gpp-decrypt

What it does

gpp-decrypt recovers the plaintext of the well-known AES-encrypted cpassword stored in SYSVOL Group Policy Preferences. Finding one is a quick win toward Active Directory privilege escalation.

Common use cases

• •Decrypt local admin credentials pushed via Group Policy for Active Directory privilege escalation.
• •Recover service-account passwords stored in GPP files after gaining SYSVOL read access.
• •Identify reused cpassword values across multiple domain-joined machines for lateral movement.

Key features

• •Decrypts AES-256 encrypted cpasswords using Microsoft's published private key.
• •Accepts single cpassword strings or bulk input for multiple decryptions.
• •Lightweight standalone script with no dependencies beyond standard Python modules.

Source