Modify Existing GPO
Modifying an existing GPO that is already applied to one or more OUs is the most straightforward scenario. To search for these, we need to enumerate all GPOs in the domain with Get-DomainGPO and check the ACL of each one with Get-DomainObjectAcl. We want to filter any for which a principal has modify privileges such as CreateChild, WriteProperty or GenericWrite, and also want to filter out the legitimate principals including SYSTEM, Domain Admins and Enterprise Admins.
beacon> powershell Get-DomainGPO | Get-DomainObjectAcl -ResolveGUIDs | ? { $_.ActiveDirectoryRights -match "CreateChild|WriteProperty" -and $_.SecurityIdentifier -match "S-1-5-21-569305411-121244042-2357301523-[\d]{4,10}" }
AceType : AccessAllowed
ObjectDN : CN={5059FAC1-5E94-4361-95D3-3BB235A23928},CN=Policies,CN=System,DC=dev,DC=cyberbotic,DC=io
ActiveDirectoryRights : CreateChild, DeleteChild, ReadProperty, WriteProperty, GenericExecute
OpaqueLength : 0
ObjectSID :
InheritanceFlags : ContainerInherit
BinaryLength : 36
IsInherited : False
IsCallback : False
PropagationFlags : None
SecurityIdentifier : S-1-5-21-569305411-121244042-2357301523-1107
AccessMask : 131127
AuditFlags : None
AceFlags : ContainerInherit
AceQualifier : AccessAllowed\
One result has been returned. Let's resolve the GPO name and the SID of the principal.
\
This shows us that members of the "Developers" group can modify "Vulnerable GPO".
We also want to know which OU(s) this GPO applies to, and by extension which computers are in those OUs. GPOs are linked to an OU by modifying the gPLink property of the OU itself. The Get-DomainOU cmdlet has a handy -GPLink parameter which takes a GPO GUID.
\
Finally, to get the computers in an OU, we can use Get-DomainComputer and use the OU's distinguished name as a search base.
\
To modify a GPO without the use of GPMC (Group Policy Management Console), we can modify the associated files directly in SYSVOL (the gpcFileSysPath).
\
We can do that manually or use an automated tool such as SharpGPOAbuse, which several abuses built into it.
Here's an example using a Computer Startup Script. It will put a startup script in SYSVOL that will be executed each time an effected computer starts (which incidentally also acts as a good persistence mechanism).
Note that you can find this software share using PowerView:
\
It can go in any remote location as long as it's accessible by the target computer(s)
\
Log into the console of Workstation 1 and run gpupdate /force from a Command Prompt. Then reboot the machine. After it starts up, the DNS Beacon will execute as SYSTEM.
\
\
SharpGPOAbuse has other functions such as adding an immediate scheduled task that you may experiment with.
Last updated