⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠆⠀⠀⠀⠀⠀⠀⠀⠀⠀⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⢇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⡄⠀⠀⠀⠀⠀⠀⡆⠀⠀⢀⡏⠘⡆⠀⠀⠀⠀⠀⠀⠀⠀⡼⡄⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⠀⠀⠀⠀⠀⠀⢠⡧⠀⠀⠀⠀⢀⡰⠁⠀⠀⣾⠁⠀⢹⠀⠀⠀⠀⠀⠀⠀⢠⠃⡃⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢦⡀⠀⠀⠀⠀⠀⠀⠀⢰⡇⠀⠀⠀⠀⠀⢠⣟⣇⠀⠀⠀⠀⢸⡇⠀⠀⠀⢃⠀⠀⢨⠇⠀⠀⠀⠀⠀⢀⡏⡌⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⠀⠀⢸⡇⠀⠀⠀⠀⠀⡾⡏⠙⣦⡀⠀⠀⣿⠃⠀⠀⠀⣬⡂⠀⣸⠀⠀⠀⠀⠀⠀⠘⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⢣⠀⠀⠀⠀⠀⠀⠀⢟⡇⠀⠀⠀⠀⢸⠃⠃⠀⠈⢷⠀⠀⣿⠀⠀⠀⠀⠙⣇⠖⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⡞⠀⠀⠀⠀⠀⠀⠀⡇⠈⡇⠀⠀⠀⠀⠀⠀⠈⣇⠀⠀⠀⠀⠘⠀⠀⠀⠀⣸⠀⠀⢿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⡿⠀⠀⠀⠀⠀⠀⠀⣷⠀⡇⠀⠀⠀⠀⠀⠀⠀⠙⣷⣤⡀⠀⠀⢠⣴⡀⢠⡏⠀⠀⠘⡏⠻⣆⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠈⠛⠀⠀⠀⠀⠀⣆⠀⠀⠀⢛⣷⠙⢧⡀⠀⠻⣯⠟⠀⠀⠀⠀⡷⠀⠘⣆⠀⠀⠀⢠⠀⠀⠀⢘⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⠀⠀⠀⠈⢾⡇⠈⣧⠀⠀⠀⠀⠀⠀⠀⣴⢇⠀⠀⢹⠀⠀⠀⢼⠀⠀⠀⡪⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠀⠀⠀⠀⣾⠁⠀⣽⠀⠀⠀⠀⠀⣠⡼⠋⡜⠀⠀⣼⠀⠀⠀⡇⠀⠀⠀⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢷⠀⠀⠀⠀⠀⠀⠀⠀⠀⡄⠀⠀⠀⠀⢀⣼⠃⠀⣰⠏⠀⠀⣠⣴⠞⠋⠀⡼⠁⠀⣰⠇⠀⠀⣸⠃⠀⠀⣸⡁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣇⠀⠀⠀⠈⡇⠀⠀⠀⡇⠀⠀⠀⢠⣾⠇⠀⣰⠋⠀⣠⢾⡟⠁⣠⡶⡓⠁⢀⣴⠋⠀⠀⢀⡏⠀⠀⣰⠿⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⡆⠀⠀⠀⠀⠀⠀⠀⡇⠀⠀⢠⡿⡃⠀⠀⢻⣄⢰⣯⠏⢠⢾⢪⠏⠀⣠⠞⠁⠀⠀⢐⣏⡀⠀⢠⡏⠀⢹⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡿⣆⠀⠀⠀⠀⠀⢸⠃⠀⠀⣿⡍⠀⠀⠀⠀⠉⠛⠀⢀⣯⠃⢸⠀⠀⡏⠀⠀⢀⡴⠛⡿⠀⠀⢸⠁⠀⠀⣷⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡬⠃⠸⡆⠀⠀⠀⠀⡸⢀⠀⠀⢿⡃⠀⢹⡒⢤⡀⠀⠀⠸⡇⠀⢸⡀⠀⢧⡀⠀⣾⠁⠀⣧⠀⠀⢪⡀⠀⠀⣿⠀⠀⢠⡃⠀⠀⠀⠀⡆⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⠖⠀⠀⣿⠀⠀⠀⣠⣗⡏⠀⠀⠘⣇⠀⠈⡇⠀⠙⢦⡀⢸⣧⠀⠀⢧⠀⠈⠳⣄⣿⠀⠀⢹⡄⠀⢸⡂⠀⠀⡿⠀⠀⡞⠀⠀⠀⠀⠘⠄⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣮⠅⠀⠀⢠⡏⠀⠀⣼⡏⢸⡇⠀⠀⠀⢹⡆⢀⡇⠀⡄⠀⠱⣼⣺⡀⠀⡌⠳⡄⠀⠈⠙⠃⠀⠀⢻⡄⠈⣿⡄⣼⠃⠀⡰⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡟⠀⠀⣠⠟⠀⠀⠀⣿⠁⠈⣧⠀⠀⠀⢠⡇⢸⠁⢠⡇⠀⠀⢹⣇⠇⠀⢷⢦⠙⢦⠀⠀⣀⠀⠀⠀⢷⠀⠘⠟⠁⢀⣴⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠸⣇⠂⢰⡏⠀⠀⠀⠀⣿⢐⡆⠸⣆⢀⣰⠟⢀⡏⠀⣸⢳⠀⠀⠸⠏⠀⠀⣿⠃⡇⠈⢳⡀⡏⢧⠀⠀⢸⡆⠀⣠⣶⡟⠁⠀⠀⠀⠀⠀⠀⣸⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢧⣘⣧⠀⠀⠀⢀⣿⠀⣇⠀⠹⠋⠁⠀⡜⢀⢮⠇⢸⠀⠀⠀⠀⢀⠞⠁⣰⠃⠀⠀⢳⠃⠈⡇⠀⢸⡇⣼⡳⢹⡁⠀⠀⠀⠀⠀⠀⠀⣧⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠛⠆⠀⢀⡾⠁⣰⠟⡆⠀⠀⢀⠞⠀⢨⡏⢠⠏⠀⠀⠀⣴⠃⢀⡞⠁⠀⠀⠀⠀⠀⠀⡇⠀⣸⠁⣇⠇⢸⠀⠀⠀⠀⠀⠀⢀⡎⣸⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⡞⠁⣰⡿⠀⠘⢆⡴⠋