> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-attacks/gpp-cpassword-attacks.md).

# GPP / cPassword Attacks

## Overview

**Group policy preferences (GPP)** allowed Administrators to create policies using embedded credentials. These credentials were encrypted and placed in a "cPassword". The encryption key was released by accident so the all the passwords are decryptable.

<figure><img src="/files/WQnVEUWiEBXBVZxLFbNK" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

<figure><img src="/files/LhZOzoOlcq0lj8SpIsDQ" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

## Check with PowerUp.ps1

```powerquery
. .\PowerUp.ps1
Invoke-AllCheck
```

<figure><img src="/files/Jz7MCoxOKfdJGJM4pEYL" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

## GPP Attack via Metasploit

```bash
use auxiliary/scanner/smb/smb_enum_gpp 
```

## Mitigation

* Be up to date on patching
* Delete old GPP xml files inside the SYSVOL