Up next on the list is the GBP or group policy preferences attack also known as M.S. 14 0 2 5.
So a quick overview.
The group policy preferences allowed admins to create policies using embedded credentials.
Now these credentials were encrypted and they were placed into an Excel document and they were stored
in this type called C password.
Now the C password was encrypted.
As I said and the key to this encryption was accidentally released and so therefore we can decrypt it.
Now this has been patched in M.S. 14 0 2 5 and prevents issues going forward.
However it does not prevent previous issues.
So what that means is if an admin has stored a group policy preference embedded credential before the
patch was implemented then this will still display a credential to us.
Now most of the time these credentials are domain admin credentials and will allow us access to domain
admin accounts.
This is not going to come up that often but it is still something that you should be checking for because
there are a lot of Server 2012 machines out there for example that this was not patched on or has been
patched but this was running on previously.
So what we're gonna do is we're going to cover how to do this and it's actually kind of difficult to
setup in the lab environment.
So we're going to do is we're actually going to use half the box to attack this before we do that.
I am going to reference an article here.
Now this article is by rapid 7 and I'm going to pace it down below.
But this kind of shows you what GBP is and what the uses were.
And you could see here that a password was stored and if we scroll down quickly we can see that the
password was stored in the swiss ball.
So as long as you have a user account and we can read that ball and it says here any domain user this
is why this is a post exploitation attack.
Once we have a domain user we can attempt to read this since all it stored here in the C password you
can see it all we have to do is run a GP decrypt which is built into Calleigh and it will decrypt the
password.
Now there is this SMB a Newham GP here.
This is a medical flight module and I really want you to write this down.
This is how you would check for this.
So you would say you have a shell and medicinally you can background that Shell run the SMB a new GP
or you can run the post on the GP and see if you can't enumerate this and gain a username and password
similar to this before I have seen this come up in previous assessments.
And this is always something that you should be checking for even if it's older.
So from here we're going to utilize hack the box there's a machine on there called active.
We're going to use that and it's got two great examples of what we just learned on here so I'm going
to challenge you once we get to the next video on solving half of the equation.
We'll walk through the first half and talk about this GBP and see a live example of it.
So I'm going to go ahead and catch you over in the next video when we explore this GBP attack.