Skip to content

Instantly share code, notes, and snippets.

@jlawhon

jlawhon/Find-VulnerableSchemas.ps1

Forked from IISResetMe/Find-VulnerableSchemas.ps1
Created July 31, 2021 06:31
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jlawhon/c1d7269f83be02ac981c606a8d24902a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jlawhon/c1d7269f83be02ac981c606a8d24902a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @IISResetMe IISResetMe revised this gist Jul 30, 2021. 1 changed file with 24 additions and 0 deletions.
    24 changes: 24 additions & 0 deletions Update-msExchStorageGroupSchema.ps1
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,24 @@
    # Discover schema NC
    $rootDSE = Get-ADRootDSE
    $schemaNC = $rootDSE.schemaNamingContext

    # Discover schema master
    $schemaMaster = Get-ADObject $schemaNC -Properties fSMORoleOwner | Get-ADDomainController -Identity { $_.fSMORoleOwner }

    # Re-bind against RootDSE on schema master
    $rootDSE = [ADSI]::new("LDAP://$($schemaMaster.HostName)/RootDSE")

    # Prepare to refresh the schema!!!
    $schemaRefresh = {
    $rootDSE.Put("schemaUpdateNow", 1)
    $rootDSE.SetInfo()
    }

    # Fetch msExchStorageGroup schema object
    $schemaObject = Get-ADObject -LDAPFilter '(&(objectClass=classSchema)(lDAPDisplayName=msExchStorageGroup))'

    # Update schema object
    Set-ADObject -Identity $schemaObject.distinguishedName -Remove @{possSuperiors = 'computer'} -Server $schemaMaster

    # Refresh schema
    & $schemaRefresh
  2. @IISResetMe IISResetMe renamed this gist Jul 30, 2021. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → Find-VulnerableSchemas.ps1
    View file
    File renamed without changes.
  3. @IISResetMe IISResetMe created this gist Jul 30, 2021.
    34 changes: 34 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,34 @@
    # Dictionary to hold superclass names
    $superClass = @{}

    # List to hold class names that inherit from container and are allowed to live under computer object
    $vulnerableSchemas = [System.Collections.Generic.List[string]]::new()

    # Resolve schema naming context
    $schemaNC = (Get-ADRootDSE).schemaNamingContext

    # Enumerate all class schemas
    $classSchemas = Get-ADObject -LDAPFilter '(objectClass=classSchema)' -SearchBase $schemaNC -Properties lDAPDisplayName,subClassOf,possSuperiors

    # Enumerate all class schemas that computer is allowed to contain
    $computerInferiors = $classSchemas |Where-Object possSuperiors -eq 'computer'

    # Populate superclass table
    $classSchemas |ForEach-Object {
    $superClass[$_.lDAPDisplayName] = $_.subClassOf
    }

    # Resolve class inheritance for computer inferiors
    $computerInferiors |ForEach-Object {
    $class = $cursor = $_.lDAPDisplayName
    while($superClass[$cursor] -notin 'top'){
    if($superClass[$cursor] -eq 'container'){
    $vulnerableSchemas.Add($class)
    break
    }
    $cursor = $superClass[$cursor]
    }
    }

    # Outpupt list of vulnerable class schemas
    $vulnerableSchemas