Brian,
In windows 2000 resource kit tools, there is a command line called
"showacls" that you can use. You can write a vbscript to read the list of
shares that you need to check from a text file then call showacls from
within the vbscript against that list of shares. Optionally you can save the
output to a text file for your review. Showacls will show you whether or not
a user has access to a given directory, you can check the command syntax for
more information. It should not take you more than 15 minutes to write the
script.
Hope this helps,
Kresna
-----Original Message-----
From: Harlan Carvey [mailto:keydet89@yahoo.com]
Sent: Thursday, September 23, 2004 3:59 AM
To: focus-ms@securityfocus.com
Cc: Klenke, Brian; 'wnorth'
Subject: RE: VBScript to audit shares and share permissions
Brian,
Wes, in looking over the Perl Script, unless I am
missing it, the code
doesn't appear to list Share and Directory
permissions for each share, which
is really the thing that I'm after. If I missed the
line(s) of code, I apologize in advance.
You didn't miss anything. I am the author of the
script that Wes mentioned...and it doesn't list
permissions. I think it's simply another case of
someone not really reading what the original author's
request was.
I did point you to a script that does do this...
http://patriot.net/~carvdawg/perl.html
You want the share.pl script.
I need a good way to automate the process of
checking a list of hosts for
shares that allow Everyone access at the share level
and Everyone access at
file system level (and maybe some other
permissions). I can get this info
from Dumpsec, but one host at a time, and it's a
manual process.
My book, "Windows Forensics and Incident Recovery",
discusses how to do this. I include a Perl script w/
the book for dumping system names, and then parsing
through that list to automate the process of checking
just about anything.
I am also trying to avoid writing this myself, since
I don't have, what's it called? Free time? :)
I hope I can find a script or a package that will do
this already (I've
tried picking through various Nessus plugins and
such).
I'm sure your free time is limited, which is why I've
pointed you to scripts that have already been created,
and can run with little to no modification.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
