# Service Permission Checker && Folder Perms Checker
# Ben Turner @benpturner
<#
.Synopsis
Service Permission Checker
.DESCRIPTION
Permission Checker : Equivlent to:
$_.FullName | Select-Object pschildname,pspath,accesstostring} catch{}}|Export-Csv C:\temp\acl.csv -NoTypeInformation
.EXAMPLE
PS C:\> Get-ServicePerms
#>
Function Get-ServicePerms {
$csharp= @"
using System;
using System.Data;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Text;
using System.Threading;
using System.Management;
using System.Text.RegularExpressions;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Xml;
using System.Collections;
using System.ServiceProcess;
using System.Net;
public static class ServicePerms
{
static List<string> folderlist;
public static void dumpfolderperms(List<string> folderlist, DataSet ds)
{
//DataSet ds = new DataSet();
ds.Tables.Add("folders");
ds.Tables["folders"].Columns.Add("Folder");
ds.Tables["folders"].Columns.Add("Permissions");
string permstring = null;
string cpermstring = null;
foreach (string value in folderlist)
{
permstring = null;
cpermstring = null;
try
{
FileSecurity fileSecurity = new FileSecurity(value, AccessControlSections.Access);
AuthorizationRuleCollection arc = fileSecurity.GetAccessRules(true, true, typeof(NTAccount));
foreach (FileSystemAccessRule rule in arc)
{
permstring = "";
permstring = rule.IdentityReference + " " + rule.AccessControlType + " " + rule.FileSystemRights;
// is this case sensitive
if (permstring.Contains("Users") & permstring.Contains("Modify"))
{
permstring = "<b><div style=\"color:red;\">**" + permstring + "</div></b>";
}
if (permstring.Contains("Users") & permstring.Contains("FullControl"))
{
permstring = "<b><div style=\"color:red;\">**" + permstring + "</div></b>";
}
if (permstring.Contains("Everyone") & permstring.Contains("Modify"))
{
permstring = "<b><div style=\"color:red;\">**" + permstring + "</div></b>";
}
if (permstring.Contains("Everyone") & permstring.Contains("FullControl"))
{
permstring = "<b><div style=\"color:red;\">**" + permstring + "</div></b>";
}
cpermstring = cpermstring + permstring + " <br>";
}
}
catch
{
}
ds.Tables["folders"].Rows.Add(value, cpermstring);
}
String hostName = Dns.GetHostName();
string contents = ConvertDataTableToHtml(ds.Tables["services"]);
string contentsfolders = ConvertDataTableToHtml2(ds.Tables["folders"]);
File.WriteAllText("Report-" + hostName + ".html", contents + contentsfolders);
}
public static void dumpservices()
{
String hostName = Dns.GetHostName();
List<string> list = new List<string>();
folderlist = new List<string>();
//List<string> folderlist = new List<string>();
DataSet ds = new DataSet();
ds.Tables.Add("services");
ds.Tables["services"].Columns.Add("Service Name");
ds.Tables["services"].Columns.Add("Unquoted");
ds.Tables["services"].Columns.Add("ImagePath");
ds.Tables["services"].Columns.Add("Permissions");
ds.Tables["services"].Columns.Add("Service Information");
ObjectQuery query = new ObjectQuery("SELECT * FROM Win32_Service");
ManagementObjectSearcher searcher = new ManagementObjectSearcher(query);
foreach (ManagementObject queryObj in searcher.Get())
{
String input = "";
try {
if (queryObj["PathName"].ToString() == "") {
continue;
} else {
input = queryObj["PathName"].ToString();
}
} catch {
}
string key = "";
string unquoted = "";
Match match = Regex.Match(input, @"^(.+?).exe", RegexOptions.IgnoreCase);
// Here we check the Match instance.
if (match.Success)
{
//Check for unquotes service paths
string unqu = match.Groups[1].Value + ".exe";
if (!unqu.Contains("\"") && unqu.Contains(" "))
{
unquoted = "Unquoted**";
}
else
{
unquoted = "False";
}
// Finally, we get the Group value and display it.
key = match.Groups[1].Value + ".exe";
key = key.Replace("\"", "");
string permsstring = null;
string currentpermstring = null;
try
{
FileSecurity fileSecurity = new FileSecurity(key, AccessControlSections.Access);
var file_info = new FileInfo(key);
//file_info.Directory.Parent
AuthorizationRuleCollection arc = fileSecurity.GetAccessRules(true, true, typeof(NTAccount));
foreach (FileSystemAccessRule rule in arc)
{
// find if users modify
// if it contains everyone or users with modify or fullControl then flag as bold or something.....
