PowerHuntShares: análisis de privilegios excesivos en Directorio Activo
El exceso de ACLs de recursos compartidos SMB es un problema sistémico y una superficie de ataque con la que todas las organizaciones luchan.
PowerHuntShares es una herramienta diseñada para inventariar, analizar y reportar automáticamente los privilegios excesivos asignados a los recursos compartidos SMB en los equipos unidos a un dominio de Active Directory.
Está pensado para ayudar a los equipos de IAM y otros blue teams a comprender mejor la superficie de ataque de sus recursos compartidos SMB y proporciona información para ayudar a agrupar de forma natural los recursos compartidos para facilitar y poder escalar fácilmente su corrección.
Características:
- Autenticar utilizando el contexto del usuario actual, una credencial o un usuario/contraseña en texto claro.
- Descubrir automáticamente los sistemas accesibles asociados a un dominio de Active Directory. También filtrará los ordenadores de Active Directory en función de los puertos abiertos disponibles.
- Puede dirigirse a un solo ordenador, a una lista de ordenadores o a los ordenadores de Active Directory descubiertos (por defecto).
- Recopilar información de ACL de recursos compartidos SMB de los ordenadores de destino mediante PowerShell.
- Analizar los datos de ACL compartidos recopilados.
- Realizar informes con un resumen general o detallados con los privilegios excesivos en formatos de archivo HTML y CSV.
PowerHuntShares hará un inventario de las ACL de recursos compartidos SMB configuradas con “privilegios excesivos” y destacará las ACL de “alto riesgo”. A continuación se explica cómo se definen en este contexto.
Los permisos excesivos de lectura y escritura de recursos compartidos se han definido como cualquier ACL de recursos compartidos de red que contenga una ACE (entrada de control de acceso) explícita para los grupos “Everyone”, “Authenticated Users”, “BUILTINsers”, “Domain Users” o “Domain Computers”.
Todos proporcionan a los usuarios del dominio acceso a los recursos compartidos afectados debido a problemas de herencia de privilegios. Hay que tener en cuenta que hay un parámetro que permite a los operadores añadir sus propios grupos de destino.
A continuación, un background adicional:
- Todos (everyone) es una referencia directa que se aplica tanto a los usuarios no autenticados como a los autenticados. Normalmente sólo se requiere una sesión nula para acceder a esos recursos.
- BUILTINUsers contiene Usuarios Autenticados
- Los Usuarios Autenticados contienen Usuarios de Dominio en sistemas unidos al dominio. Por eso, los usuarios de dominio pueden acceder a un recurso compartido cuando los permisos de recurso compartido se han asignado a “BUILTIN\Users”.
- Usuarios del dominio es una referencia directa
- Los Usuarios del Dominio también pueden crear hasta 10 cuentas de ordenador por defecto que se colocan en el grupo de Ordenadores del Dominio
- Los usuarios del dominio que tienen acceso administrativo local a un ordenador unido al dominio también pueden suplantar la cuenta del ordenador.
Nota: Los permisos de recursos compartidos pueden ser anulados por los permisos NTFS. Además, hay que tener en cuenta que las pruebas excluyen los nombres de recursos compartidos que contienen las siguientes palabras clave
print$, prnproc$, printer, netlogon,y sysvol
Recursos compartidos de alto riesgo
En el contexto de este informe, los recursos compartidos de alto riesgo se han definido como recursos compartidos que proporcionan acceso remoto no autorizado a un sistema o aplicación. Por defecto, esto incluye los recursos compartidos
wwwroot, inetpub, c$, y admin$
Sin embargo, pueden existir otros riesgos a parte de esos…
Instalación
# Bypass execution policy restrictions
Set-ExecutionPolicy -Scope Process Bypass
# Import module that exists in the current directory
Import-Module .PowerHuntShares.psm1
or
# Reduce SSL operating level to support connection to github
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
[Net.ServicePointManager]::SecurityProtocol =[Net.SecurityProtocolType]::Tls12
# Download and load PowerHuntShares.psm1 into memory
IEX(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/NetSPI/PowerHuntShares/main/PowerHuntShares.psm1")
Ejemplos de uso
.EXAMPLE 1: Run from a domain computer. Performs Active Directory computer discovery by default.
PS C:temptest> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:temptest
.EXAMPLE 2: Run from a domain computer with alternative domain credentials. Performs Active Directory computer discovery by default.
PS C:temptest> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:temptest -Credentials domainuser
.EXAMPLE 3: Run from a domain computer as current user. Target hosts in a file. One per line.
PS C:temptest> Invoke-HuntSMBShares -Threads 100 -OutputDirectory c:temptest -HostList c:temphosts.txt
.EXAMPLE 4: Run from a non-domain computer with credential. Performs Active Directory computer discovery by default.
C:temptest> runas /netonly /user:domainuser PowerShell.exe
PS C:temptest> Import-Module Invoke-HuntSMBShares.ps1
PS C:temptest> Invoke-HuntSMBShares -Threads 100 -RunSpaceTimeOut 10 -OutputDirectory c:folder -DomainController 10.1.1.1 -Credential domainuser
===============================================================
PowerHuntShares
===============================================================
This function automates the following tasks:
o Determine current computer's domain
o Enumerate domain computers
o Filter for computers that respond to ping reqeusts
o Filter for computers that have TCP 445 open and accessible
o Enumerate SMB shares
o Enumerate SMB share permissions
o Identify shares with potentially excessive privielges
o Identify shares that provide reads & write access
o Identify shares thare are high risk
o Identify common share owners, names, & directory listings
o Generate creation, last written, & last accessed timelines
o Generate html summary report and detailed csv files
Note: This can take hours to run in large environments.
