SharpGPOAbuse

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

GPO abuses have been covered previously by @harmj0y and @_wald0 in the following blog posts which we highly recommend reading:

• https://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
• https://wald0.com/?p=179

PowerView also supports the addition of a new immediate task that will execute when the GPO is pulled by the client machines. However, there were times when it was not possible to successfully use PowerView's New-GPOImmediateTask function. After digging a bit more into how we can edit the GPO manually we also came across the following blog post from @_RastaMouse:

• https://rastamouse.me/2019/01/gpo-abuse-part-2/

Essentially, it is possible to modify a GPO by creating or modifying files in SYSVOL. The configuration for each GPO is saved in the following location:

However, there are a few caveats. In order to successfully update the GPO manually by editing the files in SYSVOL we also need to update the following:

• The value of the gPCMachineExtensionNames attribute of the GPO object (if we are editing the Computer policy).
• The value of the versionNumber attribute of the GPO object.
• The value of the version within the GPT.ini file in SYSVOL.

The version in GPT.ini and the versionNumber attribute of the GPO object must have the same value and must also be increased after performing any changes in order to enable client machines to pull any changes during their normal group policy update cycle.

In addition, the gPCMachineExtensionNames must have the GUID that corresponds to the settings we have modified. A list of GUIDs can be found here:

• https://blogs.technet.microsoft.com/mempson/2010/12/01/group-policy-client-side-extension-list/

For example, in order to add a new startup script, the following GUIDs must be added in the value of gPCMachineExtensionNames attribute of the GPO object:

SharpGPOAbuse will take care of all of the above and can be used to perform the following actions:

• Add rights to a user such as SeDebugPrivilege, SeTakeOwnershipPrivilege, etc.
• Add a new startup script.
• Add a new immediate task.
• Add a user to the local admins group.

SharpGPOAbuse has been built against .NET 3.5 and is compatible with Visual Studio 2017. The code is located at: 

• https://github.com/mwrlabs/SharpGPOAbuse

CommandLineParser has been used in order to parse the command line arguments. This package will need to be installed by issuing the following command into the NuGet Package Manager Console:

After compiling the project, merge the SharpGPOAbuse.exe and the CommandLine.dll into one executable file using ILMerge:

SharpGPOAbuse can be extended to support more functionality for abusing GPOs. Examples of such functionality include:

• Open ports on host-based firewalls.
• Add a malicious service.
• Modify registry key values.

This tool was originally developed by Petros Koutroumpis (@pkb1s).