Turning your Active Directory into the attacker's C2

Turning your Active Directory into the attacker's C2

Speakers: Quentin Roland, Wilfried Bécard

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=_l9_lNUCjP4

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Dirk-jan%20Mollema%20-%20Advanced%20Active%20Directory%20to%20Entra%20ID%20lateral%20movement%20techniques.pdf

Overview

Group Policy Objects (GPOs) are one of the most powerful — and most underappreciated — attack surfaces in Active Directory environments. At DEF CON 33, penetration testers Quentin Roland and Wilfried Bécard from Sactif presented a deep technical examination of GPO-based attack vectors and released four purpose-built open-source tools to enumerate and exploit them. Their central thesis: GPOs are the "ugly ducklings" of AD exploitation — overlooked by defenders, underequipped in attacker tooling, yet extraordinarily powerful for establishing persistence, achieving lateral movement, executing code on every domain-joined machine, and — their headline finding — converting the AD infrastructure itself into a fully functional command-and-control (C2) channel that routes through legitimate Windows mechanisms and leaves no obvious network trace.

The research arose from a real-world penetration testing incident where a colleague had GPO write permissions on domain controllers but bypassed them in favor of an AD Certificate Services (ADCS) escalation path — and got caught. The lesson: GPO exploitation, done carefully, can be a stealthier and equally powerful path that defenders are less prepared to detect.

Background

▶ Watch: Q&A and closing (0:11)

What Is a Group Policy Object?

A GPO is a collection of configuration settings stored in Active Directory and applied to computers and users within organizational units (OUs), sites, or the entire domain. GPOs control everything from password policies and firewall rules to software installation, logon scripts, registry modifications, and Windows Defender exclusions.

GPOs consist of two components:

• GPC (Group Policy Container): An AD object stored under CN=Policies,CN=System,DC=domain,DC=com that holds metadata.
• GPT (Group Policy Template): A folder structure in the SYSVOL share (\\domain\SYSVOL\domain\Policies\<GUID>\) that contains the actual policy files (INF, XML, INI formats).

When a Windows machine performs a Group Policy refresh (every ~90 minutes by default, plus at startup and logon), it fetches the GPT from SYSVOL over SMB, applies changes, and logs results. The critical security implication: an attacker who can write to either the GPC object in AD or the GPT folder in SYSVOL can potentially control every machine and user account the policy applies to.

Why GPOs Are Underexploited

The speakers identified three reasons GPOs tend to be overlooked in red team engagements:

1. Limited awareness: Many security teams focus on Kerberoasting, ADCS abuse, and DCSync while GPO write permissions go un-remediated.
2. Fear of breakage: Editing a GPO that applies to domain controllers or thousands of machines can have severe consequences if done wrong. Attackers (and penetration testers) historically avoided them.
3. Tooling gaps: Existing tools like PowerSploit's Get-DomainGPO provide basic enumeration but lack the granularity to pinpoint who has which specific right on which GPO, and none offered reliable end-to-end exploitation.

Key Findings

▶ Watch: Using Group Policy objects as a C2 communication mechanism (0:20)

The team's four key contributions are encapsulated in the tools they released:

1. GPO enumeration tool: Identifies all GPOs in the domain and maps which accounts have write, create-link, or modify permissions — distinguishing between GPC write access (AD object) and GPT write access (SYSVOL) separately, since NTFS permissions on SYSVOL are often out of sync with AD ACLs.

1. GPO link exploitation: Once a misconfigured GPO is identified, the tool can intelligently craft a new policy that deploys a payload (immediate task, logon script, startup script) to target systems, calculating GPO scope and waiting for the next refresh cycle.

1. GPO-based C2 channel ("ADGPO C2"): The headline research — a fully functional C2 framework that uses GPO's own polling mechanism as the transport layer. Instead of beaconing to an external server, implants read their instructions from a GPO stored in SYSVOL and write output back to SYSVOL, meaning all C2 traffic is legitimate GPO replication over SMB on port 445.

1. Cleanup and stealth: The tools include rollback mechanisms to revert GPO modifications after use, reducing forensic footprint.

