Loading...

GPP attack

Created2025-05-29|Updated2025-07-15|articles

|Post Views:

Definition

A very simple attack to retrieve credentials stored in the SYSVOL share, which can be used to gain a shell or escalate privileges.

A GPP (Group Policy Preference) is an old-fashioned feature that lets you configure preferences on machines in an Active Directory. Unlike GPOs, GPPs are not strictly applied to machines in an AD domain, and allow users to modify settings after they have been applied.

GPPs are often used for :

Create desktop shortcuts
Configure network drives automatically
Change wallpapers

Principle of the attack

Prior to security update MS14-025, administrators used GPPs to deploy passwords via XML files stored in the AD SYSVOL in the policies folder (groups.xml,Drives.xml,Services.xml). These enable passwords to be used to configure parameters such as :

Local account passwords
Mapping of drives with identifiers
Services configured with privileged accounts
Scheduled tasks with stored passwords

The problem was that these passwords were encrypted in AES with a static key identical for everyone, which was made public. This means that anyone accessing the SYSVOL share can decrypt these passwords.

To exploit this attack, you can either search the file manually and look for the variable cpassword :

Then decrypt it using gpp-decrypt :

Or use metasploit’s smb_enum_gpp module if you have identifiers:

This vulnerability has now been corrected, but old xml files may persist. They should therefore be deleted to correct this vulnerability.

ActiveDirectory GPP

Related Articles

Golden Ticket Attack

A Golden ticket attack is a specific type of attack on the kerberos authentication protocol. Kerberos is used to securely authenticate users and services on a network. What is a Golden ticket attack?The Golden ticket attack exploits the way Kerberos works, and in particular the generation of the TGT by the KDC. If an attacker gains access to the krbtgt account, the account used by the KDC to sign TGTs, an attacker can create fake tickets known as “Golden Tickets”. These tickets allow an attac...

Vulnlab - Hybrid

Hybrid is an Active Directory chain containing a Windows machine and a Linux machine. Initial access is gained by compromising the Linux machine, then the domain can be compromised using an ADCS attack. EnumerationWe start by running an nmap scan on the ips provided. 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374┌──(kali㉿kali)-[~/ctf/vulnlab/hybrid]└─$ nmap -A -iL ipsStarting Nmap 7.94SVN ( https://nm...

DefinitionThe NTLM protocol is an old authentication protocol used by Windows machines to authenticate at domain or network level. It’s a Challenge / Response protocol, so it lets you authenticate to a server without the password ever passing over the network. This protocol is widely used by companies in conjunction with the Kereberos protocol. Only companies with a good cyber maturity no longer use it, as it’s not easy to do without. How it worksWhen a client wants to authenticate to a ...

Pass The Ticket Attack

This article will be a walkthrough of the ine lab concerning this attack. PowerviewPowerview is a PowerShell tool for reconnaissance in Windows domains. It contains a set of Powershell commands that replace the classic Windows commands of the net * type. We start the lab by opening a powershell command prompt and enabling script execution: Next, we can find the domain machines on which the current user is administrator: You can then launch a powershell session with one of these machines: HF...

Vulnlab - Heron

Heron is a medium-difficulty lab. The scenario assumes an initial compromise on a Linux machine attached to a domain, requiring a pivot to a domain controller in an attempt to compromise it. EnumerationLet’s start with the usual Nmap scan:The scan shows that 10.10.168.69 has no accessible ports, probably due to a firewall. On the other hand, 10.10.168.70 has port 22 open. This suggests that we should start by connecting to the Linux machine via SSH.The Wiki page tells us that this is a suppos...

SynthesisTea is an Active Directory chain containing 2 machines to be compromised. Initial access is gained by exploiting a CI/CD runner on a Gitea instance, and full domain compromise is possible through the WSUS connection of the domain controller. Initial enumerationLet’s start with an nmap scan of both machines.It looks like we’ve got a domain controller that isn’t behind a firewall and a machine hosting web services.We can retrieve the names of both machines using NetExec : We add t...

Loading Database