One Day Sec

How can an attacker use the SharpGPOAbuse tool to remotely execute a script via GPO from the command line?

Attackers can use SharpGPOAbuse to create or modify a GPO and add a user script. For example, running `SharpGPOAbuse.exe --AddUserScript --ScriptName StartupScript.bat --ScriptContents "cmd.exe /c echo 1 > c:\GPOAbuse.txt" --GPOName "TestGPO1"` adds a logon script to the specified GPO. The script content can include commands that trigger on user logon, and the GPO must be linked to the target domain or OU. After the policy updates, the script executes on affected machines.
SharpGPOAbusedomain penetrationcommand-lineGPOlogon scriptbatch script

Browse all Q&A →