Skip to content

Commit 72f61d4

Browse files
techspencetechspence
committed
should resolve #20 
1 parent efa1088 commit 72f61d4

File tree

1 file changed

+164
-59
lines changed

1 file changed

+164
-59
lines changed

‎Invoke-ScriptSentry.ps1

+164-59
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,11 @@ Invoke-ScriptSentry -SaveOutput $true
2121
#>
2222
[CmdletBinding()]
2323
Param(
24-
[boolean]$SaveOutput = $false
24+
[boolean]$SaveOutput = $false,
25+
26+
[Management.Automation.PSCredential]
27+
[Management.Automation.CredentialAttribute()]
28+
$Credential = [Management.Automation.PSCredential]::Empty
2529
)
2630

2731
function Get-ForestDomains {
@@ -1004,7 +1008,11 @@ function Get-DomainObject {
10041008
}
10051009
function Get-LogonScripts {
10061010
[CmdletBinding()]
1007-
param()
1011+
param(
1012+
[Management.Automation.PSCredential]
1013+
[Management.Automation.CredentialAttribute()]
1014+
$Credential = [Management.Automation.PSCredential]::Empty
1015+
)
10081016

10091017
# Get the current domain name from the environment
10101018
# $currentDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
@@ -1024,7 +1032,11 @@ function Get-LogonScripts {
10241032
}
10251033
function Get-GPOLogonScripts {
10261034
[CmdletBinding()]
1027-
param()
1035+
param(
1036+
[Management.Automation.PSCredential]
1037+
[Management.Automation.CredentialAttribute()]
1038+
$Credential = [Management.Automation.PSCredential]::Empty
1039+
)
10281040

10291041
# Get the current domain name from the environment
10301042
# $currentDomain = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
@@ -1200,7 +1212,10 @@ A custom PSObject with LDAP hashtable properties translated.
12001212
function Find-AdminLogonScripts {
12011213
[CmdletBinding()]
12021214
param (
1203-
[array]$AdminUsers
1215+
[array]$AdminUsers,
1216+
[Management.Automation.PSCredential]
1217+
[Management.Automation.CredentialAttribute()]
1218+
$Credential = [Management.Automation.PSCredential]::Empty
12041219
)
12051220
# Enabled user accounts
12061221
Foreach ($Admin in $AdminUsers) {
@@ -1221,7 +1236,10 @@ function Find-LogonScriptCredentials {
12211236
[CmdletBinding()]
12221237
param(
12231238
[Parameter(Mandatory = $true)]
1224-
[array]$LogonScripts
1239+
[array]$LogonScripts,
1240+
[Management.Automation.PSCredential]
1241+
[Management.Automation.CredentialAttribute()]
1242+
$Credential = [Management.Automation.PSCredential]::Empty
12251243
)
12261244
foreach ($script in $LogonScripts) {
12271245
# Write-Verbose -Message "Checking $($Script.FullName) for credentials.."
@@ -1243,7 +1261,10 @@ function Find-UNCScripts {
12431261
[CmdletBinding()]
12441262
param(
12451263
[Parameter(Mandatory = $true)]
1246-
[array]$LogonScripts
1264+
[array]$LogonScripts,
1265+
[Management.Automation.PSCredential]
1266+
[Management.Automation.CredentialAttribute()]
1267+
$Credential = [Management.Automation.PSCredential]::Empty
12471268
)
12481269

12491270
$ExcludedMatches = "copy|&|/command|%WINDIR%|-i|\*"
@@ -1269,7 +1290,10 @@ function Find-MappedDrives {
12691290
[CmdletBinding()]
12701291
param(
12711292
[Parameter(Mandatory = $true)]
1272-
[array]$LogonScripts
1293+
[array]$LogonScripts,
1294+
[Management.Automation.PSCredential]
1295+
[Management.Automation.CredentialAttribute()]
1296+
$Credential = [Management.Automation.PSCredential]::Empty
12731297
)
12741298

