MITRE ATT&CK TTPs
- TA0007 - Discovery
Requirements
- Valid Active Directory domain credentials
Summary
When certain site system roles are installed, part of the installation process involves configuring file shares on the host system. These shares contain detailed descriptions and unique naming conventions that may disclose what site they’re deployed in and what roles are installed. Reviewing shares on potential site systems contributes to attack path discovery.Impact
- Profiling site system roles is a supplementary step in building potential attack paths.
- A resolved DP role can be a target for PXE abuse to recover domain credentials detailed in CRED-1.
- A resolved DP role can be a target for sensitive information hunting in the Content Library.
- A resolved WSUS role can be a target for lateral movement or privilege escalation detailed in ELEVATE-1
Defensive IDs
Examples
The following examples are a sampling and are not an exhaustive representation of site system roles and their shares.Site Server Shares
The primary site server is configured with multiple default shares when deployed and these shares persist even in configurations where content delivery is migrated to a remote file share. Other than the quantity of shares, shares like theSMS_SITE share or specific strings like “Site Server DP share” for the SMS_DP$ share’s description identify the system is hosting the site server role.
Distribution Point
Distribution points (DP) and site servers have shares in common but their descriptions differentiate the two. Consider theSMS_DP$ share’s description from both roles:
Further, the presence of the REMINST file share indicates that Windows Deployment Services is installed on the host and it is likely a PXE enabled distribution point.
Windows Server Update Services
Windows Server Update Services file shares don’t necessarily disclose what site they’re in, or if they’re enrolled at all, but the default file shares persist. Additionally, a site system can have multiple roles installed, so in some cases a system could have the WSUS and DP roles installed, which would correlate the site and roles. The host for the WSUS service is also granted thesmsdbrole_SUP role in the site database, which is useful for identifying the site database when hosted remotely from the site server.
References
- Garrett Foster, SCCMHunter
- Tomas Rzepka, Looting Microsoft Configuration Manager
- Tomas Rzepka, CMLoot
- Andreas Vikerup and Dan Rosenqvist, cmloot
- Microsoft, smsdbrole_SUP