⠀⠀⠘⠓⠁⠀⠀⠀⢸⡇⠀⠘⣆⠀⠀⠀⠀⠀⠀⢰⠃⣰⠏⠀⣷⠀⠘⣇⠀⠀⠀⠀⠀⡇⠀⡇⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠠⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⠏⠁⡼⣛⡃⠀⠀⠀⠀⠀⠀⢀⡎⣿⠀⠀⠀⠀⠸⣧⠀⠀⠈⢦⡀⠀⠀⠀⠀⣸⢀⡟⠀⠀⢹⡄⡀⠹⡆⠀⠀⠀⠀⠀⠈⠁⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠁⠀⠀⠀⠀⣄⠀⠀⠀⣸⡻⠀⢸⣟⡊⠀⠀⠀⠀⠀⢀⡔⢕⠝⡹⠀⠈⢻⣖⠦⡽⣆⠀⠀⠀⠙⢦⠀⠀⠀⡏⠸⣇⣀⣀⣼⠃⡇⠀⠹⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢹⠀⠀⢠⣯⠇⠀⣗⠴⠁⠀⠀⠀⣀⢖⣥⠞⣡⠞⢁⡤⢖⢾⢻⠀⣸⠈⢳⡄⠀⠀⠀⠳⡄⠀⢧⠀⠈⠉⠉⢀⣠⣷⡀⠀⠹⡆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⡇⠀⢸⡏⡇⠀⡿⡫⠀⠀⠀⢠⢣⠋⢉⠞⠁⡴⠁⠀⡼⢸⢈⣓⠃⠀⢀⡇⠀⠀⠀⠀⠹⡄⠀⡙⠒⠒⢒⡟⠉⠀⣇⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣷⡀⠈⣿⣣⠀⢧⢿⠀⠀⠀⣣⠇⠀⢸⠀⢠⠃⠀⠀⢧⢸⡁⠈⠉⠉⠱⡇⠀⠀⠀⠀⢀⠇⢰⣇⠀⠀⢸⠀⠀⠀⢸⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣧⠀⠘⣷⣣⠘⢮⢧⠀⠀⣿⠀⠀⠈⢧⠀⣆⠀⠀⠈⠢⢵⣤⠀⠀⣜⠇⠀⠀⠀⢠⠞⠀⣏⠸⡄⠀⠃⠀⠀⠀⡞⠀⢠⡏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⣽⣆⡈⠻⣵⡈⠻⣷⠀⠻⡄⠀⠀⠀⠑⠿⣆⠀⠀⠀⠀⠀⠀⡠⠏⠀⠀⢀⢔⣁⣀⡀⢸⡀⠹⡄⠀⠀⠀⢠⠇⢀⡾⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⣿⡝⠲⠶⠭⠷⢎⡵⠀⢝⣆⠀⠀⠀⠀⠘⢦⡀⠀⠀⠀⠴⠋⠀⠀⢰⡁⠀⢉⡇⠉⠞⠀⠀⣹⠀⠀⢀⡎⢀⡾⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⣦⡰⡒⠚⠉⣄⠀⠀⠋⠳⢦⡀⠀⠀⠀⠙⠀⠀⠀⠀⠀⠀⠀⠀⠉⠚⠉⠀⠀⠀⠀⣠⠃⠀⢀⣞⡴⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⣝⣦⡀⠹⡍⠒⠒⠚⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠜⢁⣀⣴⠟⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠻⢦⣼⣦⡄⠀⠀⠀⠀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⣡⡾⠃⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠓⠒⠒⠛⠻⢤⠀⠀⠀⠀⠀⠀⠀⠀⣀⣤⠞⠛⠓⠒⠚⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠁⠁⠀⠀⠂⠐⠀⠈⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
                              GPPFire - iLLWiLL & LiQUiDSKY

GPPfire - AutoLogin Passwords & Others etc...

Python -         Run script (GPP.ps1)
PowerShell -     Run Script (GPP.py)

Description: This script was developed after GPP password tools were caught by AV/EDR. This could be used to gain access to leaked passwords commonly found in shares. The python script checks for AutoLogins and GPP Passwords that need to be decrypted. The powershell is a work in progress and only checks for AutoLogins.

Tested: This script was more for GPP AutoLogins like what you see in pingcastle, include GPP AutoLogins with the username and password from GPP. Works well on legacy environments. - SKY <3

S3 Security Inc. (S3) - 2025 (c)