MITRE ATT&CK TTPs
- T1574.014 - Hijack Execution Flow
Requirements
- Administratiive privileges on the SCCM client
Summary
The CcmExec service executes SCNotification.exe for every user logged onto the SCCM client. Since SCNotification.exe is a .NET application, its configuration file can be modified to point to a .NET assembly on a UNC path, resulting in NTLM authentication coercion. This technique requires administrative privileges on the SCCM client to overwrite the .NET assembly’s configuration file (i.e.,C:\Windows\CCM\SCNotification.exe.config).
Once the file is overwritten, the CcmExec service can be restarted to trigger the SCNotification.exe to attempt to load the remote assembly from an attacker-controlled server. The authentication can be coerced via SMB or HTTP.
This is automated by CcmPwn’s coerce command.
Note: Rather than performing coercion, a payload can be uploaded and configured in SCNotification.exe.config to achieve code execution in the user context.
Impact
This technique provides a method to compromise logged on users through NTLM relay or NetNTLM hash cracking.Defensive IDs
Andrew provides defensive considerations in his blog post on this topic. Since these detections are not SCCM-specific, we have not included them in Misconfiguration Manager but they can be found here.Examples
CcmPwn Coerce
First, setup a listener such as Responder or ntlmrelayx. Here we use Responder:ccmpwn.py with administrative credentials:
ccmpwn.py to restart the service and capture/relay the incoming NTLM authentication:
References
- Andrew Oliveau, SeeSeeYouExec: Windows Session Hijacking via CcmExec
- Andrew Oliveau, ccmpwn
- lgandx, Responder
- Fortra, ntlmrelayx