search

FSecureLABS / SharpGPOAbuse

SharpGPOAbuse is a .NET application written in C# that can be used to take advantage of a user's edit rights on a Group Policy Object (GPO) in order to compromise the objects that are controlled by that GPO.
1.03k stars 135 forks source link

potential gPCMachineExtensionNames issue #4

Closed gpoguy closed 5 years ago

gpoguy commented 5 years ago

In the code where you handle checking/adding gPCMachineExtensionNames GUIDs, you are likely going to have issues with the way you're handling that today. The GP client engine has specific expectations about how GUIDs are sorted/listed in that attribute in order for processing to actually work. All bracketed ([]) GUID pairs need to be sorted alphanumerically within the list. In addition, GP Preferences GUIDs require special treatment. The Zero GUID needs to be added to the attribute if there are no Preferences in that GPO yet, and then the 2nd GUID of a given GPP CSE pair needs to be appended to the Zero GUID, also alphanumerically. So, as an example: [{00000000-0000-0000-0000-000000000000}{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}][{5794DAFD-BE60-433F-88A2-1A31939AC01F}{2EA1A81B-48E5-45E9-8BB7-A6E3AC170006}] indicates that GPP Drive Maps and Admin Templates have been implemented in this GPO. Note that the 2nd GUID for GPP Drive Maps is tacked onto the end of the zero GUID and then the Admin Templates ({35378EA...) GUID pair comes next because it falls before the GPP Drive Maps GUID pair, alphanumerically.

pkb1s commented 5 years ago

Hi @gpoguy,

You are absolutely right. I was able to verify the issue and have pushed a fix that arranges the GUIDs to be in the order expected by the GP client engine.

Thank you for pointing this out and for helping me resolve this.