MITRE ATT&CK TTPs
Requirements
Permitted security roles:- Full Administrator
- Application Administrator
Summary
SCCM allows administrators to deploy applications located at a specified UNC path to client devices and can select whether they are executed asSYSTEM, as the currently logged in user, or as a specific user.
Impact
An attacker could use this technique to deploy an application on a remote client device asSYSTEM, as the currently logged in user, or as a specific user. This can be abused to conduct lateral movement by executing a C2 agent binary from a reachable UNC path (e.g., a readable file share) or by specifying the UNC path of an attacker relay server and forwarding the user’s NTLM authentication to another system where they have administrator privileges.
New applications can also be hidden from being displayed in the Configuration Manager Console software, making them more difficult to detect.
Defensive IDs
- DETECT-4: Monitor application deployment logs in the site’s Audit Status Messages
- PREVENT-9: Enforce MFA for SMS Provider calls
- PREVENT-20: Block unnecessary connections to site systems
Subtechniques
- EXEC-1.1 - Deploy binary or script from share
- EXEC-1.2 - Deploy as user to relay NTLM authentication
Examples
Note that any user with theApplication Administrator role can also perform this attack, but they will not be able to conduct the first step below to confirm their role, nor will they be able to force clients to immediately update their machine policy and execute pending application deployments. They will have to wait for the machine policy to be polled automatically by the client, which by default, occurs every 60 minutes.
-
Confirm that the current domain context has the necessary privileges to define a collection of systems and deploy applications to it by executing:
EXEC-1.1
-
Execute the following command, which creates a device collection, adds the specified device or user to the collection, creates an application using the specified installation path, deploys the application to the device collection, waits for the deployment to complete (the default is 5 minutes but may need to be increased in large hierarchies), then cleans up the created objects:
Note that by default, the application is executed in the context of the currently logged on user, but can be executed as
SYSTEMusing the-soption. The path (calc.exe) can be substituted for a UNC path where a binary resides (e.g., a C2 agent binary on a readable file share,\\share\bin.exe). Alternatively, the installation path can be set to the path for PowerShell to execute a script in on the device.Installation paths can include other programs and their arguments as well, so there are many possible ways to abuse this functionality.
EXEC-1.2
This technique to elicit NTLM authentication is no different than application deployment via EXEC-1.1, except that the installation path of outher malicious application is set to a UNC path on a relay server that the attacker controls. That way, when each SCCM client in the deployment group attempts to install the new application, it sends NTLM authentication to the attacker’s listening machine via SMB (or HTTP, if WebClient is enabled). This is advantageous in scenarios where execution of PowerShell or a C2 agent binary is blocked or could result in detection. Because SCCM has an option to install application deployments either as the logged-on user, a specific user, or as SYSTEM, an attacker can capture/relay credentials for users associated with a specific computer using SCCM as well.- Identify where the target user has user device affinity or was the last to log on (RECON-5).
-
On the attacker relay server, start
ntlmrelayx, targeting the IP address of the relay target and the SMB service: -
Use the same command and technique noted in EXEC-1.1, but instead of specifying the path to a binary or script, specify the UNC path to a system where
ntlmrelayxis running to negotiate NTLM authentication and impersonate the target user to another target device:After a few minutes, ntlmrelayx should receive a connection from the account:Alternatively, to automatically find the device whereAPERTURE\cave.johnsonis the primary user and coerce NTLM authentication from the user to192.168.57.130, execute:
References
- Matt Nelson, Offensive Operations with PowerSCCM
- Dave Kennedy and Dave DeSimone, Owning One to Rule Them All
- Chris Thompson, Relaying NTLM Authentication from SCCM Clients
- Chris Thompson, SharpSCCM