About
Today's tale of pentest pwnage is about a GPO escalation path I'd seen before but could never get working, until a bloodhoundcli update introduced me to GroupPolicyBackdoor. I'll cover how it let me target one specific server, how it cleans up after itself, and the little gotcha that confused me in the lab. Spoiler: all this hard work ended with a 2 a.m. domain admin victory dance and a well-earned mint hot cocoa. Added bonus: I've got a short video about GroupPolicyBackdoor over at 7MinSec.club.