skills.rest
blacklanternsecurity
blacklanternsecurityOFFICIAL
Explore all skills by this author →
WebsiteGitHub

gpo-abuse

Exploit Active Directory Group Policy Objects for code execution and privilege escalation.

253|37|Updated Feb 22, 2026
Search Tags:#privilege escalation#lateral movement#active directory#gpo abuse#group policy#sysvol
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill gpo-abuse
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gpo-abuse
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/gpo-abuse
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill gpo-abuse

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers leverage misconfigurations in Active Directory Group Policy Objects (GPOs) to gain code execution, escalate privileges, and move laterally within a network.

Core Features & Use Cases

  • GPO Enumeration: Discover GPOs with write permissions using tools like GPOHound and PowerView.
  • Exploitation: Deploy malicious code via immediate tasks, logon scripts, or registry keys.
  • Persistence & Lateral Movement: Establish a foothold and expand access by abusing GPO settings.
  • GPP Password Extraction: Recover encrypted passwords from Group Policy Preferences.
  • Use Case: An attacker identifies a GPO that grants them write access. They modify it to include a scheduled task that executes a reverse shell on all linked computers, granting SYSTEM-level access.

Quick Start

Use the gpo-abuse skill to enumerate GPO permissions for the current domain.

Frequently Asked Questions about gpo-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Group Policy Objects for privilege escalation in Active Directory?▼

GPO abuse works by modifying immediate tasks, logon scripts, or registry keys on writable GPOs to execute code across linked computers, gaining SYSTEM-level access for lateral movement.

What is GPP password extraction and how does it recover credentials from SYSVOL?▼

GPP password extraction decrypts credentials stored in Group Policy Preferences XML files on the SYSVOL share by leveraging Microsoft's published AES key to recover plaintext passwords.

Can I use pyGPOAbuse to deploy malicious scheduled tasks for lateral movement?▼

Yes, pyGPOAbuse modifies writable GPOs to inject immediate scheduled tasks executing arbitrary commands or reverse shells, providing SYSTEM-level access on all computers linked to the target policy.

Do I need write access to SYSVOL to poison logon scripts for AD persistence?▼

Yes, poisoning SYSVOL and NETLOGON logon scripts requires write access to the shares or linked GPOs to inject malicious code that executes automatically upon user authentication.

How do I enumerate Active Directory GPOs with weak permissions using GPOHound?▼

Enumerate writable GPOs by querying Active Directory for Group Policy Objects where your user holds write privileges, leveraging tools like GPOHound or PowerView to identify exploitation targets.

What are the limitations of GPO abuse for code execution in Active Directory?▼

GPO abuse requires write access to target GPOs or SYSVOL shares, and execution depends on Group Policy refresh cycles, meaning malicious immediate tasks or logon scripts may not trigger immediately.

Related Skills

Explore More Software Engineering Skills→
hypnguyen1209hypnguyen1209
338

active-directory-attack

Enumerate Active Directory components and map attack paths with BloodHound.

Community
Advanced
AeonDaveAeonDave
15

crackmapexec

Automate Active Directory credential spraying, enumeration, and remote command execution over SMB and WinRM.

Community
Advanced
hardw00thardw00t
90

network-pentest

Simulate attacker techniques across internal networks and Active Directory environments.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

kerberos-delegation

Exploit Kerberos delegation misconfigurations in Active Directory for privilege escalation.

Official
Advanced