12751299
$Shares = @()
@@ -1302,7 +1326,10 @@ function Find-NonexistentShares {
13021326
[CmdletBinding()]
13031327
param (
13041328
[array]$LogonScripts,
1305-
[array]$AdminUsers
1329+
[array]$AdminUsers,
1330+
[Management.Automation.PSCredential]
1331+
[Management.Automation.CredentialAttribute()]
1332+
$Credential = [Management.Automation.PSCredential]::Empty
13061333
)
13071334
$LogonScriptShares = @()
13081335
[Array] $LogonScriptShares = foreach ($script in $LogonScripts) {
@@ -1371,7 +1398,10 @@ function Find-UnsafeLogonScriptPermissions {
13711398
[Parameter(Mandatory = $true)]
13721399
[array]$LogonScripts,
13731400
[Parameter(Mandatory = $true)]
1374-
[array]$SafeUsersList
1401+
[array]$SafeUsersList,
1402+
[Management.Automation.PSCredential]
1403+
[Management.Automation.CredentialAttribute()]
1404+
$Credential = [Management.Automation.PSCredential]::Empty
13751405
)
13761406

13771407
$UnsafeRights = 'FullControl|Modify|Write'
@@ -1401,7 +1431,10 @@ function Find-UnsafeUNCPermissions {
14011431
[Parameter(Mandatory = $true)]
14021432
[array]$UNCScripts,
14031433
[Parameter(Mandatory = $true)]
1404-
[array]$SafeUsersList
1434+
[array]$SafeUsersList,
1435+
[Management.Automation.PSCredential]
1436+
[Management.Automation.CredentialAttribute()]
1437+
$Credential = [Management.Automation.PSCredential]::Empty
14051438
)
14061439

14071440
$UnsafeRights = 'FullControl|Modify|Write'
@@ -1452,7 +1485,10 @@ function Find-UnsafeLogonScriptPermissions {
14521485
[Parameter(Mandatory = $true)]
14531486
[array]$LogonScripts,
14541487
[Parameter(Mandatory = $true)]
1455-
[array]$SafeUsersList
1488+
[array]$SafeUsersList,
1489+
[Management.Automation.PSCredential]
1490+
[Management.Automation.CredentialAttribute()]
1491+
$Credential = [Management.Automation.PSCredential]::Empty
14561492
)
14571493

14581494
$UnsafeRights = 'FullControl|Modify|Write'
@@ -1482,7 +1518,10 @@ function Find-UnsafeGPOLogonScriptPermissions {
14821518
[Parameter(Mandatory = $true)]
14831519
[array]$GPOLogonScripts,
14841520
[Parameter(Mandatory = $true)]
1485-
[array]$SafeUsersList
1521+
[array]$SafeUsersList,
1522+
[Management.Automation.PSCredential]
1523+
[Management.Automation.CredentialAttribute()]
1524+
$Credential = [Management.Automation.PSCredential]::Empty
14861525
)
14871526

14881527
$UnsafeRights = 'FullControl|Modify|Write'
@@ -1538,33 +1577,127 @@ Get-Art -Version '0.6'
15381577

15391578
$SafeUsers = 'NT AUTHORITY\\SYSTEM|Administrator|NT SERVICE\\TrustedInstaller|Domain Admins|Server Operators|Enterprise Admins|CREATOR OWNER'
15401579
$AdminGroups = @("Account Operators", "Administrators", "Backup Operators", "Cryptographic Operators", "Distributed COM Users", "Domain Admins", "Domain Controllers", "Enterprise Admins", "Print Operators", "Schema Admins", "Server Operators")
1541-
$AdminUsers = $AdminGroups | ForEach-Object { (Get-DomainGroupMember -Identity $_ -Recurse | Where-Object {$_.MemberObjectClass -eq 'user'})} | Sort-Object -Property MemberName -Unique
1542-
$AdminUsers | ForEach-Object { $SafeUsers = $SafeUsers + '|' + $_.MemberName }
15431580

