Group Policy Preferences cpassword → user takeover

§ Context

Assumed environment: at least one GPP file (Groups.xml, ScheduledTasks.xml, Services.xml, DataSources.xml, Drives.xml, Printers.xml) in SYSVOL contains a non-empty cpassword field.

§ Steps

1. 01
   Authenticate as recovered accountInitial Access

   T1078— Valid Accounts
2. 02
   Any authenticated userInitial Access

   T1078— Valid Accounts
3. 03
   Map account's access via BloodHoundDiscovery

   AD-BLOODHOUND— BloodHound / SharpHound Enumeration
4. 04
   AES-decrypt with published keyCredential Access

   AD-GPP-CPASSWORD— GPP cpassword Recovery (MS14-025)
5. 05
   Hunt SYSVOL for cpasswordDiscovery

   AD-NETEXEC— NetExec / CrackMapExec Sweep

   Get-GPPPassword / nxc smb -M gpp_password

§ References

• T1078Valid Accounts

§ Frequently asked

What is the "Group Policy Preferences cpassword → user takeover" attack path?

Pre-MS14-025 GPPs left cpassword-encrypted credentials in SYSVOL with a published AES key. Any authenticated user can decrypt them. It chains 5 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Authenticate as recovered account (T1078) — a initial access primitive. Assumed environment: at least one GPP file (Groups.

What is the final impact of this kill-chain?

The final step lands on Hunt SYSVOL for cpassword (AD-NETEXEC), which falls under Discovery. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Leaked legacy VPN credential → ransomware (Colonial-class)

  A dormant VPN account whose password appeared in a third-party breach is still active, has no MFA enforced. Sign in, recon AD, deploy ransomware across the estate.

• Shared techniques2

  Citrix Bleed → steal authenticated session → MFA bypass

  Send a long Host header to a vulnerable NetScaler — memory disclosure leaks an authenticated session token already past MFA. Replay the token to log into the corporate VPN.

• Shared techniques2

  WriteDACL on a privileged user → ForceChangePassword → takeover

  Discover a misconfigured ACL that lets a low-priv user modify the ACL of a Tier-0 account, grant ForceChangePassword to themselves, reset the victim's password, and log in.

• Shared techniques2

  GenericWrite on Domain Admins → AddMember → DA

  A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.

• Shared techniques2

  GPO write rights → Immediate scheduled task → SYSTEM on OU

  GenericWrite on a linked GPO (or write rights to its SYSVOL folder) lets you drop a ScheduledTasks.xml that fires as SYSTEM on every machine in the OU at the next gpupdate.

• Shared techniques2

  Unconstrained delegation → Capture DC TGT → DCSync

  Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.