I grabbed the password hash from a domain's Groups.xml file and decrypted the hash. However the decrypted password contains characters "%" and "^", and I'm having problems using it with winexe. No matter what I try, it tells me the credentials are incorrect. I'm trying:

winexe -U Administrator%test^pass%1234 //lab-host-ip "cmd"

I escaped both characters using \^ and \% but it still gives me an authentication error. I tried double and single quotes but no luck. What am I doing wrong?


The password may be wrong. You found it in a group policy, but the group policy might not actually apply to any machine, or at least not the machine you are testing it with. They could have changed the password or maybe they deployed LAPS since then.

You can try this (from PowerView) to find out to which computers the GPO applies:

# retrieve all the computer dns host names a GPP password applies to
Get-DomainOU -GPLink '<GPP_GUID>' | % {Get-DomainComputer -SearchBase $_.distinguishedname -Properties dnshostname}


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.