1544-
# Get a list of all logon scripts
1545-
$LogonScripts = Get-LogonScripts
1581+
if ($Credential.UserName) {
1582+
Write-Host "[i] Credentials detected. Running ScriptSentry as: $($Credential.UserName)"
1583+
} else {
1584+
# nothing, no creds supplied
1585+
}
1586+
1587+
if ($Credential.UserName) {
1588+
$AdminUsers = $AdminGroups | ForEach-Object { (Get-DomainGroupMember -Identity $_ -Recurse -Credential $Credential | Where-Object {$_.MemberObjectClass -eq 'user'})} | Sort-Object -Property MemberName -Unique
1589+
$AdminUsers | ForEach-Object { $SafeUsers = $SafeUsers + '|' + $_.MemberName }
1590+
1591+
# Get a list of all logon scripts
1592+
$LogonScripts = Get-LogonScripts -Credential $Credential
1593+
1594+
# Get a list of all GPO logon scripts
1595+
$GPOLogonScripts = Get-GPOLogonScripts -Credential $Credential
15461596

1547-
# Get a list of all GPO logon scripts
1548-
$GPOLogonScripts = Get-GPOLogonScripts
1597+
if ($LogonScripts) {
1598+
# Find logon scripts (.bat, .vbs, .cmd, .ps1, .kix) that contain unc paths (e.g. \\srv01\fileshare1)
1599+
$UNCScripts = Find-UNCScripts -LogonScripts $LogonScripts -Credential $Credential
15491600

1550-
if ($LogonScripts) {
1551-
# Find logon scripts (.bat, .vbs, .cmd, .ps1, .kix) that contain unc paths (e.g. \\srv01\fileshare1)
1552-
$UNCScripts = Find-UNCScripts -LogonScripts $LogonScripts
1601+
# Find mapped drives (e.g. \\srv01\fileshare1, \\srv02\fileshare2\accounting)
1602+
$MappedDrives = Find-MappedDrives -LogonScripts $LogonScripts -Credential $Credential
15531603

1554-
# Find mapped drives (e.g. \\srv01\fileshare1, \\srv02\fileshare2\accounting)
1555-
$MappedDrives = Find-MappedDrives -LogonScripts $LogonScripts
1604+
# Find nonexistent shares
1605+
$NonExistentSharesScripts = Find-NonexistentShares -LogonScripts $LogonScripts -AdminUsers $AdminUsers -Credential $Credential
1606+
$NonExistentShares = $NonExistentSharesScripts | Where-Object {$_.Exploitable -eq 'Potentially'} | Sort-Object -Property Share -Unique
15561607

1557-
# Find nonexistent shares
1558-
$NonExistentSharesScripts = Find-NonexistentShares -LogonScripts $LogonScripts -AdminUsers $AdminUsers
1559-
$NonExistentShares = $NonExistentSharesScripts | Where-Object {$_.Exploitable -eq 'Potentially'} | Sort-Object -Property Share -Unique
1608+
# Find unsafe permissions on logon scripts
1609+
$UnsafeLogonScripts = Find-UnsafeLogonScriptPermissions -LogonScripts $LogonScripts -SafeUsersList $SafeUsers -Credential $Credential
15601610

1561-
# Find unsafe permissions on logon scripts
1562-
$UnsafeLogonScripts = Find-UnsafeLogonScriptPermissions -LogonScripts $LogonScripts -SafeUsersList $SafeUsers
1611+
# Find credentials in logon scripts
1612+
$Credentials = Find-LogonScriptCredentials -LogonScripts $LogonScripts -Credential $Credential
1613+
} else {
1614+
Write-Host "[i] No logon scripts found!`n" -ForegroundColor Cyan
1615+
}
1616+
1617+
if ($UNCScripts) {
1618+
# Find unsafe permissions for unc files found in logon scripts
1619+
$UnsafeUNCPermissions = Find-UnsafeUNCPermissions -UNCScripts $UNCScripts -SafeUsersList $SafeUsers -Credential $Credential
1620+
} else {
1621+
Write-Host "[i] No UNC files found!`n" -ForegroundColor Cyan
1622+
}
1623+
1624+
if ($MappedDrives) {
1625+
# Find unsafe permissions for unc paths found in logon scripts
1626+
$UnsafeMappedDrives = Find-UnsafeUNCPermissions -UNCScripts $MappedDrives -SafeUsersList $SafeUsers -Credential $Credential
1627+
} else {
1628+
Write-Host "[i] No mapped drives found!`n" -ForegroundColor Cyan
1629+
}
15631630

