Group Policy Preferences
Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
There is already bunch of article that discuss about this topic. Some of them are:
The quickest way to hunting credentials from GPP is using impacket-Get-GPPPassword.
And then, you can verify the credentials using NetExec or Evil-WinRM.
Last updated