GPOddity
GPOddity combines NTLM relaying with the modification of a GPO:
The target user has
WriteDACLover a GPORelay credentials of the target user for modifying the path of the GP template (
gPCFileSysPath)Load a malicious template from an attacker-controlled location
The target user has WriteDACL over a GPO:
Relay the LDAP service on the DC (172.16.2.1) to the attack's machine (172.160.100.37):
Create a shortcut pointing to the attacker's relay server:
Copy the .LNK file to the target share:
Back on the relay server:
Assign the WriteDACL permissions over the target GPO on the attacker (domain user):
Alternatively, if we don't have compromised a domain user, we can add a computer object and assign the permissions to it:
Execute the GPOddity attack:
Create the share and move the malicious template to it:
From a SYSTEM shell point configure the share's path and permissions:
Check the policy's attribute with PowerView:
When the policy refreshes:
Last updated
Was this helpful?