Skip to main content

​
MITRE ATT&CK TTPs

​
Requirements

​
Coercion

  • Valid Active Directory domain credentials
  • Connectivity to SMB (TCP/445) on coercion target:
  • Connectivity from the coercion target to SMB (TCP/445) on the relay server
  • Coercion target settings:
    • BlockNTLM = 0 or not present, or = 1 and BlockNTLMServerExceptionList contains attacker relay server [DEFAULT]
    • RestrictSendingNTLMTraffic = 0, 1, or not present, or = 2 and ClientAllowedNTLMServers contains attacker relay server [DEFAULT]
    • Domain computer account is not in Protected Users [DEFAULT]
  • Domain controller settings:
    • RestrictNTLMInDomain = 0 or not present, or is configured with any value and DCAllowedNTLMServers contains coercion target [DEFAULT]

​
Relay

  • Connectivity from the relay server to SMB (TCP/445) on the relay target, the child primary site OR
  • Connectivity from the relay server to HTTPS (TCP/443) on the relay target, the child primary site AND
  • Relay target settings:
    • RequireSecuritySignature = 0 or not present [DEFAULT]
    • RestrictReceivingNTLMTraffic = 0 or not present [DEFAULT]
    • Coercion target is local admin (to access RPC/admin shares)
  • Domain controller settings:
    • RestrictNTLMInDomain = 0 or not present, or is configured with any value and DCAllowedNTLMServers contains relay target [DEFAULT]
    • LmCompatibilityLevel < 5 or not present, or = 5 and LmCompatibilityLevel >= 3 on the coercion target [DEFAULT]

​
Summary

In some situations, such as reaching limits for client enrollment, SCCM adminsitrators may choose to expand from single site into a hierarchy managed by a central administration site (CAS). A prerequisite for expansion is for the CAS’s domain computer account to be a local administrator on the originating primary site server. This permission is only required during expansion of the site and can be removed when complete. Additionally, this permission is not required for any further sites joined to the hierarchy once complete. However, if a configuration exists where all site server hosts are a member of a security group that grants local administrator rights to each other, the CAS can be coerced and relayed to any child site. An attacker who is able to successfully coerce NTLM authentication from a CAS via SMB can escalate to “Full Administrator” by either:
  1. Relaying the CAS to SMB on its originating child primary site
  2. Relaying the CAS to the AdminService on its originating child primary site

​
Impact

The “Full Administrator” security role is granted all permissions in Configuration Manager for all scopes and all collections. An attacker with this privilege can execute arbitrary programs on any client device that is online as SYSTEM, the currently logged on user, or as a specific user when they next log on. They can also leverage tools such as CMPivot and Run Script to query or execute scripts on client devices in real-time using the AdminService or WMI on an SMS Provider.

​
Defensive IDs

​
Subtechniques

  • TAKEOVER-4.1: Relay to SMB
  • TAKEOVER-4.2: Relay to AdminService

​
Examples

​
SMB relay

  1. Use SCCMHunter to profile SCCM infrastructure The results of the smb module indicate:
    • The CAS.INTERNAL.LAB sytems is a site server in the “CAS” site and is also a central administration site
    • The SCCM2.INTERNAL.LAB host is a site server in the “ABC” site
    • SMB signing is disabled on both systems
  2. On the attacker relay server, start ntlmrelayx, targeting the SMB service on the primary site server identified in the previous step. The -socks flag is used to hold the authenticated session open:
  3. From the attacker host, coerce NTLM authentication from the CAS via SMB, targeting the relay server’s IP address:
    After a few seconds, you should receive an SMB connection on the relay server that is forwarded to the SMB service on the site server and the authenticated session is held open:
  4. Proxy secretsdump.py in the context of the CAS through the authenticated session to recover the primary site server’s hashed credential:
  5. Get TGT for recovered site server machine account:
  6. S4U:
  7. Set the Kerberos credentials cache file environment variable:
  8. Establish a PowerShell remoting session on the target site server to interact with the SMS Provider:

​
References