PowerHuntShares v2

PowerHuntShares es una herramienta de PowerShell diseñada para ayudar a los equipos de ciberseguridad y probadores de penetración a identificar, comprender, atacar y remediar mejor los recursos compartidos SMB en los entornos de Active Directory que protegen. Todo hacker tiene una historia sobre el abuso de recursos compartidos SMB, pero es una superficie de ataque que los equipos de ciberseguridad todavía luchan por defender. Este proyecto tiene como objetivo proporcionar una herramienta de prueba de concepto abierta para crear un inventario completo de recursos compartidos, aprovechando estadísticas, gráficos, diagramas y modelos de lenguaje para contextualizar los recursos compartidos, resumir relaciones, evaluar riesgos y priorizar la remediación.

Admite funcionalidad para:

Autenticarse usando el contexto de usuario actual, una credencial o usuario/contraseña en texto claro.
Descubrir sistemas accesibles asociados con un dominio de Active Directory automáticamente. También filtrará equipos de Active Directory según los puertos abiertos disponibles.
Apuntar a un solo equipo, una lista de equipos o equipos de Active Directory descubiertos (predeterminado).
Recolectar información de ACL de recursos compartidos SMB de equipos objetivo usando PowerShell.
Analizar los datos de ACL de recursos compartidos recolectados.
Reportar informes resumidos y detalles de privilegios excesivos en formatos HTML y CSV.

Características adicionales:

Funciones LLM independientes: https://github.com/NetSPI/PowerHuntShares/blob/main/Scripts/Invoke-FingerPrintShare.ps1
Analizadores de contraseñas independientes: https://github.com/NetSPI/PowerHuntShares/tree/main/Scripts/ConfigParsers

Recursos de PowerHuntShares v2:

Blog de la v2: https://www.netspi.com/blog/technical-blog/network-pentesting/powerhuntshares-2-0-release/

Recursos de PowerHuntShares v1:

Blog de la v1: https://www.netspi.com/blog/technical/network-penetration-testing/network-share-permissions-powerhuntshares/
Video de presentación de la v1: https://www.youtube.com/watch?v=TtwyQchCz6E
Diapositivas de presentación de la v1: https://github.com/NetSPI/PowerHuntShares/blob/main/Presentations/SO-CON_2025_Sutherland_Hunting_SMB_Shares_Final.pdf

Vocabulario

PowerHuntShares inventariará las ACL de recursos compartidos SMB configuradas con "privilegios excesivos" y destacará las ACL de "alto riesgo". A continuación se define cómo se definen en este contexto.

Privilegios excesivos
Los permisos de lectura y escritura excesivos en recursos compartidos se han definido como cualquier ACL de recurso compartido de red que contenga una ACE (Entrada de Control de Acceso) explícita para los grupos "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users" o "Domain Computers". Todos proporcionan acceso a los usuarios del dominio a los recursos compartidos afectados debido a problemas de herencia de privilegios. Tenga en cuenta que hay un parámetro que permite a los operadores agregar sus propios grupos objetivo.
A continuación se presenta información adicional de contexto:

Everyone es una referencia directa que se aplica tanto a usuarios no autenticados como autenticados. Normalmente solo se requiere una sesión nula para acceder a esos recursos.
BUILTIN\Users contiene a Authenticated Users
Authenticated Users contiene a Domain Users en sistemas unidos al dominio. Es por eso que Domain Users puede acceder a un recurso compartido cuando los permisos del recurso se han asignado a "BUILTIN\Users".
Domain Users es una referencia directa
Domain Users también puede crear hasta 10 cuentas de equipo por defecto que se colocan en el grupo Domain Computers
Domain Users que tienen acceso administrativo local a un equipo unido al dominio también pueden suplantar la cuenta del equipo.

Tenga en cuenta: Los permisos del recurso compartido pueden ser anulados por los permisos NTFS. Además, tenga en cuenta que las pruebas excluyen los nombres de recursos compartidos que contienen las siguientes palabras clave:

print$, prnproc$, printer, netlogon, y sysvol

Recursos compartidos de alto riesgo
En el contexto de este informe, los recursos compartidos de alto riesgo se definen como aquellos que proporcionan acceso remoto no autorizado a un sistema o aplicación. Por defecto, esto incluye los recursos compartidos

wwwroot, inetpub, c$, y admin$

Sin embargo, pueden existir exposiciones adicionales que no se mencionan explícitamente.

Comandos de configuración

A continuación se muestra una lista de comandos que se pueden usar para cargar PowerHuntShares en su sesión actual de PowerShell. Tenga en cuenta que se deberá ejecutar uno de estos cada vez que ejecute PowerShell. No es persistente.

# Bypass execution policy restrictions
Set-ExecutionPolicy -Scope Process Bypass

# Import module that exists in the current directory
Import-Module .\PowerHuntShares.psm1

or

# Reduce SSL operating level to support connection to github
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
[Net.ServicePointManager]::SecurityProtocol =[Net.SecurityProtocolType]::Tls12

# Download and load PowerHuntShares.psm1 into memory
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/NetSPI/PowerHuntShares/main/PowerHuntShares.psm1")

Ejemplos de comandos

Nota importante: Todos los comandos deben ejecutarse como un usuario de dominio sin privilegios.