// or search through the html after.....
currentpermstring = "";
currentpermstring = rule.IdentityReference + " " + rule.AccessControlType + " " + rule.FileSystemRights;
// is this case sensitive
if (currentpermstring.Contains("Users") & currentpermstring.Contains("Modify"))
{
currentpermstring = "<b><div style=\"color:red;\">**" + currentpermstring + "</div></b>";
}
if (currentpermstring.Contains("Users") & currentpermstring.Contains("FullControl"))
{
currentpermstring = "<b><div style=\"color:red;\">**" + currentpermstring + "</div></b>";
}
if (currentpermstring.Contains("Everyone") & currentpermstring.Contains("Modify"))
{
currentpermstring = "<b><div style=\"color:red;\">**" + currentpermstring + "</div></b>";
}
if (currentpermstring.Contains("Everyone") & currentpermstring.Contains("FullControl"))
{
currentpermstring = "<b><div style=\"color:red;\">**" + currentpermstring + "</div></b>";
}
permsstring = permsstring + currentpermstring + " <br>";
}
}
catch
{
permsstring = "Path not found: " + key + "\n";
}
var key2 = "";
Match match2 = Regex.Match(key, @"^(.*[\\\/])[^\\\/]*$", RegexOptions.IgnoreCase);
if (match2.Success)
{
key2 = match2.Groups[1].ToString();
}
var file = new FileInfo(key);
var directory2 = file.Directory;
while (directory2 != null)
{
if (!folderlist.Contains(directory2.FullName.ToString().ToLower()))
{
folderlist.Add(directory2.FullName.ToString().ToLower());
}
directory2 = directory2.Parent;
}
string serviceinformation = "";
// Try and see if the service can be stopped or restarted
ServiceController svc = new ServiceController(queryObj["Name"].ToString());
try
{
serviceinformation = svc.Status.ToString();
bool canstop = svc.CanPauseAndContinue;
bool canstart = svc.CanStop;
bool canshutdown = svc.CanShutdown;
serviceinformation = serviceinformation + "<br>CanPauseAndContinue:" + canstop + "<br>CanStart:" + canstart + "<br>CanShutdown:" + canshutdown;
//svc.Start();
}
catch (Exception ex)
{
Console.WriteLine("Error" + ex);
}
ds.Tables["services"].Rows.Add(queryObj["DisplayName"].ToString() + " (" + queryObj["Name"].ToString() + ")", unquoted, queryObj["PathName"].ToString(), permsstring, serviceinformation);
}
}
DirSearch("C:\\");
dumpfolderperms(folderlist, ds);
}
public static void DirSearch(string sDir)
{
try
{
foreach (string d in Directory.GetDirectories(sDir))
{
folderlist.Add(d);
DirSearch(d);
}
}
catch (System.Exception excpt)
{
Console.WriteLine(excpt.Message);
}
}
public static string ConvertDataTableToHtml(DataTable targetTable)
{
if (targetTable == null)
{
throw new ArgumentNullException("targetTable");
}
StringBuilder builder = new StringBuilder();
builder.Append("<html>");
builder.Append("<head>");
builder.Append("<title>");
builder.Append("Page-");
builder.Append(Guid.NewGuid().ToString());
builder.Append("</title>");
builder.Append("</head>");
builder.Append("<body>");
builder.Append("<h1>Service Permissions - Search for ** to find any vulnerabilities........</h1>");
builder.Append("<table border='1px' cellpadding='5' cellspacing='0' ");
builder.Append("style='border: solid 1px Black; font-size: small;'>");
builder.Append("<tr align='left' valign='top'>");
foreach (DataColumn column in targetTable.Columns)
{
builder.Append("<td align='left' valign='top'>");
builder.Append(column.ColumnName);
builder.Append("</td>");
}
builder.Append("</tr>");
foreach (DataRow row in targetTable.Rows)
{
builder.Append("<tr align='left' valign='top'>");
foreach (DataColumn column2 in targetTable.Columns)
{
builder.Append("<td align='left' valign='top'>");
builder.Append(row[column2.ColumnName].ToString());
builder.Append("</td>");
}
builder.Append("</tr>");
}
builder.Append("</table>");
builder.Append("</body>");
builder.Append("</html>");
return builder.ToString();
}
public static string ConvertDataTableToHtml2(DataTable targetTable)
{
if (targetTable == null)
{
throw new ArgumentNullException("targetTable");
}
StringBuilder builder = new StringBuilder();
builder.Append("<html>");
builder.Append("<head>");
builder.Append("<title>");
builder.Append("Page-");
builder.Append(Guid.NewGuid().ToString());
builder.Append("</title>");
builder.Append("</head>");
builder.Append("<body>");
builder.Append("<table border='1px' cellpadding='5' cellspacing='0' ");
builder.Append("style='border: solid 1px Black; font-size: small;'>");
builder.Append("<tr align='left' valign='top'>");
foreach (DataColumn column in targetTable.Columns)
{
builder.Append("<td align='left' valign='top'>");
builder.Append(column.ColumnName);
builder.Append("</td>");
}
builder.Append("</tr>");
foreach (DataRow row in targetTable.Rows)
{
builder.Append("<tr align='left' valign='top'>");
foreach (DataColumn column2 in targetTable.Columns)
{
builder.Append("<td align='left' valign='top'>");
builder.Append(row[column2.ColumnName].ToString());
builder.Append("</td>");
}
builder.Append("</tr>");
}
builder.Append("</table>");
builder.Append("</body>");
builder.Append("</html>");
return builder.ToString();
}
}
"@
$Assem = "System.Data",
"System.Xml.Linq",
"System.Xml",
"System.Data.Entity",
"System.Management",
"System.Management.Instrumentation",
"System.ServiceProcess"
Add-Type -TypeDefinition $csharp -Language CSharpVersion3 -IgnoreWarnings -ReferencedAssemblies $Assem
[ServicePerms]::dumpservices()
$complete = "[+] Writing output to Report-" + $env:COMPUTERNAME + ".html"
echo "[+] Completed Service Permissions Review"
echo "$complete"
}