ADTRADE-001: Restos de cpassword de Preferencias de directiva de grupo en SYSVOL
- Plataforma
- Active Directory
- Categoría
- AD Adversary Tradecraft Indicators
- Severidad
- Critical
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Desde 2008 hasta mayo de 2014, las Preferencias de directiva de grupo permitían a los administradores insertar tareas programadas, contraseñas de usuarios locales, unidades asignadas y servicios mediante un campo 'cpassword', cifrado con una clave AES-256 que Microsoft documentó públicamente. La corrección de MS14-025 deshabilitó el campo cpassword en las NUEVAS preferencias, pero dejó intactas las existentes en SYSVOL. Todos los ejercicios de equipo rojo siguen encontrando estos casos. Cualquier usuario del dominio autenticado puede leer SYSVOL, obtener el cpassword y descifrarlo sin conexión. Si encuentra algo aquí, trate cada credencial expuesta como comprometida y rótela.
Por qué importa
cpassword is the textbook example of a "patched but not remediated" vulnerability. MS14-025 closed the door on creating new GPP secrets, but the patch deliberately did not touch existing XML in SYSVOL because Microsoft could not safely guess which credentials were still in production use. Years later, the original administrators have left, the documentation is gone, and the XML is still there. The recovery is one-sided: any authenticated user (every domain account, including low-privileged service accounts, kiosk accounts, and helpdesk accounts) has Read access to SYSVOL by design, so the credentials are effectively published to the entire user population. The static AES-256 key (4e 99 06 e8 fc b6 6c c9 fa f4 93 10 62 0f fe e8 f4 96 e8 06 cc 05 79 90 20 9b 09 a4 33 b6 6c 1b) is documented in MS-GPPREF section 2.2.1.1.4 and is hard-coded into PowerSploit, Metasploit, Empire, and every red-team primer. The blast radius depends on what the preference set up: local Administrator accounts on every workstation, a service running as a tier-0 account, or a scheduled task running as Domain Admin all turn into immediate forest compromise. Because the data is exfiltrated by a normal LDAP / SMB read it generates no anomalous telemetry and is one of the first things every adversary checks during initial recon. This is why it is classified as a Tradecraft Indicator rather than a configuration finding: the presence of these files is high-signal evidence that the environment has not had an adversarial review.
Ruta de ataque
1. Initial access: the attacker has any authenticated domain identity. A guest contractor account, a phished helpdesk account, or a low-privilege service account is sufficient. No special rights are required. 2. SYSVOL enumeration: the attacker connects to \\<domain>\SYSVOL\<domain>\Policies and recursively lists XML files. PowerSploit ships Get-GPPPassword, which does this in one line: Get-GPPPassword. Metasploit has post/windows/gather/credentials/gpp. Impacket ships Get-GPPPassword.py for non-Windows operators. 3. cpassword harvest: the tool greps the XML for cpassword= and captures the surrounding userName / runAs attribute so the operator knows which account the credential belongs to. 4. Offline decryption: the cpassword is base64-decoded, the trailing equals signs are padded if needed, and the result is AES-256-CBC decrypted with the published 32-byte key and a zero IV. The plaintext password drops out. No interaction with the domain is needed for this step; it is a pure offline operation. 5. Lateral movement: with the recovered credential the attacker logs into whatever the GPP preference managed. Common high-value cases: a "Local Admin password reset" preference that set the same local Administrator password on every workstation (full lateral movement primitive), a scheduled task running as a Tier-0 account (instant Tier-0 compromise), or an SQL service account that turns out to be a domain admin. 6. Persistence: even after the credential is rotated, the attacker may relink or re-stage a malicious GPP preference using a different XML name, betting that defenders will only audit the names they have already seen.
Cómo lo evalúa Guerrilla
Guerrilla resolves the PDC emulator with Get-ADDomain, then enumerates every Group Policy Container under CN=Policies,CN=System and constructs the SYSVOL UNC for each GPO. It performs a recursive Get-ChildItem against \\<pdc>\SYSVOL\<domain>\Policies filtered to *.xml, then runs Select-String for the literal token "cpassword" against the contents of each file. For matches it parses the XML with [xml] and extracts the cpassword node attribute plus the sibling userName, runAs, accountName, or newName attribute depending on the preference type, and records the GPO GUID parsed from the file path, the LastWriteTime of the XML, and the file owner where available. The check deliberately uses the PDC emulator copy of SYSVOL to avoid DFSR replication windows producing inconsistent results across DCs. The check does not write to SYSVOL and does not decrypt; it only reads. A clean run returns zero rows. Any non-zero result is a Critical finding.
Valor recomendado
Cero atributos cpassword en cualquier ubicación bajo \\domain\SYSVOL\domain\Policies\**\*.xml.
Remediación
Analice SYSVOL: Get-ChildItem -Path \\<domain>\SYSVOL\<domain>\Policies -Recurse -Include *.xml | Select-String 'cpassword'. Para cada coincidencia: (1) rote la contraseña de la cuenta cuya credencial está expuesta (el nombre de usuario está en el mismo XML), (2) audite los registros en busca de uso de esa credencial desde que se creó la preferencia, (3) elimine la preferencia GPP una vez que la nueva credencial esté en su lugar. El artículo KB2962486 de Microsoft contiene la guía de limpieza.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5, AC-6
- CIS AD Benchmark
- 10.1.1
- MITRE ATT&CK
- T1552.006