SCCM

Decrypting the Forest From the Trees

Decrypting the Forest From the Trees

| | Active Directory, forest-discovery, SCCM
TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via the Administration ...
Posts By SpecterOps Team Members - Medium
Further Adventures With CMPivot — Client Coercion

Further Adventures With CMPivot — Client Coercion

| | configmgr, Cybersecurity, SCCM
Further Adventures With CMPivot — Client CoercionPerfectly Generated AI Depiction based on TitleTL:DRCMPivot queries can be used to coerce SMB authentication from SCCM client hostsIntroductionCMPivot is a component part of the Configuration Manager framework. With the rise ...
Posts By SpecterOps Team Members - Medium
Automating SCCM with Ludus: A Configuration Manager for Your Configuration Manager

Automating SCCM with Ludus: A Configuration Manager for Your Configuration Manager

| | Automation, Cybersecurity, homelab, SCCM
TL;DR: Using Ludus as the backend, and with the help of Erik at Bad Sector Labs, I present a fully customizable SCCM deployment you can integrate into your home lab. https://github.com/Synzack/ludus_sccmIntroThe past ...
Posts By SpecterOps Team Members - Medium
A Detection Engineer’s Guide to SCCM Misconfiguration Abuse

A Detection Engineer’s Guide to SCCM Misconfiguration Abuse

| | detection-engineering, SCCM, sccm-tools, Threat Hunting
OverviewSystem Center Configuration Manager (SCCM), now known as Microsoft Endpoint Configuration Manager, is a comprehensive management solution for deploying, managing, and maintaining Windows-based devices and systems within an organization. It allows IT ...
SnapAttack - Medium
SCCM Exploitation: Compromising Network Access Accounts 

SCCM Exploitation: Compromising Network Access Accounts 

| | Blog, Cybersecurity, Penetration Testing, pentesting, SCCM, Security Research, Threat & Attack Simulation, Vulnerability Management & Penetration Testing
Authors: Marshall Price and Connor Dowling TL;DR: SCCM Network Access Accounts (NAA) are frequently used despite being associated with several […] ...
The Guiding Point | GuidePoint Security
Rooting out Risky SCCM Configs with Misconfiguration Manager

Rooting out Risky SCCM Configs with Misconfiguration Manager

| | Information Security, Red Team, research, SCCM
tl;dr: I wrote a script to identify every TAKEOVER and ELEVATE attack in Misconfiguration Manager.Ever since Garrett Foster, Duane Michael, and I released Misconfiguration Manager at SO-CON last month, we’ve had tons ...
Posts By SpecterOps Team Members - Medium
SCCM Exploitation: Account Compromise Through Automatic Client Push & AD System Discovery 

SCCM Exploitation: Account Compromise Through Automatic Client Push & AD System Discovery 

| | Blog, Cybersecurity, Penetration Testing, pentesting, SCCM, Security Research, Threat & Attack Simulation, Vulnerability Management & Penetration Testing
Author: Marshall Price, Senior Security Consultant TL;DR: The following conditions can lead to compromise of the SCCM client push account […] ...
The Guiding Point | GuidePoint Security
Misconfiguration Manager: Overlooked and Overprivileged

Misconfiguration Manager: Overlooked and Overprivileged

| | attack-path-management, Information Security, information-technology, SCCM
TL;DR: Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance. We’re also presenting this material at SO-CON 2024 on March 11, ...
Posts By SpecterOps Team Members - Medium
SCCM Hierarchy Takeover with High Availability

SCCM Hierarchy Takeover with High Availability

| | configuration management, Cybersecurity, mecm, Microsoft, SCCM
TL;DR: SCCM sites configured to support high availability can be abused to compromise the entire hierarchyI previously wrote about how targeting site systems hosting the SMS Provider role can be used to ...
Posts By SpecterOps Team Members - Medium
SCCM Hierarchy Takeover

SCCM Hierarchy Takeover

| | configmgr, Infosec, pentesting, Red Team, SCCM
One Site to Rule Them Alltl;dr:There is no security boundary between sites in the same hierarchy.When an administrative user is granted a security role in SCCM, such as Full Administrator or Infrastructure Administrator, ...
Posts By SpecterOps Team Members - Medium
Load more