GPO Implementation: Two-Component Architecture

▶ Watch (2:03)

A Group Policy Object has two parts. The Group Policy Container (GPC) lives in LDAP and stores metadata: GUID, version, flags, and the GPC file path attribute that points to the SMB share. The Group Policy Template (GPT) sits in the SYSVOL share and contains the actual configuration files (Group.xml, Registry.xml, etc.). The GUID ties them together. The GPC file path attribute defines the UNC path to the GPT. By default it points to SYSVOL, but any arbitrary SMB path works. Setting it to an attacker-controlled IP causes clients to fetch malicious GPT files.

Stealthy GPO Enumeration with GPO Parser

▶ Watch (9:59)

GPO enumeration reveals where users have local admin rights via group membership, privilege assignments (SeDebugPrivilege), connection restrictions, and registry hardening (disabling LLMNR, MDNS). Wilfried showed that BloodHound ignores blocked inheritance and enforced links, producing false attack paths. GPO Parser, released on the Synacktiv GitHub, processes all GPO parameters: inheritance, enforcement, flags, and item-level targeting. It supports online collection with a low-privilege account and offline analysis on exported LDAP + SYSVOL data. The tool enriches BloodHound with proper edges for lateral movement.

Exploiting GPO Write Access with GroupPolicyBackdoor.py

▶ Watch (22:18)

When you control a GPO, you can deploy malicious configurations to all linked OUs. Existing tools (PyGPOAbuse, GPOAbuse) lacked cleanup and targeting. GroupPolicyBackdoor.py solves this. It uses only LDAP and SMB, creates state folders for clean revert, and supports item-level targeting to hit specific computers. The demo showed compromising a jump server used by domain admins: the tool injected a scheduled task that ran as a domain admin and added the attacker’s user to Domain Admins. After exploitation, a clean command removed the injected configuration from the GPO.

NTLM Relay Attack on GPO via GPOT

▶ Watch (31:51)

Relay an NTLM-authenticated user who has write access to a GPC but no SYSVOL privileges. Quentin modified the GPC file path attribute on the GPC to point to an attacker SMB server. The attacker runs GPOT, which implements a domain-joined SMB server using Netlogon authentication. When the victim (e.g., a domain controller) refreshes GPOs, it connects to the attacker’s SMB share and applies a malicious GPT that adds the attacker’s machine account to the local Administrators group. The demo showed gaining local admin on a domain controller via this relay-only attack.

▶ Watch (38:01)

Protected OUs (AdminCount=1) block ACL inheritance, preventing traditional OU exploits. UNET poisons the GPLink attribute on the OU to inject a fake GPO that points to an attacker-controlled domain name. The attacker runs a fake LDAP and SMB server to serve a malicious GPT. The tool requires only the “manage GPO links” permission on the target OU. The demo targeted a PKI server OU: the attacker wrote a GPLink pointing to unet.co.com, and when the PKI server refreshed GPOs, it applied a scheduled task that added the attacker’s user to the local Administrators group.

Notable Quotes

so they enumerate DCS they find out they can exploit ESC4 with a previous escalation they exploited it successfully but at the end they got detected Wilfried “wil_fri3d” Bécard · ▶ 0:58

we created the group policy back door.py tool this is a Python implementation using only LDAP and SMB protocol Quentin “quent0x1” Roland · ▶ 22:18

we were wondering is this even exploitable and it turns out that yes it is Quentin “quent0x1” Roland · ▶ 30:07

Key Takeaways

  • GPO enumeration reveals lateral movement paths that BloodHound’s ACL-based analysis misses.
  • GroupPolicyBackdoor.py provides safe, targetable, and revertible GPO exploitation.
  • NTLM relay to LDAP plus GPC file path modification enables GPO hijack without SYSVOL access.
  • GPLink poisoning bypasses protected OU inheritance blocks with low privileges.