.EXAMPLE 1: Run from a domain computer. Performs Active Directory computer discovery by default.
PS C:\temp\test> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:\temp\test 

.EXAMPLE 2: Run from a domain computer with alternative domain credentials. Performs Active Directory computer discovery by default.
PS C:\temp\test> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:\temp\test -Credential domain\user

.EXAMPLE 3: Run from a domain computer as current user. Target hosts in a file. One per line.
PS C:\temp\test> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:\temp\test  -HostFile c:\temp\hosts.txt      

.EXAMPLE 4: Run from a non-domain computer with credential. Performs Active Directory computer discovery by default.
C:\temp\test> runas /netonly /user:domain\user PowerShell.exe
PS C:\temp\test> Import-Module PowerHuntShares.psm1
PS C:\temp\test> Invoke-HuntSMBShares -Threads 100 -RunSpaceTimeout 10 -OutputDirectory c:\folder\ -DomainController 10.1.1.1 -Credential domain\user

===============================================================
PowerHuntShares
===============================================================
 This function automates the following tasks:     

 o Determine current computer's domain
 o Enumerate domain computers        
 o Filter for computers that respond to ping reqeusts          
 o Filter for computers that have TCP 445 open and accessible  
 o Enumerate SMB shares 
 o Enumerate SMB share permissions   
 o Identify shares with potentially excessive privielges       
 o Identify shares that provide reads & write access           
 o Identify shares thare are high risk
 o Identify common share owners, names, & directory listings   
 o Generate creation, last written, & last accessed timelines
 o Generate html summary report and detailed csv files         

 Note: This can take hours to run in large environments.       
---------------------------------------------------------------
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---------------------------------------------------------------
SHARE DISCOVERY      
---------------------------------------------------------------
[*][03/01/2021 09:35] Scan Start
[*][03/01/2021 09:35] Output Directory: c:\temp\smbshares\SmbShareHunt-03012021093504
[*][03/01/2021 09:35] Successful connection to domain controller: dc1.demo.local
[*][03/01/2021 09:35] Performing LDAP query for computers associated with the demo.local domain
[*][03/01/2021 09:35] - 245 computers found
[*][03/01/2021 09:35] Pinging 245 computers
[*][03/01/2021 09:35] - 55 computers responded to ping requests.
[*][03/01/2021 09:35] Checking if TCP Port 445 is open on 55 computers
[*][03/01/2021 09:36] - 49 computers have TCP port 445 open.
[*][03/01/2021 09:36] Getting a list of SMB shares from 49 computers
[*][03/01/2021 09:36] - 217 SMB shares were found.
[*][03/01/2021 09:36] Getting share permissions from 217 SMB shares
[*][03/01/2021 09:37] - 374 share permissions were enumerated.
[*][03/01/2021 09:37] Getting directory listings from 33 SMB shares
[*][03/01/2021 09:37] - Targeting up to 3 nested directory levels
[*][03/01/2021 09:37] - 563 files and folders were enumerated.
[*][03/01/2021 09:37] Identifying potentially excessive share permissions
[*][03/01/2021 09:37] - 33 potentially excessive privileges were found across 12 systems..
[*][03/01/2021 09:37] Scan Complete
---------------------------------------------------------------
SHARE ANALYSIS      
---------------------------------------------------------------
[*][03/01/2021 09:37] Analysis Start
[*][03/01/2021 09:37] - 14 shares can be read across 12 systems.
[*][03/01/2021 09:37] - 1 shares can be written to across 1 systems.
[*][03/01/2021 09:37] - 46 shares are considered non-default across 32 systems.
[*][03/01/2021 09:37] - 0 shares are considered high risk across 0 systems
[*][03/01/2021 09:37] - Identified top 5 owners of excessive shares.
[*][03/01/2021 09:37] - Identified top 5 share groups.
[*][03/01/2021 09:37] - Identified top 5 share names.
[*][03/01/2021 09:37] - Identified shares created in last 90 days.
[*][03/01/2021 09:37] - Identified shares accessed in last 90 days.
[*][03/01/2021 09:37] - Identified shares modified in last 90 days.
[*][03/01/2021 09:37] Analysis Complete
---------------------------------------------------------------
SHARE REPORT SUMMARY      
---------------------------------------------------------------
[*][03/01/2021 09:37] Domain: demo.local
[*][03/01/2021 09:37] Start time: 03/01/2021 09:35:04
[*][03/01/2021 09:37] End time: 03/01/2021 09:37:27
[*][03/01/2021 09:37] Run time: 00:02:23.2759086
[*][03/01/2021 09:37] 
[*][03/01/2021 09:37] COMPUTER SUMMARY
[*][03/01/2021 09:37] - 245 domain computers found.
[*][03/01/2021 09:37] - 55 (22.45%) domain computers responded to ping.
[*][03/01/2021 09:37] - 49 (20.00%) domain computers had TCP port 445 accessible.
[*][03/01/2021 09:37] - 32 (13.06%) domain computers had shares that were non-default.
[*][03/01/2021 09:37] - 12 (4.90%) domain computers had shares with potentially excessive privileges.
[*][03/01/2021 09:37] - 12 (4.90%) domain computers had shares that allowed READ access.
[*][03/01/2021 09:37] - 1 (0.41%) domain computers had shares that allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) domain computers had shares that are HIGH RISK.
[*][03/01/2021 09:37] 
[*][03/01/2021 09:37] SHARE SUMMARY
[*][03/01/2021 09:37] - 217 shares were found. We expect a minimum of 98 shares
[*][03/01/2021 09:37]   because 49 systems had open ports and there are typically two default shares.
[*][03/01/2021 09:37] - 46 (21.20%) shares across 32 systems were non-default.
[*][03/01/2021 09:37] - 14 (6.45%) shares across 12 systems are configured with 33 potentially excessive ACLs.
[*][03/01/2021 09:37] - 14 (6.45%) shares across 12 systems allowed READ access.
[*][03/01/2021 09:37] - 1 (0.46%) shares across 1 systems allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) shares across 0 systems are considered HIGH RISK.
[*][03/01/2021 09:37] 
[*][03/01/2021 09:37] SHARE ACL SUMMARY
[*][03/01/2021 09:37] - 374 ACLs were found.
[*][03/01/2021 09:37] - 374 (100.00%) ACLs were associated with non-default shares.
[*][03/01/2021 09:37] - 33 (8.82%) ACLs were found to be potentially excessive.
[*][03/01/2021 09:37] - 32 (8.56%) ACLs were found that allowed READ access.
[*][03/01/2021 09:37] - 1 (0.27%) ACLs were found that allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) ACLs were found that are associated with HIGH RISK share names.
[*][03/01/2021 09:37] 
[*][03/01/2021 09:37] - The 5 most common share names are:
[*][03/01/2021 09:37] - 9 of 14 (64.29%) discovered shares are associated with the top 5 share names.
[*][03/01/2021 09:37]   - 4 backup
[*][03/01/2021 09:37]   - 2 ssms
[*][03/01/2021 09:37]   - 1 test2
[*][03/01/2021 09:37]   - 1 test1
[*][03/01/2021 09:37]   - 1 users
[*] -----------------------------------------------

