> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/post-compromise-attacks/gpp-cpassword-attacks.md).

# GPP / cPassword Attacks

## Overview

**Group policy preferences (GPP)** allowed Administrators to create policies using embedded credentials. These credentials were encrypted and placed in a "cPassword". The encryption key was released by accident so the all the passwords are decryptable.

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FF33pi8ivOjKBBShTJKrd%2Fimage.png?alt=media&amp;token=cc45746a-5bfc-4265-ba5e-0d0b93ae89bf" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2FKyQPBBItb5Dol0txn5eU%2Fimage.png?alt=media&amp;token=1f96a076-4530-4c9a-9d9d-219d4efd3d96" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

## Check with PowerUp.ps1

```powerquery
. .\PowerUp.ps1
Invoke-AllCheck
```

<figure><img src="https://152155081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUczSr73L34emqNMDOxDg%2Fuploads%2F9gSyvlEkGDs50Yi6npRX%2Fimage.png?alt=media&amp;token=46bbb97b-6e98-4a01-a77a-b7f1a4c67f03" alt=""><figcaption><p>Hack the Box machine <em>Querier</em></p></figcaption></figure>

## GPP Attack via Metasploit

```bash
use auxiliary/scanner/smb/smb_enum_gpp 
```

## Mitigation

* Be up to date on patching
* Delete old GPP xml files inside the SYSVOL