How a normal domain user with no admin privileges can exploit Group Policy Preferences (GPP) passwords to become local administrator across the organisation.
Scenario: you are a normal user in your company’s domain. No admin privileges. Nothing. You can’t even install a program on your machine. What if I told you that you can be the local administrator on your machine and probably on MANY more across your organization?
I am not able to count the number of things you are able to do as a local admin (evil / non-evil) :-)… for this post am going to demonstrate how to simply move from a normal user and gain local admin privileges. This is an attack vector I have been using in various security assessments I have been doing. Time to let the cat out of the bag… haha.
What are Group Policy Preferences Passwords?
In a nutshell, sys admins have 100 plus machines on a domain, and want to configure all the machines, chances are they are bound to use the same local admin password to install programs and configure the machines in the domain. They use the GPO to do this; hence the use of the Group Policy Preference Password to conveniently push same password to all hosts in the domain. Convenience at the expense of security – how many times do we see that??
Ways to find the GPP password?
To be honest, countless. But I shall show a few effective methods here:
1. Manually traversing SYSVOL
Traverse to \\<domain name>\SYSVOL\<domain name>\Policies\ and look for *.xml files; specifically Groups.xml or Services.xml.
Opening one of the Groups.xml files we see a cpassword field which is encrypted. Game over? NO. Microsoft published the decryption AES key publicly – a whole 32-byte static AES key. Let that sink in. So basically decrypt and have your local administrator password… in CLEARTEXT.
2. Using PowerShell Tools
For rapid execution, there are multiple PowerShell tools to find and decrypt GPP passwords automatically. An example is Get-GPPPassword.ps1 from PowerSploit.
3. Metasploit & Custom Finders
Trust Metasploit not to get left out — post/windows/gather/credentials/gpp module can enumerate and decrypt cpassword entries automatically across SYSVOL shares.
Now that we have the local admin password...
The mere fact that you have got this password from GPP tells you one thing – chances are that it is used on most if not all machines in the domain! Think about the lateral movement that is possible, the dumping of credentials – Mimikatz across the entire estate.
Remember this is not a new attack vector; the reason I am highlighting this is because in almost every internal penetration testing assessment, this has been a recurring vulnerability.