Ejemplos de informes HTML

Página de resumen del informe

Página de archivos interesantes

Página de secretos extraídos

Página del explorador ShareGraph

Créditos

Autor
Scott Sutherland (@_nullbind)

Código de código abierto utilizado
Estas personas escribieron código de código abierto que se utilizó como parte de este proyecto. ¡Un gran agradecimiento a ellos y su trabajo!

Nombre	Sitio
Will Schroeder (@harmj0y)	https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1

Licencia
BSD 3-Clause

Tareas pendientes

Correcciones/Errores pendientes

Update code to avoid defender
Password extraction functions current return a "valid" record when the fields are found in the file, but the have blank values. Also, some directories appear to be treated as files.
ACLs associated with Builtin\Users sometimes shows up as LocalSystem under undefined conditions, and as a result, doesnt show up in the Excessive Privileges export. - Thanks Sam!

Funcionalidades pendientes

Add powerhuntshares version to html report output
Add options to opt out of interesting file enumeration and secrets parsing.
Add ability to specify additional groups to target
Add file content search.
Add DontExcludePrintShares option
Add auto targeting of groups that contain a large % of the user population; over 70% (make configurable). Add as option.
Add configuration fid: netlogon and sysvol you may get access denied when using windows 10 unless the setting below is configured. Automat a check for this, and attempt to modify if privs are at correct level. gpedit.msc, go to Computer -> Administrative Templates -> Network -> Network Provider -> Hardened UNC Paths, enable the policy and click "Show" button. Enter your server name (* for all servers) into "Value name" and enter the folowing text "RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0" wihtout quotes into the "Value" field.
Add active sessions data to help identify potential owners/users of share.
Pull spns and computer description/spn account descriptions to help identify owner/business unit.
Create bloodhound import file / edge (highrisk share)
Add better support for IPv6, IPv6 addresses dont show up in subnets summary
Dynamic identification of spikes in high risk share creation/common groupings, need to better summarize supporting detail beyond just the timeline. For each of the data insights, add average number of shares created for insight grouping by year/month (for folder hash / name etc), and the increase the month/year it spikes. (attempt to provide some historical context); maybe even list the most common non default directories being used by each of those. Potentially adding "first seen date" as well. (in alpha)
Dynamic identification of share creation, modification, and access cadence across a share population that share a name and have a high similarity level.
add showing share permissions (along with the already displayed NTFS permissions) and resultant access (most restrictive wins)
add depth, file/directory flag
So. Many. Other. Things.