---------------------------------------------------------------
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---------------------------------------------------------------
SHARE DISCOVERY
---------------------------------------------------------------
[*][03/01/2021 09:35] Scan Start
[*][03/01/2021 09:35] Output Directory: c:tempsmbsharesSmbShareHunt-03012021093504
[*][03/01/2021 09:35] Successful connection to domain controller: dc1.demo.local
[*][03/01/2021 09:35] Performing LDAP query for computers associated with the demo.local domain
[*][03/01/2021 09:35] - 245 computers found
[*][03/01/2021 09:35] Pinging 245 computers
[*][03/01/2021 09:35] - 55 computers responded to ping requests.
[*][03/01/2021 09:35] Checking if TCP Port 445 is open on 55 computers
[*][03/01/2021 09:36] - 49 computers have TCP port 445 open.
[*][03/01/2021 09:36] Getting a list of SMB shares from 49 computers
[*][03/01/2021 09:36] - 217 SMB shares were found.
[*][03/01/2021 09:36] Getting share permissions from 217 SMB shares
[*][03/01/2021 09:37] - 374 share permissions were enumerated.
[*][03/01/2021 09:37] Getting directory listings from 33 SMB shares
[*][03/01/2021 09:37] - Targeting up to 3 nested directory levels
[*][03/01/2021 09:37] - 563 files and folders were enumerated.
[*][03/01/2021 09:37] Identifying potentially excessive share permissions
[*][03/01/2021 09:37] - 33 potentially excessive privileges were found across 12 systems..
[*][03/01/2021 09:37] Scan Complete
---------------------------------------------------------------
SHARE ANALYSIS
---------------------------------------------------------------
[*][03/01/2021 09:37] Analysis Start
[*][03/01/2021 09:37] - 14 shares can be read across 12 systems.
[*][03/01/2021 09:37] - 1 shares can be written to across 1 systems.
[*][03/01/2021 09:37] - 46 shares are considered non-default across 32 systems.
[*][03/01/2021 09:37] - 0 shares are considered high risk across 0 systems
[*][03/01/2021 09:37] - Identified top 5 owners of excessive shares.
[*][03/01/2021 09:37] - Identified top 5 share groups.
[*][03/01/2021 09:37] - Identified top 5 share names.
[*][03/01/2021 09:37] - Identified shares created in last 90 days.
[*][03/01/2021 09:37] - Identified shares accessed in last 90 days.
[*][03/01/2021 09:37] - Identified shares modified in last 90 days.
[*][03/01/2021 09:37] Analysis Complete
---------------------------------------------------------------
SHARE REPORT SUMMARY
---------------------------------------------------------------
[*][03/01/2021 09:37] Domain: demo.local
[*][03/01/2021 09:37] Start time: 03/01/2021 09:35:04
[*][03/01/2021 09:37] End time: 03/01/2021 09:37:27
[*][03/01/2021 09:37] Run time: 00:02:23.2759086
[*][03/01/2021 09:37]
[*][03/01/2021 09:37] COMPUTER SUMMARY
[*][03/01/2021 09:37] - 245 domain computers found.
[*][03/01/2021 09:37] - 55 (22.45%) domain computers responded to ping.
[*][03/01/2021 09:37] - 49 (20.00%) domain computers had TCP port 445 accessible.
[*][03/01/2021 09:37] - 32 (13.06%) domain computers had shares that were non-default.
[*][03/01/2021 09:37] - 12 (4.90%) domain computers had shares with potentially excessive privileges.
[*][03/01/2021 09:37] - 12 (4.90%) domain computers had shares that allowed READ access.
[*][03/01/2021 09:37] - 1 (0.41%) domain computers had shares that allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) domain computers had shares that are HIGH RISK.
[*][03/01/2021 09:37]
[*][03/01/2021 09:37] SHARE SUMMARY
[*][03/01/2021 09:37] - 217 shares were found. We expect a minimum of 98 shares
[*][03/01/2021 09:37] because 49 systems had open ports and there are typically two default shares.
[*][03/01/2021 09:37] - 46 (21.20%) shares across 32 systems were non-default.
[*][03/01/2021 09:37] - 14 (6.45%) shares across 12 systems are configured with 33 potentially excessive ACLs.
[*][03/01/2021 09:37] - 14 (6.45%) shares across 12 systems allowed READ access.
[*][03/01/2021 09:37] - 1 (0.46%) shares across 1 systems allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) shares across 0 systems are considered HIGH RISK.
[*][03/01/2021 09:37]
[*][03/01/2021 09:37] SHARE ACL SUMMARY
[*][03/01/2021 09:37] - 374 ACLs were found.
[*][03/01/2021 09:37] - 374 (100.00%) ACLs were associated with non-default shares.
[*][03/01/2021 09:37] - 33 (8.82%) ACLs were found to be potentially excessive.
[*][03/01/2021 09:37] - 32 (8.56%) ACLs were found that allowed READ access.
[*][03/01/2021 09:37] - 1 (0.27%) ACLs were found that allowed WRITE access.
[*][03/01/2021 09:37] - 0 (0.00%) ACLs were found that are associated with HIGH RISK share names.
[*][03/01/2021 09:37]
[*][03/01/2021 09:37] - The 5 most common share names are:
[*][03/01/2021 09:37] - 9 of 14 (64.29%) discovered shares are associated with the top 5 share names.
[*][03/01/2021 09:37] - 4 backup
[*][03/01/2021 09:37] - 2 ssms
[*][03/01/2021 09:37] - 1 test2
[*][03/01/2021 09:37] - 1 test1
[*][03/01/2021 09:37] - 1 users
[*] -----------------------------------------------
Powered by WPeMatico
