Impacket Get-GPPPassword.py

Back to the category index / Back to the command index

Overview

Finds Group Policy Preferences XML files locally or on SMB shares, then extracts and decrypts cpassword values.

Item	Details
Implementation	examples/Get-GPPPassword.py
Category	SMB / MSRPC / NTLM
Size	310 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and input

Run python examples/Get-GPPPassword.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@], or LOCAL to parse local files.
-xmlfile	Group Policy Preferences XML files to parse.
-share	SMB share (default: SYSVOL)
-base-dir	Directory to search (default: /).
-ts	Add a timestamp to each log message.
-debug	Enable debug output.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Do not prompt for a password (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache file named by KRB5CCNAME, based on the target parameters; if no valid credentials are found, use those supplied on the command line.
-aesKey	AES key for Kerberos authentication (128 or 256 bits).
-dc-ip	Domain controller IP address; if omitted, use the domain portion (FQDN) of the target.
-target-ip	Target IP address; if omitted, use the target value. Useful when the target is a NetBIOS name that cannot be resolved.
-port	Destination SMB server port (choices: 139, 445; default: 445)

Detailed processing flow

With -xmlfile, the tool reads local files. Otherwise, it establishes an SMB session and recursively searches the share and base directory. It detects the encoding of candidate XML files, parses them as DOM documents, extracts fields from each preference element, decrypts base64 cpassword values with the known AES key, and displays the results.

How it works

Some Group Policy Preferences XML files stored passwords encrypted with a shared, known AES key in the cpassword attribute. This command separates finding XML files from interpreting and decrypting the attribute. Both local -xmlfile and remote SYSVOL/share searches feed bytes to the same parser.

For SMB searches, it recursively follows directory entries from the share and base directory, treating XML names and extensions used by GPP as candidates. Because the retrieved bytes are not necessarily UTF-8, it uses charset_normalizer to estimate the encoding before passing them to the DOM parser. Attribute locations such as username, newName, changed, and path vary by XML element type; parse_xmlfile_content() normalizes them into a common record.

The tool adds missing base64 padding to cpassword, decrypts it with the fixed AES key and IV in CBC mode, removes PKCS#7 padding, and recovers the Unicode password. Reading the XML, finding cpassword, and obtaining valid plaintext are separate stages. An inaccessible directory, malformed XML, or decryption failure in one record should not halt the whole search.

Key implementation elements

Symbol	Location	Where to trace its responsibility
GetGPPasswords	40	__init__(), list_shares(), find_cpasswords(), parse_xmlfile_content(), parse(), decrypt_password(), show()
parse_args()	209	Module function
parse_target()	237	Module function
init_smb_session()	260	Module function

Dependencies

Within Impacket

Module	Main names used
impacket	version
impacket.examples	logger, utils
impacket.smbconnection	SMB2_DIALECT_002, SMB2_DIALECT_21, SMBConnection, SMB_DIALECT, SessionError

External packages (used directly)

Import name	Distribution package	Import path and declaration status
Cryptodome	pycryptodomex	Imported directly; declared
charset_normalizer	charset_normalizer	Imported directly; declared

Output, side effects, and required privileges

• The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
• Depending on the options, it creates or updates local files. Check how existing files are handled and the permissions on output containing secrets.

Failure paths and cleanup

• On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.

When changing the implementation

The code depends on SMBConnection, Cryptodome.Cipher.AES, charset_normalizer, and XML DOM. GetGPPasswords separates I/O, parsing, and cryptography across find_cpasswords(), parse_xmlfile_content(), and decrypt_password().

Verification

• Syntax: python -m py_compile examples/Get-GPPPassword.py
• CLI: python examples/Get-GPPPassword.py -h
• No test specific to this command was found. Use tests for shared modules and, when needed, test its behavior in an isolated environment.