gpoParser - gpoParser is a tool designed to extract and analyz

项目说明

gpoParser

gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Acti en.
Since enumerating these settings can be tedious and time-consuming, this tool provides a clearer understanding of applied policies and helps identify dangerous configurations that could enable lateral mo or pri escalation.
It was presented at leHack 2025 and DEFCON 33.

Install

Note: dependency needed for gssapi package: libkrb5-dev, install via sudo apt install libkrb5-dev (or via your relevant package manager)

Features

GPO retrieval in online or offline mode

Online: Connects to the LDAP directory to gather GPO-related information and their attributes (flags, gPLink, gPOptions, and more). It also connects to the SYS to collect the GPO configuration files.

Offline: Requires a (partial) copy of the LDAP directory and the content of the Policies folder from the SYS. Currently, LDAP directory collection relies on:

- ldeep
- ADExplorerSnapshot Objects output format (NDJSON)

Display

This mode displays all configuration changes applied by GPOs, limited to supported formats and parsed data. You can filter the results by GPO name or GUID.

Query

This view shows the relationships between GPOs and computers. For example, you can see which computers a GPO applies to or what changes are applied to one or more computers.

BloodHound enrichment

Parses GPO information to create additional edges such as AdminTo, CanRDP, and CanPSRemote, identifying lateral mo opportunities that BloodHound may not detect natively. Edges are added by connecting directly to the Neo4j database.

Limitations

Offline data ingestion introduces certain limitations: parameters such as inheritance status, user/computer configuration status, security filters, WMI filters, and item-le may not always be collected or interpreted by existing tools (BloodHound, PowerView, GPOHound).
gpoParser will progressively take all these parameters into account as its de continues.
Additional data collectors will be introduced as the tooling e.

项目信息

开发语言：Python

Star 数：376

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。