gpp-decrypt

Decrypts the Group Policy Preferences cPassword (public AES key).

Decrypts Group Policy Preferences passwords (the cpassword attribute) found in XML files on the SYSVOL share. Microsoft published the AES key used, so any cpassword found reverts instantly to cleartext.

Family Credential dumping & theft

Flags '<cpassword>'

Concepts GPP cpassword (MS14-025)

Cheatsheet Post-exploitation & lateral

Installation

sudo apt install -y gpp-decrypt

Useful commands2 commands

Appears in

Some machines where its use is documented; not an exhaustive list.

ActiveHackTheBox