1564-
# Find credentials in logon scripts
1565-
$Credentials = Find-LogonScriptCredentials -LogonScripts $LogonScripts
1631+
# Find unsafe NETLOGON & SYSVOL share permissions
1632+
$NetlogonSysvol = Get-NetlogonSysvol
1633+
$UnsafeNetlogonSysvol = Find-UnsafeUNCPermissions -UNCScripts $NetlogonSysvol -SafeUsersList $SafeUsers -Credential $Credential
1634+
1635+
if ($GPOLogonScripts) {
1636+
# Find unsafe permissions on GPO logon scripts
1637+
$UnsafeGPOLogonScripts = Find-UnsafeGPOLogonScriptPermissions -GPOLogonScripts $GPOLogonScripts -SafeUsersList $SafeUsers -Credential $Credential
1638+
} else {
1639+
Write-Host "[i] No GPO logon scripts found!`n" -ForegroundColor Cyan
1640+
}
1641+
1642+
# Find admins that have logon scripts assigned
1643+
$AdminLogonScripts = Find-AdminLogonScripts -AdminUsers $AdminUsers -Credential $Credential
15661644
} else {
1567-
Write-Host "[i] No logon scripts found!`n" -ForegroundColor Cyan
1645+
$AdminUsers = $AdminGroups | ForEach-Object { (Get-DomainGroupMember -Domain (Get-Domain).Name -Identity $_ -Recurse | Where-Object {$_.MemberObjectClass -eq 'user'})} | Sort-Object -Property MemberName -Unique
1646+
$AdminUsers | ForEach-Object { $SafeUsers = $SafeUsers + '|' + $_.MemberName }
1647+
1648+
# Get a list of all logon scripts
1649+
$LogonScripts = Get-LogonScripts
1650+
1651+
# Get a list of all GPO logon scripts
1652+
$GPOLogonScripts = Get-GPOLogonScripts
1653+
1654+
if ($LogonScripts) {
1655+
# Find logon scripts (.bat, .vbs, .cmd, .ps1, .kix) that contain unc paths (e.g. \\srv01\fileshare1)
1656+
$UNCScripts = Find-UNCScripts -LogonScripts $LogonScripts
1657+
1658+
# Find mapped drives (e.g. \\srv01\fileshare1, \\srv02\fileshare2\accounting)
1659+
$MappedDrives = Find-MappedDrives -LogonScripts $LogonScripts
1660+
1661+
# Find nonexistent shares
1662+
$NonExistentSharesScripts = Find-NonexistentShares -LogonScripts $LogonScripts -AdminUsers $AdminUsers
1663+
$NonExistentShares = $NonExistentSharesScripts | Where-Object {$_.Exploitable -eq 'Potentially'} | Sort-Object -Property Share -Unique
1664+
1665+
# Find unsafe permissions on logon scripts
1666+
$UnsafeLogonScripts = Find-UnsafeLogonScriptPermissions -LogonScripts $LogonScripts -SafeUsersList $SafeUsers
1667+
1668+
# Find credentials in logon scripts
1669+
$Credentials = Find-LogonScriptCredentials -LogonScripts $LogonScripts
1670+
} else {
1671+
Write-Host "[i] No logon scripts found!`n" -ForegroundColor Cyan
1672+
}
1673+
1674+
if ($UNCScripts) {
1675+
# Find unsafe permissions for unc files found in logon scripts
1676+
$UnsafeUNCPermissions = Find-UnsafeUNCPermissions -UNCScripts $UNCScripts -SafeUsersList $SafeUsers
1677+
} else {
1678+
Write-Host "[i] No UNC files found!`n" -ForegroundColor Cyan
1679+
}
1680+
1681+
if ($MappedDrives) {
1682+
# Find unsafe permissions for unc paths found in logon scripts
1683+
$UnsafeMappedDrives = Find-UnsafeUNCPermissions -UNCScripts $MappedDrives -SafeUsersList $SafeUsers
1684+
} else {
1685+
Write-Host "[i] No mapped drives found!`n" -ForegroundColor Cyan
1686+
}
1687+
1688+
# Find unsafe NETLOGON & SYSVOL share permissions
1689+
$NetlogonSysvol = Get-NetlogonSysvol
1690+
$UnsafeNetlogonSysvol = Find-UnsafeUNCPermissions -UNCScripts $NetlogonSysvol -SafeUsersList $SafeUsers
1691+
1692+
if ($GPOLogonScripts) {
1693+
# Find unsafe permissions on GPO logon scripts
1694+
$UnsafeGPOLogonScripts = Find-UnsafeGPOLogonScriptPermissions -GPOLogonScripts $GPOLogonScripts -SafeUsersList $SafeUsers
1695+
} else {
1696+
Write-Host "[i] No GPO logon scripts found!`n" -ForegroundColor Cyan
1697+
}
1698+
1699+
# Find admins that have logon scripts assigned
1700+
$AdminLogonScripts = Find-AdminLogonScripts -AdminUsers $AdminUsers
15681701
}
15691702

