Group Policy Modification
Sub-technique of T1484 Domain or Tenant Policy Modification ↗
Editing a Group Policy Object you have rights over to run code on the machines it applies to.
How it shows up on Hack The Box
If BloodHound shows GenericWrite or WriteDacl over a GPO linked to the domain controllers, an immediate scheduled task (pyGPOAbuse, SharpGPOAbuse) makes you an admin.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Passwords in Active Directory: GPP (Groups.xml), LAPS and gMSA 3 min read Three places where the domain itself stores passwords you can read: cpassword in Groups.xml, the LAPS local admin password and the hash of gMSA accounts.