Lab Walkthrough Demonstrates Active Directory GPO Abuse and Defenses
Summary
An Active Directory lab walkthrough shows how low-privilege users with delegated write access to a domain-linked GPO can deploy tasks, scripts, local administrators, and reverse shells, and describes ways to detect and mitigate the abuse.
Key points
- In the ignite.local lab, a low-privilege account with write access to a domain-linked GPO is used to execute code on in-scope systems, including a Domain Controller.
- BloodHound identifies writable GPOs; pyGPOAbuse, SharpGPOAbuse, and StandIn demonstrate modifying policy content to deploy scheduled tasks, scripts, and Restricted Groups changes.
- The walkthrough demonstrates creating local administrator accounts and obtaining interactive shells in user or SYSTEM contexts.
- The examples use Linux network access or a Windows foothold, showing different ways to modify GPO content through the available tools.
- Defensive guidance includes treating GPO write access as Tier 0, limiting delegation and link scope, and auditing GPO permissions.
- The article recommends monitoring SYSVOL and LDAP changes, including gPCMachineExtensionNames updates and policy files such as ScheduledTasks.xml and GptTmpl.inf.
Article Details
- Topic
- Abuse of writable Group Policy Objects to escalate privileges and execute code across an Active Directory domain
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 192[.]168[.]1[.]17 | Attacker-controlled Kali lab host used to receive reverse-shell callbacks and serve payloads. |
| IPV4 | 192[.]168[.]1[.]7 | Identified as the reverse-shell callback address in the SharpGPOAbuse demonstration. |
| URL | hxxp[:]//192[.]168[.]1[.]17/file.hta | Specific HTA payload URL hosted by the attacker-controlled lab machine and executed through GPO-abuse tooling. |
| URL | hxxp[:]//192[.]168[.]1[.]17/run.txt | Specific payload URL hosted by the attacker-controlled lab machine and downloaded for execution through the GPO task. |
MITRE ATT&CK
T1021.006 · Windows Remote ManagementThe operator uses Evil-WinRM to connect to the Domain Controller during the demonstration.T1053.005 · Scheduled TaskScheduled tasks are created through the abused GPO to execute payloads on systems applying the policy.T1059.001 · PowerShellPowerShell commands download and execute payloads delivered through the modified GPO.T1059.003 · Windows Command ShellA command-shell action is used to create a local account and add it to the Administrators group.T1105 · Ingress Tool TransferPayloads are downloaded from the attacker-controlled host to affected systems for execution.T1136.001 · Local AccountThe injected task creates a local administrator account on affected machines.T1484.001 · Group Policy ModificationThe demonstration modifies a domain-linked Group Policy Object to deploy attacker-controlled tasks, scripts, and group changes.
Products
Tools
BloodHoundUsing BloodHound to discover writable GPOs and tools like pyGPOAbuse, SharpGPOAbuse, and StandIn, the attacker creates persistent local administrators and interactive reverse shells, while defenders are advised to treatEvil-WinRMA Kali Linux attacker (192.168.1.17) carries the offensive tooling: bloodhound-python, pyGPOAbuse, and evil-winrm.msfvenomFor first SharpGPOAbuse variant we build the payload with msfvenom, generating a reverse-shell HTA that calls back on port 4443 with the help of the following command:netcatOn Kali, we set up a netcat listener on port 1234 wrapped with rlwrap for a better interactive experience.PingCastleTools such as PingCastle, Purple Knight, and PowerShell’s Get-GPPermission surface this ACL drift on demand and should be run on a scheduled cadence.Purple KnightTools such as PingCastle, Purple Knight, and PowerShell’s Get-GPPermission surface this ACL drift on demand and should be run on a scheduled cadence.pyGPOAbuseUsing BloodHound to discover writable GPOs and tools like pyGPOAbuse, SharpGPOAbuse, and StandIn, the attacker creates persistent local administrators and interactive reverse shells, while defenders are advised to treatSharpGPOAbuseUsing BloodHound to discover writable GPOs and tools like pyGPOAbuse, SharpGPOAbuse, and StandIn, the attacker creates persistent local administrators and interactive reverse shells, while defenders are advised to treatStandInUsing BloodHound to discover writable GPOs and tools like pyGPOAbuse, SharpGPOAbuse, and StandIn, the attacker creates persistent local administrators and interactive reverse shells, while defenders are advised to treat