Group Policy Preferences
Sub-technique of T1552 Unsecured Credentials ↗
Decrypting the cpassword in GPP XML files on SYSVOL, encrypted with a key Microsoft published.
How it shows up on Hack The Box
Any domain user can read SYSVOL: look for Groups.xml (and Services.xml, ScheduledTasks.xml) and decrypt with gpp-decrypt. A classic on older boxes such as Active.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Cross-Site Scripting (XSS)
- CSRF
- SQL injection
- SSRF
- Saved credentials / DPAPI
- ADCS (certificates)
- NTLM capture and relay
- Pass-the-hash / ticket
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- SAM/LSA/LSASS dumping
- ACL abuse (BloodHound)
- GPP and GPO abuse
- Hash cracking
Guides
- Passwords in Active Directory: GPP (Groups.xml), LAPS and gMSA 3 min read Three places where the domain itself stores passwords you can read: cpassword in Groups.xml, the LAPS local admin password and the hash of gMSA accounts.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
NetExec (nxc) › Kerberos and credentials
GPP passwords in SYSVOL
nxc smb 10.10.11.20 -u usuario -p 'Password123!' -M gpp_passwordNo command matches.