Cyber security

GPOHunter – Active Directory Group Policy Security Analyzer

GPOHunter is a comprehensive tool designed to analyze and identify security misconfigurations in Active Directory Group Policy Objects (GPOs).

It automates security checks and provides detailed reports on potential vulnerabilities, helping administrators secure their environments.

Features

  • Connects to Active Directory using LDAP/LDAPS protocols.
  • Supports NTLM authentication and Pass-the-Hash techniques.
  • Analyzes all GPOs within the domain.
  • Identifies and reports security misconfigurations.
  • Displays affected organizational units (OUs) and objects.
  • Offers multiple output formats: JSON, CSV, and HTML.
  • Provides an option to view detailed XML content of GPO files.

Security Checks

Currently, GPOHunter implements the following security checks:

  1. Clear Text Password Storage
    • Detects the “ClearTextPassword = 1” setting in GPOs.
    • This setting allows passwords to be stored in unencrypted form, posing a critical security risk by exposing credentials.
  2. GPP Passwords (MS14-025)
    • Identifies encrypted passwords within Group Policy Preferences.
    • Examines various GPP files such as Groups.xml, Services.xml, and others.
    • These passwords are encrypted with a known key and can be easily decrypted using public information.
  3. NetNTLMv1 Authentication Enabled
    • Detects insecure LmCompatibilityLevel settings.
    • Identifies GPOs that enable NetNTLMv1, which is vulnerable to:
      • Relay attacks when combined with Coerce.
      • Password cracking using rainbow tables.

Future Development

The list of security checks will be continuously expanded with additional checks and verifications.

Usage

To run GPOHunter, use the following command:

python gpo_analyzer_cli.py -u USERNAME -p PASSWORD -d DOMAIN -dc DC_HOST [options]

Options:

  • -H, --hash: NTLM hash for Pass-the-Hash.
  • -o, --output: Path to the output file.
  • -f, --format: Output format (json, csv, html).
  • -v, --verbose: Verbose output.
  • --show-xml: Show raw XML content of GPO files.

Requirements

  • Python 3.7+
  • ldap3
  • impacket
  • colorama
  • pycryptodome

Installation

Clone the repository. Install the required packages:

pip install -r requirements.txt

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Google Dorking in Cybersecurity: A Complete Guide

Introduction In the vast ocean of the internet, the most powerful tool you already have…

36 minutes ago

Pystinger : Bypass Firewall For Traffic Forwarding Using Webshell

Pystinger is a Python-based tool that enables SOCKS4 proxying and port mapping through webshells. It…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

CVE-Search : A Tool To Perform Local Searches For Known Vulnerabilities

Introduction When it comes to cybersecurity, speed and privacy are critical. Public vulnerability databases like…

1 week ago

How to Bash Append to File: A Simple Guide for Beginners

If you are working with Linux or writing bash scripts, one of the most common…

1 week ago

Mastering the Bash Case Statement with Simple Examples

What is a bash case statement? A bash case statement is a way to control…

1 week ago