Package: gpp-cpass-decrypt
gpp-cpass-decryptPython 3 script that decrypts credentials (cPassword) stored in Group Policy Preferences (GPP) files (Groups.xml) located in the SYSVOL folder.A very handy and useful tool for Ethical Hackers during Penetration Testing Projects, Red Team Exercises or CTFs involving attacks to Active Directory infrastructures.If you findgpp-cpass-decryptuseful, pleaseto the authors. Thank you!Clone Repogitclonehttps://github.com/galoget/gpp-cpass-decryptInstall DependenciesThis tool has 2 dependencies:pycryptodomecoloramaIn order to avoid conflicts with any other installed modules in your system, it is recommended (not mandatory) to use a virtual environment (virtualenv).Both dependencies are included inrequirements.txtand can be installed in any of the following ways (just use one method):Method 1By doing the automated installation from PyPi withpip3, this command will install all dependencies (pip3MUSTbe installed in your system):pip3installgpp-cpass-decryptWith this method you can use the tool as any other command without calling it with Python (don't forget to add your pip binary path to your PATH variable).In Kali Linux this is the default path you need to add to yourPATHenvironment variable./home/kali/.local/binThen, simply run:gpp_cpass_decrypt-c<base64_encoded_cpassword>Method 2By usingpip3and installing the dependencies manually (pip3MUSTbe installed in your system):pip3installpycryptodomecoloramaMethod 3By usingpip3andrequirements.txt. Againpip3MUSTbe installed in your system:pip3install-rrequirements.txtMethod 4By using setuptools:python3setup.pyinstallFrom Method 2 to Method 4. In case you don't want to install the tool in your system. You can use it as a Python script that is not managed bypip:python3 gpp_cpass_decrypt.py -c <base64_encoded_cpassword>Running the toolYou can run the tool with any of the following commands. They are equivalent:python3gpp_cpass_decrypt.py-c<base64_encoded_cpassword>
python3gpp_cpass_decrypt.py--cpassword<base64_encoded_cpassword>Execution ExampleCommand:Installed using Method 1:gpp_cpass_decrypt-c"gtTqxKHj4RWsxHWcZcWtM8j7XbxiL7w+SwIyQbAetjEUfqBg2HmTklEXlDHuQPgE3NyuCKZ9Nu3oeXaeSt+9JQ=="Expected Output:Decrypted Password: Hackem Cybersecurity Research GroupMore Examples:You can continue testing the tool with the following encrypted strings:Ciphertext 1: YTGHyibeELFS0elGK9Z40dryAJbGpDAMwgW3DakPXyE=
Plaintext 1: Hello World
Ciphertext 2: FhkrztByQuGCkRwrk18AUp/qLNAG33QC/96rUFoSQm+2O8jPqTtAeoOig3mhfsFGr6NsKrZBiI4d6iy8Jro/Bw==
Plaintext 2: HackemCTF{R3d_T34m_0p3r4t0r_3xp3rt_8724376348734}
Ciphertext 3: c+jaRBWag4oGSHYnF73o1snzocCYsF2EP1DO7CFbe70=
Plaintext 3: Cryptography is FunDisclaimerThis tool can only be used where strict consent has been given. Do not use it for illegal purposes! It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by any of the tools included in this repository.LicenseThis Project is licensed under GNU GPLv2.0 License. For any further detailes, please see theLICENSEfile included in this repository.ContactIn case you:Want to report a bug or any unexpected behaviorWant to collaborate with the project or have an interesting ideas on how to improve it (new features)Have any questions about the tool that are not documented in the repositoryYou can contact the author directly inthis linkvia a private message.