GPP Attack
Last updated
Was this helpful?
Last updated
Was this helpful?
MS14-025
The Group Policy Preferences allowed admins to create policies using embedded credentials
These credentials were encrypted and placed into XML document and stored in the type called as cPassword.
The key of this was accidently released. It was patched in MS14-025 but it doesn’t prevent previous issues.
Most of the times these credentials are domain admin credentials and give access to domain admin accounts.
Mostly found on Server 2012 machines.
The password hash can be found in Groups.xml file
We can use gpp-decrypt tool to decrypt the password: gpp-decrypt <hash>
We can then use GetUserSPNs to dump the service account hash. This can then be cracked using hashcat and used with psexec to log into the machine.
