gpoParser

To install gpoParser, you must first ensure that the libkrb5-dev dependency is installed on your system via your package manager (e.g., sudo apt install libkrb5-dev). Once the dependency is met, you can install the tool using pipx directly from the GitHub repository.

sudo apt install libkrb5-dev
pipx install git+https://github.com/synacktiv/gpoParser

Before using gpoParser, ensure you have the following Python packages installed. Note that a specific version of ldap3 is required for compatibility:

pip3 install ldap3-bleeding-edge==2.10.1.1337 chardet impacket ijson neo4j

The local mode parses GPOs from local files. This requires a copy of the SYSVOL Policies folder and an LDAP directory dump.

Supported LDAP dump formats:

• ldeep (default)
• adexplorer (using ADExplorerSnapshot NDJSON output)

Usage: gpoParser local [-f {ldeep,adexplorer}] [-o OUTPUT] <sysvol_folder> <ldap_folder>

# Example using ldeep format
gpoParser local sysvol/ ldap/

The remote mode connects directly to an Active Directory environment. It uses LDAP to gather GPO attributes (like gPLink and gPOptions) and connects to the SYSVOL share to collect configuration files.

Use the following flags to authenticate:

• -s, --server: LDAP server IP or FQDN (e.g., ldap://192.168.57.5).
• -d, --domain: The domain name.
• -u, --user: Username.
• -p, --password: Password.
• -H, --hash: NTLM authentication in [LM:]NT format.
• -k, --kerberos: Use Kerberos authentication.
• -o, --output: Specify a custom output filename (defaults to ./cache_gpoParser_<timestamp>.json).

gpoParser remote -u bob -p password -d corp -s 192.168.57.5

The gpoParser tool operates in one of five primary modes:

• local: Parse GPOs from local SYSVOL and LDAP dump files.
• remote: Parse GPOs by connecting to a live LDAP/SYSVOL environment.
• display: View the parsed configuration changes from the cache.
• query: Query the relationship between GPOs and computers.
• enrich: Add GPO-derived edges to a BloodHound Neo4j database.

usage: gpoParser [-h] {local,remote,display,query,enrich} ...

The display mode shows configuration changes applied by GPOs (e.g., Group memberships, Registry changes) based on the cached JSON data. You can filter the output to specific GPOs.

Options:

• -g, --gpo: Filter results by a specific GPO name or GUID.
• -c, --cache: Specify a custom cache file location.

# Display all parsed GPO changes
gpoParser display

# Filter by GPO name
gpoParser display -g work

Use the local mode to parse Group Policy Objects (GPOs) from local files. This requires a SYSVOL folder and an LDAP dump in ldeep or adexplorer format.

Arguments:

• sysvol_folder: Path to the SYSVOL folder containing policies.
• ldap_folder: Folder containing the LDAP dump.
• -f, --format: Input format (ldeep or adexplorer). Defaults to ldeep.
• -o, --output: Output filename for the cache. Defaults to ./cache_gpoParser_<timestamp>.json.

python3 gpoParser/__init__.py local /path/to/sysvol /path/to/ldap_dump -f ldeep -o my_cache.json

Use the query mode to identify relationships between GPOs and computers. You can query which computers are affected by a specific GPO, or which GPOs affect a specific computer.

Arguments:

• -g, --gpo: Filter by GPO name or GUID.
• -C, --computer: Filter by computer name or distinguishedName.
• -c, --cache: Path to the cache file. Defaults to ./cache_gpoParser_*.json.

# Find all computers affected by a specific GPO
python3 gpoParser/__init__.py query -c my_cache.json -g "GPO_GUID_OR_NAME"

# Find all GPOs affecting a specific computer
python3 gpoParser/__init__.py query -c my_cache.json -C "CN=Comp1,OU=Workstations,DC=corp,DC=local"

The enrich mode parses the cached GPO information to create new edges in a BloodHound Neo4j database. This helps identify lateral movement opportunities like AdminTo, CanRDP, and CanPSRemote that are not natively detected by BloodHound.

Options:

• -u, --user: Neo4j username (default: neo4j).
• -p, --password: Neo4j password (default: bloodhoundcommunityedition).
• -s, --server: Neo4j server URI (default: bolt://localhost:7687).
• -c, --cache: Cache file location.

gpoParser enrich -u neo4j -p password -s bolt://localhost:7687

The query mode maps the relationship between GPOs and computers. It allows you to see which computers are affected by a specific GPO, or what specific configuration changes are applied to a specific computer.

Options:

• -g, --gpo: Filter by GPO name or GUID.
• -C, --computer: Filter by computer name or distinguishedName.
• -c, --cache: Specify a custom cache file location.

# See which computers are affected by GPOs
gpoParser query

# See what changes are applied to a specific computer
gpoParser query -C wks

Use the remote mode to parse GPOs directly from a remote LDAP/SYSVOL server. This mode requires network access to the domain controller.

Arguments:

• -s, --server: LDAP server IP or FQDN (e.g., ldap://192.168.57.5 or ldaps://dc.corp.local).
• -d, --domain: Domain name.
• -u, --user: Username.
• -p, --password: Password.
• -H, --hash: NTLM authentication in [LM:]NT format.
• -k, --kerberos: Use Kerberos authentication.
• -o, --output: Output filename for the cache. Defaults to ./cache_gpoParser_<timestamp>.json.

python3 gpoParser/__init__.py remote -s ldap://dc.corp.local -d corp.local -u administrator -p password123 -o remote_cache.json