Excessive Share Privileges Dashboard
+Results Overview
Insecure ACEs
+ ++ + $ExcessiveSharePrivsCount +
+
Risk Level | +Computer | +Share Name | +Share Path | +ACE | +ACE Identity | +Share Owner | +Creation Date | +Modified Date | +Files | + +
---|
diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index cbec3c2..05cd851 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.64 +# Version: v1.66 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -1363,7 +1363,7 @@ function Analyze-HuntSMBShares } # ---------------------------------------------------------------------- - # Calculate risk score per acl + # Calculate risk score per acl - ACE INSIGHTS # ---------------------------------------------------------------------- # add interesting file flags # add risk score @@ -1579,6 +1579,84 @@ function Analyze-HuntSMBShares $RiskLevelCountHigh = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'High' | measure | select count -ExpandProperty count $RiskLevelCountCritical = $ExcessiveSharePrivsFinal | where RiskLevel -eq 'Critical' | measure | select count -ExpandProperty count + # Create table for ACEs page + $AceTableRows = $ExcessiveSharePrivsFinal | + foreach { + + # Risk Level + $AceRowRiskScore = $_.RiskScore + $AceRowRiskLevel = $_.RiskLevel + + # Read + $AceRowHasRead = $_.HasRead + + # Write + $AceRowHasWrite = $_.HasWrite + + # HR + $AceRowHasHR = $_.HasHR + + # RCE + $AceRowHasRCE = $_.HasRCE + + # Has sesntive secrests + $AceRowHasSecrets = $_.HasSecrets + + # Has sesntive data + $AceRowHasIF = $_.HasIF + + # Computer + $AceRowComputer = $_.ComputerName + + # Share Name + $AceRowShareName = $_.ShareName + + # Share Path + $AceRowSharePath = $_.SharePath + + # ACE + $AceRowACE = $_.FileSystemRights + + # Identity + $AceRowIdentity = $_.IdentityReference + + # Share Owner + $AceRowShareOwner = $_.ShareOwner + + # Created + $AceRowCreated = $_. CreationDate + + # Modified + $AceRowModified = $_.LastModifiedDate + + # Files + $AceRowFilecount = $_.FileCount + $AceRowFileList = $_.FileList + + $AceRow = @" +
Risk Level | +Computer | +Share Name | +Share Path | +ACE | +ACE Identity | +Share Owner | +Creation Date | +Modified Date | +Files | + +
---|