# Simulating legitimate Active Directory services (SMB/LDAP) on the network: GPO exploitation research (Synacktiv)

> Synacktiv research by Quentin Roland describes Scapy-based multiplexing SMB and LDAP servers that simulate authenticated Active Directory services, enabling exploitation of user Group Policy Objects (via gPCFileSysPath/gPLink poisoning) without dummy domain controllers. It is offensive research with public tooling; no in-the-wild exploitation is reported.

- **Published:** 2026-10-22T12:43:01Z
- **Last reviewed:** 2026-10-22T12:43:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4142
- **ID:** TL-2026-4142
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-54121

## Description

On 2026-08-31 Synacktiv published offensive research by Quentin Roland on simulating legitimate Active Directory LDAP and SMB services on the network, building on the earlier GPOddity (gPCFileSysPath spoofing) and OUned (gPLink manipulation) tools. GPO poisoning works by modifying the gPCFileSysPath attribute of a Group Policy Container (GPC) LDAP object, or by injecting a malicious GPC reference through the gPLink attribute of an OU/site/domain (requiring WriteGPLink-type permissions), so that targets fetch a poisoned Group Policy Template (GPT) from an attacker-controlled SMB server. Malicious settings such as scheduled tasks (ScheduledTasks.xml) are then applied by the client with elevated privileges.

The research resolves a long-standing limitation around user GPOs. Since MS16-072 (CVE-2016-3223), the initial GPO retrieval uses the machine security context, and only the GPT.INI fetch uses the user's context. A rogue SMB server therefore needs to handle a user authentication followed by a second session (machine account) on the same TCP connection. The previous impacket-based SMB server assumed one session per connection and failed. Synacktiv implemented SMB session multiplexing (SessionID handling per SMB 2.0) in Scapy (SMBStreamSocketMultiplexing in layers/smb2.py, layers/smbserver.py), supporting Kerberos/Netlogon domain authentication.

The work also adds a Scapy-based LDAP server (layers/ldapserver.py, layers/ldap.py) configured from JSON keyed by distinguished names, supporting add/delete/modify/search (BASE/LEVEL/SUBTREE), SPNEGO authentication and a machine account (SCAPY$) with AES256 keys. This removes the need for a dummy Active Directory domain in OUned-style LDAP attacks and the tedious network forwarding previously required. The article notes the approach is also relevant to rogue LDAP/SMB listeners used in the Certighost ADCS flaw (CVE-2026-54121), mentioned only as context. The article states no IOCs, no detections or mitigations, and no in-the-wild use. Defenders should treat the published tooling as a source of behavioral detection opportunities: unexpected gPCFileSysPath/gPLink changes, GPC objects pointing to non-SYSVOL UNC paths, machine accounts fetching GPTs from non-domain-controller hosts, and rogue SMB/LDAP listeners on internal segments.

## MITRE ATT&CK

- T1484.001 Group Policy Modification
- T1484.001 Group Policy Modification
- T1557 Adversary-in-the-Middle
- T1557 Adversary-in-the-Middle
- T1187 Forced Authentication
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1053.005 Scheduled Task
- T1078.002 Domain Accounts
- T1036 Masquerading

## Sources

- [Simulating legitimate Active Directory services on the network: the case of GPO exploitation (Synacktiv)](https://www.synacktiv.com/en/publications/simulating-legitimate-active-directory-services-on-the-network-the-case-of-gpo.html)
- [GPOddity: exploiting Active Directory GPOs through NTLM relaying and more (Synacktiv)](https://synacktiv.com/publications/gpoddity-exploiting-active-directory-gpos-through-ntlm-relaying-and-more)
- [OUned.py: exploiting hidden Organizational Units ACL attack vectors in Active Directory (Synacktiv)](https://synacktiv.com/publications/ounedpy-exploiting-hidden-organizational-units-acl-attack-vectors-in-active-directory)
- [GPOddity repository](https://github.com/Synacktiv/GPOddity)
- [OUned repository](https://github.com/Synacktiv/OUned)
- [GroupPolicyBackdoor repository](https://github.com/synacktiv/GroupPolicyBackdoor)
- [Scapy repository](https://github.com/secdev/scapy)
- [Microsoft Security Bulletin MS16-072](https://learn.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-072)
- [CVE-2026-54121: Certighost ADCS Flaw Lets Domain Users Impersonate Domain Controllers](https://www.ampcuscyber.com/shadowopsintel/certighost-ad-cs-flaw-lets-domain-users-impersonate-domain-controllers/)
- [Certighost research (Kudelski Security)](https://kudelskisecurity.com/research/certighost)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4142