rapid7/metasploit-framework — pull request #455 by trolldbois (2012-06-07 01:50:37+00:00)
Title: Post module - search for GPO local users password and decrypt them - win2k8 (clean pull request)

Moved to a post module

Based on Gpprefdecrypt.py - Decrypt the password of local users added via Windows 2008 Group Policy Preferences.

http://esec-pentest.sogeti.com/exploiting-windows-2008-group-policy-preferences ( emilien girault )

This tool decrypts the cpassword attribute value embedded in the Groups.xml file stored in the domain controller's Sysvol share.