Technical Deep Dive

▶ Watch: Abusing LDAP attributes for covert data storage and retrieval (3:34)

GPO Permission Taxonomy

The speakers dedicated significant time to clarifying the precise permissions model, as it is commonly misunderstood even by experienced AD administrators.

A GPO can be modified by an attacker who holds any of the following:

• Write permissions on the GPC object in AD (controls metadata, links, version number)
• Write permissions on the corresponding GPT folder in SYSVOL (controls actual policy content)
• Create GPO rights in the domain (allows creating new GPOs linked to accessible OUs)
• Link GPO rights on an OU (allows linking an existing GPO — even if you can't edit it — to a target OU)

The distinction between GPC and GPT permissions is operationally important. A defender may correctly configure AD ACLs on the GPC but fail to lock down the corresponding SYSVOL folder, leaving GPT writeable by a broader set of accounts. The enumeration tool checks both independently.

Delivery Mechanisms Within GPOs

Once write access is confirmed, a GPO can deliver payloads in multiple ways:

• Scheduled tasks (Immediate Tasks): XML-defined tasks that execute on the next GP refresh without waiting for a reboot or logon. The ImmediateTask type is particularly useful because it runs immediately upon policy application.
• Logon/Logoff scripts: VBScript or PowerShell scripts executed at logon — reliable but visible in the GPO editor.
• Startup/Shutdown scripts: Execute with SYSTEM privileges at machine startup or shutdown.
• Registry modifications: Set HKLM run keys or software configuration values to establish persistence.
• Software installation: Deploy an MSI package from a SYSVOL path to all targeted machines.

The speakers favored Immediate Tasks for stealth: they fire without user interaction, run under the machine account (SYSTEM), and are self-deleting by design in some configurations.

The GPO-Based C2 Channel

The most novel contribution of the talk is using GPO infrastructure as a bidirectional covert channel. Here is the mechanism:

Command delivery (attacker → implant):

1. Attacker writes an "instruction" blob (encoded command) into a GPO file in SYSVOL, such as a custom INI file or a crafted registry.pol entry.
2. The GPO version counter in the GPC is incremented (or the attacker waits for the natural client-side polling).
3. The infected machine, during its next Group Policy refresh cycle, fetches the updated GPT from SYSVOL.
4. The implant, running as part of the GP processing pipeline or as a scheduled task deployed by a previous policy, reads the instruction from the known path.

Result exfiltration (implant → attacker):

1. The implant writes output data to a file in SYSVOL (to which machine accounts typically have write access in their own OU's policies path, or using a writable share in an otherwise read-only structure).
2. The attacker reads back the result at their next polling interval.

The entire channel travels over SMB port 445, which is essential for domain functioning and universally allowed between domain-joined clients and domain controllers. No external connections, no unusual DNS lookups, and no atypical processes — just standard Group Policy replication that blends into normal AD traffic.

The researchers acknowledged that this technique requires an attacker to already have write access to a GPO — meaning it is a post-exploitation C2 mechanism rather than an initial access vector. But in environments where a compromised service account or misconfigured delegation grants GPO write rights, this provides a durable, stealthy channel that is extremely difficult to block without disrupting domain operations.

Scope and Targeting

GPOs apply to OUs, and OUs can contain computers, users, or both. The researchers demonstrated:

• Domain-wide GPO: A GPO linked to the domain root affects all domain-joined machines (tens of thousands in large enterprises) — extreme power, extreme risk of detection.
• Targeted OU GPO: Targeting a specific OU (e.g., the Domain Controllers OU or a critical-server OU) maximizes impact while minimizing scope, reducing the chance of collateral damage that triggers a helpdesk ticket.
• User-targeted GPO: Logon scripts target users rather than machines — useful for credential harvesting, token capture, or browser cookie theft on next logon.

