RE: VBScript to audit shares and share permissions

From: Kresna Prawira (kprawira_at_esurance.com)
Date: 09/25/04

  • Next message: Jens Mickerts: "RE: Fw: Serious Security Issue in Windows XP SP2's Firewall" 
    To: focus-ms@securityfocus.com
Date: Fri, 24 Sep 2004 17:40:52 -0700

    Brian,

    In windows 2000 resource kit tools, there is a command line called
    "showacls" that you can use. You can write a vbscript to read the list of
    shares that you need to check from a text file then call showacls from
    within the vbscript against that list of shares. Optionally you can save the
    output to a text file for your review. Showacls will show you whether or not
    a user has access to a given directory, you can check the command syntax for
    more information. It should not take you more than 15 minutes to write the
    script.

    Hope this helps,

    Kresna

    -----Original Message-----
    From: Harlan Carvey [mailto:keydet89@yahoo.com]
    Sent: Thursday, September 23, 2004 3:59 AM
    To: focus-ms@securityfocus.com
    Cc: Klenke, Brian; 'wnorth'
    Subject: RE: VBScript to audit shares and share permissions

    Brian,

    > Wes, in looking over the Perl Script, unless I am
    > missing it, the code
    > doesn't appear to list Share and Directory
    > permissions for each share, which
    > is really the thing that I'm after. If I missed the
    > line(s) of code, I apologize in advance.

    You didn't miss anything. I am the author of the
    script that Wes mentioned...and it doesn't list
    permissions. I think it's simply another case of
    someone not really reading what the original author's
    request was.

    I did point you to a script that does do this...
    http://patriot.net/~carvdawg/perl.html
    You want the share.pl script.

    > I need a good way to automate the process of
    > checking a list of hosts for
    > shares that allow Everyone access at the share level
    > and Everyone access at
    > file system level (and maybe some other
    > permissions). I can get this info
    > from Dumpsec, but one host at a time, and it's a
    > manual process.

    My book, "Windows Forensics and Incident Recovery",
    discusses how to do this. I include a Perl script w/
    the book for dumping system names, and then parsing
    through that list to automate the process of checking
    just about anything.

    > I am also trying to avoid writing this myself, since
    > I don't have, what's it called? Free time? :)
    >
    > I hope I can find a script or a package that will do
    > this already (I've
    > tried picking through various Nessus plugins and
    > such).

    I'm sure your free time is limited, which is why I've
    pointed you to scripts that have already been created,
    and can run with little to no modification.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jens Mickerts: "RE: Fw: Serious Security Issue in Windows XP SP2's Firewall"

    Relevant Pages

    • Re: VBScript and opening html page
      ... to open page from vbscript? ... >> My script is checking permissions and when see, ... >> I have three possibilities by permissions. ... > Dim objIEA ...
      (microsoft.public.scripting.vbscript)
    • Re: VBScript and opening html page
      ... > How can I open html webpage from VBScript? ... > My script is checking permissions and when see, ... > I have three possibilities by permissions. ... Set objIEA = CreateObject ...
      (microsoft.public.scripting.vbscript)
    • Opening html from vbscript
      ... I have check.aspx page with VBScript. ... My script is checking permissions and when see, ... I have three possibilities by permissions. ... If I have 3 level then check.aspx open for me page3 ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Ping Steve Yandl or other VBScript gurus
      ... post on the vbscript newsgroup and that got me going in the right direction. ... 'Run macro named createResumeFromFile, which has no arguments, and catch its ... 'Exit the script with the value of the return code from the macro/function. ... how to do what I want to do entirely in VBA or VBScript; ...
      (microsoft.public.word.vba.general)
    • Re: LDAP query information
      ... execution of the vbscript? ... The error message indicates the line number in the script, ... Dim strBase, strFilter, strAttributes, strQuery, adoRecordset ... ' Construct LDAP syntax query. ...
      (microsoft.public.windows.server.scripting)