MITRE ATT&CK TTPs
Requirements
Coercion
- Valid Active Directory domain credentials
- Connectivity to SMB (TCP/445) on coercion target:
- Connectivity from the coercion target to SMB (TCP/445) on the relay server
- Coercion target settings:
BlockNTLM=0or not present, or =1andBlockNTLMServerExceptionListcontains attacker relay server [DEFAULT]RestrictSendingNTLMTraffic=0,1, or not present, or =2andClientAllowedNTLMServerscontains attacker relay server [DEFAULT]- Domain computer account is not in
Protected Users[DEFAULT]
- Domain controller settings:
RestrictNTLMInDomain=0or not present, or is configured with any value andDCAllowedNTLMServerscontains coercion target [DEFAULT]
Relay
- Connectivity from the relay server to SMB (TCP/445) on the relay target, the child primary site OR
- Connectivity from the relay server to HTTPS (TCP/443) on the relay target, the child primary site AND
-
Relay target settings:
RequireSecuritySignature=0or not present [DEFAULT]RestrictReceivingNTLMTraffic=0or not present [DEFAULT]- Coercion target is local admin (to access RPC/admin shares)
-
Domain controller settings:
RestrictNTLMInDomain=0or not present, or is configured with any value andDCAllowedNTLMServerscontains relay target [DEFAULT]LmCompatibilityLevel<5or not present, or =5and LmCompatibilityLevel >=3on the coercion target [DEFAULT]
Summary
In some situations, such as reaching limits for client enrollment, SCCM adminsitrators may choose to expand from single site into a hierarchy managed by a central administration site (CAS). A prerequisite for expansion is for the CAS’s domain computer account to be a local administrator on the originating primary site server. This permission is only required during expansion of the site and can be removed when complete. Additionally, this permission is not required for any further sites joined to the hierarchy once complete. However, if a configuration exists where all site server hosts are a member of a security group that grants local administrator rights to each other, the CAS can be coerced and relayed to any child site. An attacker who is able to successfully coerce NTLM authentication from a CAS via SMB can escalate to “Full Administrator” by either:- Relaying the CAS to SMB on its originating child primary site
- Relaying the CAS to the AdminService on its originating child primary site
Impact
The “Full Administrator” security role is granted all permissions in Configuration Manager for all scopes and all collections. An attacker with this privilege can execute arbitrary programs on any client device that is online as SYSTEM, the currently logged on user, or as a specific user when they next log on. They can also leverage tools such as CMPivot and Run Script to query or execute scripts on client devices in real-time using the AdminService or WMI on an SMS Provider.Defensive IDs
- DETECT-1: Monitor site server domain computer accounts authenticating from another source
- DETECT-5: Monitor group membership changes for SMS Admins
- DETECT-5: Monitor group membership changes for RBAC_Admins table
- PREVENT-12: Require SMB signing on site systems
- PREVENT-20: Block unnecessary connections to site systems
Subtechniques
- TAKEOVER-4.1: Relay to SMB
- TAKEOVER-4.2: Relay to AdminService
Examples
SMB relay
-
Use
SCCMHunterto profile SCCM infrastructure The results of thesmbmodule indicate:- The CAS.INTERNAL.LAB sytems is a site server in the “CAS” site and is also a central administration site
- The SCCM2.INTERNAL.LAB host is a site server in the “ABC” site
- SMB signing is disabled on both systems
-
On the attacker relay server, start
ntlmrelayx, targeting the SMB service on the primary site server identified in the previous step. The-socksflag is used to hold the authenticated session open: -
From the attacker host, coerce NTLM authentication from the CAS via SMB, targeting the relay server’s IP address:
After a few seconds, you should receive an SMB connection on the relay server that is forwarded to the SMB service on the site server and the authenticated session is held open:
-
Proxy
secretsdump.pyin the context of the CAS through the authenticated session to recover the primary site server’s hashed credential: -
Get TGT for recovered site server machine account:
-
S4U:
-
Set the Kerberos credentials cache file environment variable:
-
Establish a PowerShell remoting session on the target site server to interact with the SMS Provider:
References
- Microsoft, Prerequisites for installing Configuration Manager sites
- Garrett Foster, SCCMHunter