GPO Abuse
DACL Attacks
There are two main attack paths related to Group Policy Objects (GPOs).
The first involves permissions to modify a GPO. If a user can edit a GPO, they can change its configuration and cause commands or scripts to execute on every computer where that policy is applied.
The second involves permissions to link a GPO to an Active Directory (AD) object such as an Organisation Unit (OU), domain, or site. On its own, this permission is not always sufficient for abuse. However, when combined with the ability to create or modify GPOs, it allows an attacker to attach a malicious policy to systems in the environment.
When enumerating GPOs from a security perspective, four main characteristics should be analyzed:
Non-administrative users who can modify GPOs – these represent potential targets for abuse.
Where those GPOs are linked – these indicate the potential impact of modifying the policy.
Non-administrative users who can link GPOs – these provide possible attack avenues.
Users who can create new GPOs – these may allow an attacker to introduce a malicious policy into the domain.
Understanding these relationships helps determine whether a compromised account can influence systems through Group Policy.
GPO Enumeration - Windows
The first step is usually to enumerate existing GPOs in the domain. Using PowerView, we can retrieve information about domain policies.
# Enumerate the first domain GPO
Get-DomainGPO | Select-Object -First 1
# List all GPOs
Get-DomainGPO -Properties displaynameSeveral properties are particularly important when reviewing GPO objects.
displayname
The name displayed for the GPO in tools such as the Group Policy Management Console (GPMC). Administrators typically identify policies using this name.
name
The unique identifier of the GPO, usually a GUID. This value uniquely identifies the policy within AD.
gpcfilesyspath
The file system path containing the GPO files inside the SYSVOL share on domain controllers. These files hold the policy configuration and are replicated across the domain.
objectguid
A globally unique identifier used by AD and applications that interact programmatically with the GPO.
Identifying Where GPOs are Applied
GPO links are stored in the gPLink attribute of domain objects such as domains, sites, and OUs. This attribute references the GUID of the linked policy. In the following example, the GUID corresponds to the Default Domain Policy. The number at the end represents link options.
0→ enabled1→ disabled2→ enforced3→ enforced but disabled
Identifying Users with GPO Modification Rights
Another important task is identifying users who have permissions to modify GPOs. The following command searches for non-default users (SIDs greater than 1000) who possess potentially dangerous permissions.
The same approach can be used to identify GPO links at different levels of the AD hierarchy.
To determine which systems might be affected by a linked GPO, the computers within the targeted OUs can be listed.
Identifying Users with GPO Creation Rights
Another important privilege is the ability to create new GPOs. This permission can also be enumerated by analyzing the ACLs of the container where GPO objects are stored.
If the necessary administrative tools are available, new GPOs can be created using the GroupPolicy module included with Remote Server Administration Tools (RSAT) or PowerGPOAbuse.
Identifying Users with GPO Link Rights
Users with the ability to link GPOs can modify the gPLink attribute on sites, domains, or OUs. The following commands enumerate those permissions.
A GPO can then be linked using the GroupPolicy module:
Automating GPO Enumeration
The Get-GPOEnumeration script (a wrapper around PowerView) automates the process of identifying potentially exploitable GPO permissions. When executed without parameters, it searches for:
GPOs that non-administrative users can modify
Where those GPOs are linked
Additional parameters include: -ModifyGPOs, -LinkGPOs, and -CreateGPO.
GPO Abuse - Windows
Once a user has the ability to edit a GPO, they can introduce malicious configurations that will be executed on affected systems. A common tool for this purpose is SharpGPOAbuse (Invoke-SharpGPOAbuse.ps1). Another option available in PowerView is the New-GPOImmediateTask command, which creates a scheduled task through the policy.
It is important to note that using the --AddLocalAdmin option may overwrite existing administrator settings if the modified GPO has higher priority. If local administrator configurations already exist on the affected systems, they may be replaced.
GPO Enumeration - Linux
GPO enumeration can also be performed from Linux systems. Tools such as GPOwned and pywerview provide functionality similar to PowerView. The former's gpcmachine and gpcuser flags target GPOs related to computers and users respectively.
Site-level links are not included by default, so these may need to be queried directly from the Sites container in Active Directory. To identify users with GPO modification rights, GPOwned can be combined with dacledit.
GPO Abuse - Linux
To abuse a GPO from Linux, pyGPOAbuse can be used. This tool partially implements the functionality of SharpGPOAbuse and allows execution of commands through scheduled tasks or PowerShell.
GPOddity
GPOddity combines NTLM relaying with the modification of a GPO:
The target user has
WriteDACLover a GPORelay credentials of the target user for modifying the path of the GP template (
gPCFileSysPath)Load a malicious template from an attacker-controlled location
The target user has WriteDACL over a GPO:
Relay the LDAP service on the DC (172.16.2.1) to the attack's machine (172.160.100.37):
Create a shortcut pointing to the attacker's relay server:
Copy the .LNK file to the target share:
Back on the relay server:
Assign the WriteDACL permissions over the target GPO on the attacker (domain user):
Alternatively, if we don't have compromised a domain user, we can add a computer object and assign the permissions to it:
Execute the GPOddity attack:
Create the share and move the malicious template to it:
From a SYSTEM shell point configure the share's path and permissions:
Check the policy's attribute with PowerView:
When the policy refreshes:
Last updated