15701703
if ($NonExistentShares) {
@@ -1574,34 +1707,6 @@ if ($NonExistentShares) {
15741707
Write-Host "[i] No non-existent shares found!`n" -ForegroundColor Cyan
15751708
}
15761709

1577-
if ($UNCScripts) {
1578-
# Find unsafe permissions for unc files found in logon scripts
1579-
$UnsafeUNCPermissions = Find-UnsafeUNCPermissions -UNCScripts $UNCScripts -SafeUsersList $SafeUsers
1580-
} else {
1581-
Write-Host "[i] No UNC files found!`n" -ForegroundColor Cyan
1582-
}
1583-
1584-
if ($MappedDrives) {
1585-
# Find unsafe permissions for unc paths found in logon scripts
1586-
$UnsafeMappedDrives = Find-UnsafeUNCPermissions -UNCScripts $MappedDrives -SafeUsersList $SafeUsers
1587-
} else {
1588-
Write-Host "[i] No mapped drives found!`n" -ForegroundColor Cyan
1589-
}
1590-
1591-
# Find unsafe NETLOGON & SYSVOL share permissions
1592-
$NetlogonSysvol = Get-NetlogonSysvol
1593-
$UnsafeNetlogonSysvol = Find-UnsafeUNCPermissions -UNCScripts $NetlogonSysvol -SafeUsersList $SafeUsers
1594-
1595-
if ($GPOLogonScripts) {
1596-
# Find unsafe permissions on GPO logon scripts
1597-
$UnsafeGPOLogonScripts = Find-UnsafeGPOLogonScriptPermissions -GPOLogonScripts $GPOLogonScripts -SafeUsersList $SafeUsers
1598-
} else {
1599-
Write-Host "[i] No GPO logon scripts found!`n" -ForegroundColor Cyan
1600-
}
1601-
1602-
# Find admins that have logon scripts assigned
1603-
$AdminLogonScripts = Find-AdminLogonScripts -AdminUsers $AdminUsers
1604-
16051710
# Show all results
16061711
if ($UnsafeMappedDrives) {Show-Results $UnsafeMappedDrives}
16071712
if ($UnsafeLogonScripts) {Show-Results $UnsafeLogonScripts}

0 commit comments

Comments
 (0)