๐ Secure Bits ๐ก
๐๐ฟ๐ฒ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ๐ ๐ต๐ถ๐ฑ๐ถ๐ป๐ด ๐ถ๐ป ๐๐ผ๐๐ฟ ๐๐ฟ๐ผ๐๐ฝ ๐ฃ๐ผ๐น๐ถ๐ฐ๐ถ๐ฒ๐?
๐๐ผ๐ ๐ผ๐น๐ฑ is your Active Directory? Are you sure there’s no history of stored credentials?
๐จ Before 2014, many admins used Group Policy Preferences (GPP) to ๐๐ฒ๐ ๐ฝ๐ฎ๐๐๐๐ผ๐ฟ๐ฑ๐ for tasks, services, and other configurations. It was convenientโbut ๐ฑ๐ฎ๐ป๐ด๐ฒ๐ฟ๐ผ๐๐๐น๐ ๐ถ๐ป๐๐ฒ๐ฐ๐๐ฟ๐ฒ. Microsoft patched this in 2014, but old, vulnerable GPOs may still exist.
๐ง๐ต๐ฒ ๐ฝ๐ฟ๐ผ๐ฏ๐น๐ฒ๐บ?
โช๏ธThese passwords were stored in SYSVOL, accessible to any authenticated user.
โช๏ธBut they were encrypted, right?
โช๏ธYes… but….the ๐๐๐ฆ ๐ฒ๐ป๐ฐ๐ฟ๐๐ฝ๐๐ถ๐ผ๐ป ๐ธ๐ฒ๐ ๐๐ฎ๐ ๐ฝ๐๐ฏ๐น๐ถ๐ฐ๐น๐ ๐ธ๐ป๐ผ๐๐ปโmaking decryption trivial.
๐ก ๐๐ผ๐ ๐๐ผ ๐ฐ๐ต๐ฒ๐ฐ๐ธ if your environment is still exposed:
Run this simple PowerShell command:
$domain = Get-ADDomain | select -ExpandProperty Forest
findstr /S /I cpassword \$domainSYSVOL$domainPolicies*.xml
โ
๐ข๐ฟ ๐๐๐ฒ ๐บ๐ ๐ณ๐ฟ๐ฒ๐ฒ ๐๐ผ๐ผ๐น, ADProbe, to scan your Active Directory:
https://academy.horizon-secured.com/p/adprobe
