GPP / cPassword Attacks

Overview

Group policy preferences (GPP) allowed Administrators to create policies using embedded credentials. These credentials were encrypted and placed in a "cPassword". The encryption key was released by accident so the all the passwords are decryptable.

Hack the Box machine Querier
Hack the Box machine Querier

Check with PowerUp.ps1

. .\PowerUp.ps1
Invoke-AllCheck
Hack the Box machine Querier

GPP Attack via Metasploit

use auxiliary/scanner/smb/smb_enum_gpp

Mitigation

  • Be up to date on patching

  • Delete old GPP xml files inside the SYSVOL

PreviousLNK File AttacksNextMimikatz

Last updated

Was this helpful?