This quick start assumes you have already completed the installation process and have valid domain credentials.
Assessment Workflow
Step 1: LDAP Discovery
Start by discovering SCCM infrastructure in the target domain:Expected Discovery Output
Expected Discovery Output
Step 2: SMB Profiling
Profile the discovered targets to understand their roles and attack surface:Expected Profiling Output
Expected Profiling Output
Step 3: Target Analysis
Review the discovery and profiling results to identify attack vectors:Target Prioritization
High Priority Targets:
- Site Servers with SMB signing disabled
- Management Points with exposed HTTP services
- Distribution Points with PXE variables
- MSSQL instances with site database access
- HTTP client enrollment for credential theft
- MSSQL relay attacks for privilege escalation
- DPAPI extraction from Distribution Points
- SMB relay attacks against unsigned targets
Step 4: Exploitation
Option A: HTTP Client Enrollment
Target HTTP-based client enrollment for credential extraction:Option B: MSSQL Privilege Escalation
Leverage MSSQL access for privilege escalation:Option C: DPAPI Secret Extraction
Extract Network Access Account credentials:Step 5: Post-Exploitation
If you’ve successfully gained administrative access, use the admin module:Common Workflows
Red Team Engagement
Red Team Engagement
Objective: Gain domain admin through SCCM compromise
- Discovery:
findmodule to map SCCM infrastructure - Profiling:
smbmodule to identify attack surface - Exploitation:
httpormssqlmodules for initial access - Escalation:
adminmodule for privilege escalation - Persistence: Create backdoor accounts and maintain access
Penetration Test
Penetration Test
Objective: Assess SCCM security posture
- Enumeration: Comprehensive discovery with all modules
- Vulnerability Assessment: Identify misconfigurations and weaknesses
- Proof of Concept: Demonstrate exploitability without damage
- Documentation: Export results for detailed reporting
- Remediation: Provide specific hardening recommendations
Purple Team Exercise
Purple Team Exercise
Objective: Test detection capabilities
- Baseline: Establish normal SCCM activity patterns
- Attack Simulation: Execute controlled attack scenarios
- Detection Analysis: Verify security monitoring effectiveness
- Tuning: Adjust detection rules and monitoring systems
- Validation: Re-test to confirm improved detection
Troubleshooting Common Issues
Authentication Failures
Authentication Failures
Symptoms: “Authentication failed” or “Access denied” errorsSolutions:
- Verify credentials are correct and account is not locked
- Check domain name format (use FQDN)
- Try different authentication methods (-k for Kerberos)
- Ensure network connectivity to domain controller
No SCCM Infrastructure Found
No SCCM Infrastructure Found
Symptoms: Empty results from find moduleSolutions:
- Verify you’re targeting the correct domain
- Check if SCCM is actually deployed in the environment
- Try the
-resolveflag for nested group enumeration - Confirm you have appropriate LDAP read permissions
SMB Connection Issues
SMB Connection Issues
Symptoms: SMB profiling fails or times outSolutions:
- Check SMB signing requirements and compatibility
- Verify network connectivity and firewall rules
- Try reducing thread count with
-threadsparameter - Use specific target lists instead of broad scanning
Next Steps
LDAP Enumeration
Deep dive into LDAP discovery techniques and advanced options
HTTP Exploitation
Learn advanced HTTP client enrollment attack techniques
MSSQL Attacks
Master MSSQL-based privilege escalation methods
Post-Exploitation
Explore administrative access and lateral movement capabilities
Best Practices
Operational Security
- Test in Labs First: Always validate techniques in controlled environments
- Minimize Impact: Use read-only operations when possible during assessments
- Document Everything: Maintain detailed logs of activities and findings
- Coordinate with Teams: Communicate with IT and security teams during authorized testing
- Clean Up: Remove any temporary artifacts created during testing