GPP / cPassword Attacks

Overview

Group policy preferences (GPP) allowed Administrators to create policies using embedded credentials. These credentials were encrypted and placed in a "cPassword". The encryption key was released by accident so the all the passwords are decryptable.

Hack the Box machine Querier

Hack the Box machine Querier

Check with PowerUp.ps1

. .\PowerUp.ps1
Invoke-AllCheck

Hack the Box machine Querier

GPP Attack via Metasploit

use auxiliary/scanner/smb/smb_enum_gpp 

Mitigation

• Be up to date on patching

• Delete old GPP xml files inside the SYSVOL