Skip to main content
Applies to BloodHound Enterprise and CE The ability to alter the gPLink attribute may allow an attacker to apply a malicious Group Policy Object (GPO) to a domain, OU, or Site. This can be exploited to make affected computers and users execute arbitrary commands through an immediate scheduled task.

​
Abuse Info

An attacker with permission to modify the gPLink attribute can link GPOs to the object. For a domain or OU, the linked GPO affects contained users and computers, including nested OUs. The GPO can be weaponized by injecting a malicious configuration, such as a scheduled task executing a malicious script. For a Site, the linked GPO affects the site’s domain controllers and computers mapped to the site’s subnets. The default site also affects computers that do not map to another site. User-side settings affect users who sign in to the affected computers. A Site GPO link is scoped by site membership, but blocked GPO inheritance on a domain or OU can prevent its application unless the link is enforced. For a domain, OU, or Site, the GPO can be linked as enforced to bypass blocked GPO inheritance. WMI or security filtering can be used to limit the impact to specific accounts, which is important in environments with many users or computers under the affected scope. Refer to A Red Teamer’s Guide to GPOs and OUs for details about the abuse technique, and check out the following tools for practical exploitation:

​
Without control over a GPO

An attacker can still execute the attack without control over a GPO by setting up a fake LDAP server to host a GPO. This approach requires the ability to add non-existent DNS records and create machine accounts, or access to a compromised domain-joined machine. However, this method is complex and requires significant setup. From a domain-joined compromised Windows machine, the write access to the gPLink attribute may be abused through Powermad, PowerView and native Windows functionalities. For site-specific requirements and implementation, see Site Unseen: Enumerating and Attacking Active Directory Sites. For domains and OUs, see OU having a laugh?. From a Linux machine, the write access to the gPLink attribute may be abused using the OUned.py exploitation tool. For a detailed outline of exploit requirements and implementation, you can refer to the article associated to the OUned.py tool.

​
Opsec Considerations

There is no opsec information for this edge.

​
Edge Schema

Source: User, Group, Computer
Destination: Domain, OU, Site
Traversable: ✅

​
References

This edge is related to the following MITRE ATT&CK technique:

​
Abuse info references