gpp

Overview ¶

Package gpp decrypts Group Policy Preferences (GPP) cpassword values.

Group Policy Preferences let a domain admin push local accounts, scheduled tasks, services, mapped drives, and data sources to every machine in an Active Directory domain. The password for those items is stored in an XML file under the domain SYSVOL share (Groups.xml, Services.xml, ScheduledTasks.xml, DataSources.xml, Drives.xml, Printers.xml) as a "cpassword" attribute — AES-256-CBC encrypted. The catch: Microsoft *published* the 32-byte AES key in the MS-GPPREF protocol spec (§2.2.1.1), so any domain user who can read SYSVOL can decrypt every cpassword offline. This is one of the highest-impact Active Directory findings (MS14-025 removed the ability to *create* new ones, but legacy SYSVOL files persist for years).

This takes either a raw cpassword string or a pasted GPP XML snippet, extracts every cpassword (with the co-located account name when present), and decrypts it to the cleartext password. The AES key, the all-zero IV, the CBC mode, and the UTF-16LE plaintext encoding are all fixed by the spec — there is nothing to guess.

No confidently-wrong output: the key / IV / algorithm are fixed; an empty cpassword (a cleared field) is reported as "no password set", and a wrong-length or bad-padding ciphertext is reported as an error on that entry, never a garbled guess. No network, no key material beyond the public one.

Wrap-vs-native: native — Go stdlib crypto/aes + crypto/cipher + encoding/xml, no new go.mod dependency. Anchored to the well-known public cpassword vectors (see the test), cross-checked against openssl.