ARP Around and Find Out Hijacking GPO UNC Paths for Code Exe...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/arp-around-and-find-out-hijacking-gpo-unc-paths-for-code-execution-and-ntlm-relay
• Blog Title: ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution and NTLM Relay
• Suggested Section: Windows Hardening -> Active Directory Methodology (new subsection under GPO/GPP abuse) or Windows Local Privilege Escalation/AD -> add technique page: "WriteGPLink + UNC path hijack (ARP spoof) for GPO Software Installation SYSTEM RCE & NTLM relay"

🎯 Content Summary

Title/Context
TrustedSec (Austin Coontz, April 30, 2026) documents practical Active Directory attack chains that turn a common OU ACL misconfiguration (WriteGPLink) plus same-L2 access (ARP spoofing) into (1) remote code execution as NT AUTHORITY\SYSTEM via hijacked GPO Software Installation UNC paths, and (2) NTLMv2 capture and potential NTLM relay by hijacking UNC paths used by drive mappings (and similarly logon/startup scripts). The...

🔧 Technical Details

WriteGPLink → forced GPO application (OU gPLink manipulation)
If an attacker-controlled principal has WriteGPLink over an OU, they can modify the OU’s gPLink attribute to link an existing GPO (without editing/creating the GPO). This forces that GPO’s settings to apply to all users/computers in the OU, enabling abuse of any “dangerous” pre-existing configurations (software install, drive maps, startup/logon scripts) discovered by reading SYSVOL and correlating GPO GUIDs to targets via BloodHound.

GPO Software Installation UNC hijack → SYSTEM execution
When a Software Installation policy references an MSI via a UNC hostname path (e.g., \\HOST\share\package.msi), an attacker on the same L2 segment can ARP spoof the UNC host’s IP to redirect SMB traffic to the attacker machine, bind the victim IP locally (ip addr add X/32 dev IFACE), and serve an SMB share (e.g., Impacket smbserver.py) containin...

🤖 Agent Actions

I’m mapping the AD/GPO-related parts of the repo first, then I’ll read the closest existing pages before deciding whether this belongs in an existing GPO abuse page or needs a new technique page.
I found existing coverage for gPLink, SYSVOL parsing, NTLM relay, and GPP abuse, so I’m reading those pages now to avoid creating redundant content and to pick one precise file for the addition.
The closest existing target is the AD ACL/GPO abuse page. It already covers direct GPO modification and SYSVOL script poisoning, but not the narrower WriteGPLink plus UNC-host hijack path, so I’m checking that section in detail before patching it.
I’ve read the main candidate pages and the gap is narrowing: current coverage explains direct GPO editing and SYSVOL poisoning, but not linking an existing GPO and hijacking its remote UNC dependency over L2. I’m verifying that against the original blog now so the patch stays narrowly scoped and technical.
The blog is accessible, but the initial fetch is mostly page chrome. I’m extracting the embedded article text and cross-checking with adjacent GPO research so the final addition stays about the technique, not the specific writeup.
I’ve confirmed this is new enough to add. I’m patching the AD ACL/GPO abuse page with a compact WriteGPLink + UNC path hijack subsection so the technique sits next to the existing GPO delegation material instead of scattering it across multiple files.
The patch is in place. I’m re-reading the edited section and the file ending now to verify the placement, wording, and references stay consistent with HackTricks style and that nothing redundant or malformed slipped in.
Updated README.md under the existing GPO delegation abuse section.

The new subsection documents the missing technique: abusing WriteGPLink to link an existing UNC-backed GPO, enumerating viable targets from readable SYSVOL, then hijacking the referenced host over L2 to get either MSI-based SYSTEM execution, drive-map NTLM capture with SMB-to-WebDAV relay potential, or logon/startup script execution. I kept it in a single file, added concise commands, and appended the TrustedSec blog to the file’s ## References.

Verification: reviewed the patched section, final references block, and git diff. No automated tests were applicable for this markdown-only change.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/arp-around-and-find-out-hijacking-gpo-unc-paths-for-code-execution-and-ntlm-relay

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (new subsection under GPO/GPP abuse) or Windows Local Privilege Escalation/AD -> add technique page: "WriteGPLink + UNC path hijack (ARP spoof) for GPO Software Installation SYSTEM RCE & NTLM relay"".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0