Skip to main content
The http module exploits SCCM’s client enrollment process to extract Network Access Account credentials from Management Points. This technique combines Adam Chester’s research with skelsec’s deobfuscator to spoof legitimate client enrollment and retrieve sensitive policy information.
This attack leverages the fact that SCCM clients automatically receive Network Access Account credentials through policy requests, allowing attackers to extract these credentials by masquerading as legitimate clients.

​
Attack Overview

The HTTP client enrollment attack works by:
  1. Machine Account Creation: Creating a new machine account in Active Directory (or using existing credentials)
  2. Client Registration: Registering with Management Points as a legitimate SCCM client
  3. Policy Request: Requesting client policies that contain Network Access Account credentials
  4. Credential Extraction: Decrypting and extracting the credentials from the policy response
This attack requires machine account privileges. The -auto flag will automatically create a machine account if you have sufficient privileges, or you can provide existing machine account credentials.

​
Troubleshooting Common Issues

Cause: This error typically occurs when the policy is not immediately available after registration.Solutions:
  • Increase sleep time with the -sleep flag (default: 10 seconds)
  • Use manual policy request with -mp and -uuid flags
  • Wait for SCCM database updates to complete
  • Check for proxy interference in network communications
Root Causes:
  • SCCM database performance issues
  • Network proxy delays
  • Management Point processing lag
  • Timing synchronization issues

​
Prerequisites

Requirements

  • Valid Active Directory credentials
  • Ability to create machine accounts OR existing machine account credentials
  • Network access to discovered Management Points
  • Previous enumeration data from find and smb modules

​
Command Syntax

​
Parameters

Use the -auto flag for fully automated attacks when you have sufficient privileges to create machine accounts. For stealth or when using existing credentials, use the manual approach with -cn and -cp.

​
Usage Examples

Fully automated attack using account with machine creation privileges
Expected Output:
The automatic mode creates a new machine account, registers with all discovered Management Points, and extracts Network Access Account credentials. The decrypted policy is saved for further analysis.
Use pre-existing machine account credentials for stealthy operations
Expected Output:
Using existing machine credentials avoids creating new accounts and may be less detectable. Record the UUID for potential future policy requests.
Request policies using previously obtained registration UUID
Expected Output:
Manual policy requests are useful when timing issues occur during initial registration. This allows you to retry policy extraction without re-registering the client.

​
Attack Analysis

Understanding Network Access Account Credentials

The extracted Network Access Account (NAA) credentials provide:
  • Domain Authentication: Access to network resources during OS deployment
  • Share Access: Read access to distribution point content shares
  • Lateral Movement: Potential for further domain compromise
  • Task Sequence Variables: Additional secrets from deployment configurations

Operational Security

Detection Considerations:
  • Machine account creation may trigger security alerts
  • HTTP traffic to Management Points may be logged
  • Policy requests create entries in SCCM logs
  • Consider using existing machine accounts when possible

Output Files

Generated Artifacts:
  • Decrypted policy XML files
  • Registration UUIDs for future use
  • Network Access Account credentials
  • Task sequence variable dumps

​
Troubleshooting Guide

‘NoneType’ object has no attribute split
  • Increase -sleep value to 20-30 seconds
  • Try manual policy request with saved UUID
  • Check Management Point availability
Authentication failures
  • Verify machine account creation permissions
  • Confirm machine account credentials are correct
  • Check Kerberos vs NTLM authentication requirements
No Management Points found
  • Run find module first to discover MPs
  • Verify Management Points are accessible
  • Check network connectivity to HTTP endpoints

​
Next Steps

Credential Usage

Use extracted NAA credentials for:
  • SMB share enumeration
  • Distribution Point access
  • Further lateral movement

MSSQL Exploitation

Leverage credentials for database attacks and privilege escalation

DPAPI Extraction

Extract additional secrets from client systems using local admin access