Demo / Proof of Concept

▶ Watch: Persistence mechanisms using native AD features (27:29)

The talk included live demonstrations of the enumeration and exploitation tools. The demo environment was a small AD lab:

1. Enumeration: Running the GPO enumeration tool against the lab domain returned a list of all GPOs with their GUID, display name, linked OUs, and — critically — the exact set of accounts with GPC write rights vs. GPT filesystem rights. One service account had been granted modify rights on a GPO linked to the Domain Controllers OU.

1. Exploitation: Using the exploitation tool with the service account, the presenters pushed an Immediate Task to the Domain Controllers OU's GPO. The task executed a reverse shell payload on the DC with SYSTEM privileges, achieved within the 90-second GP refresh window.

1. C2 demonstration: The GPO C2 channel demo showed a command being written to a SYSVOL path, a client machine polling for it, executing the command, and writing output back — all visible in Wireshark as standard \\DC\SYSVOL SMB traffic, indistinguishable from normal Group Policy synchronization.

1. Cleanup: The rollback function removed the Immediate Task from the GPO and reverted the GPT folder contents after the demo, illustrating how an attacker could minimize forensic evidence.

Defensive Implications

▶ Watch: Defensive recommendations and detection strategies (32:29)

Detection Strategies

• Monitor GPO modifications: Event ID 5136 (Directory Service Change) logs GPO object modifications in AD. Event ID 5145 (network share access with detailed flags) on domain controllers logs SMB writes to SYSVOL. Both should be baseline-monitored and alerted on when changes come from accounts that are not part of a GPO management group.
• Alert on new Immediate Tasks: Scheduled task creation events (Event ID 4698/4702) on machines that received a new GPO-delivered task should be investigated, particularly if the creating identity is NT AUTHORITY\SYSTEM (GP processing context).
• Anomalous GP refresh timing: Clients that process Group Policy far more frequently than the 90-minute baseline, or at unusual hours, may indicate an attacker is forcing policy refresh (gpupdate /force) to accelerate their C2 polling.
• SYSVOL write monitoring: Domain controllers should alert on any write to SYSVOL originating from non-DC, non-admin accounts.

Hardening Steps

• Audit GPO permissions immediately: Use the team's released enumeration tool or BloodHound's GPO analysis to identify all accounts with GPO write rights. Any service account, low-privilege user, or orphaned account with these rights is a critical misconfiguration.
• Separate GPC and GPT permissions: Ensure that NTFS ACLs on SYSVOL match the AD ACLs on the corresponding GPC objects. Discrepancies are a common source of overly-permissive access.
• Restrict GPO creation rights: Only dedicated GPO management accounts (ideally protected by Privileged Access Workstations) should have the right to create GPOs in the domain.
• Implement GPO change approval workflows: Enterprise environments should enforce a change management process for GPO modifications, ideally with AGPM (Advanced Group Policy Management) which logs all edits and requires approval for policy changes.
• Use tiered AD models: Separate domain controllers from standard workstations at both the OU and GPO levels; apply the principle of least privilege aggressively.

Key Takeaways

• GPO write access is a path to domain-wide code execution that is frequently misconfigured and undermonitored.
• The distinction between GPC (AD) and GPT (SYSVOL) write permissions matters: audit both independently, as they are often out of sync.
• The researchers' GPO C2 channel demonstrates that AD infrastructure itself can be weaponized as a covert, hard-to-block command-and-control medium that blends into legitimate traffic.
• Immediate Tasks are the most reliable and stealthy delivery mechanism for GPO-based exploitation, executing within one refresh cycle with SYSTEM privileges.
• Four open-source tools were released to help defenders enumerate their GPO exposure and help red teams demonstrate the risk convincingly to clients.
• The core defensive message: treat GPO write permissions with the same urgency as DCSync rights, because the impact is comparable.

About the Speakers

Wilfried Bécard and Quentin Roland are penetration testers and red teamers at Sactif, a French cybersecurity firm. This was their first DEF CON talk. Their work focuses on Active Directory security, attack paths in enterprise Windows environments, and developing practical tooling that bridges the gap between academic vulnerability research and real-world offensive assessments. The GPO tooling they released is designed to be directly usable during penetration tests to demonstrate business impact to clients who may otherwise underestimate the risk of misconfigured GPO delegation.