Shitty sysadmins - MS14-025
findstr /S /I cpassword shouldn't give you domain admin in 2019
tl;dr
findstr /S /I cpassword \\lol.domain\SYSVOL\lol.domain\Policies\
What
- Group policy does a bunch of stuff, some of this stuff needs credentials
- These credentials would end up in a
cpasswordattribute - Everyone realised this was a bad idea in 2014
- The ability to do things this was removed in 2014
When you see these things in 2019, it’s because something old is still there (and it’s probably been abused by some other attacker too).