> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # SCCMHunter Documentation > Post-exploitation tool for identifying, profiling, and attacking SCCM infrastructure in Active Directory environments. SCCMHunter Banner SCCMHunter Banner SCCMHunter is a post-exploitation tool built to streamline identifying, profiling, and attacking SCCM-related assets in an Active Directory domain. This comprehensive toolkit provides multiple attack vectors against Microsoft System Center Configuration Manager (SCCM) infrastructure. SCCMHunter was developed and tested in lab environments. Performance may vary in production networks. Please report issues on GitHub if you encounter problems. ## Attack Methodology SCCMHunter follows a systematic approach to SCCM exploitation: ### 1. **Discovery and Enumeration** The tool queries LDAP through multiple methods to identify SCCM infrastructure: Checks the DACL for the 'System Management' container manually created during AD schema extension Resolves any published Management Points that clients use for communication Identifies PXE-enabled Distribution Points using Windows Deployment Services Searches for "SCCM" and "MECM" keywords throughout the directory based on common naming practices ### 2. **Target Profiling** Once targets are identified, SCCMHunter profiles them using the SMB module: * **Share Analysis**: Checks for default shares required by specific SCCM roles * **SMB Signing Status**: Determines SMB signing configuration for potential relay attacks * **Service Detection**: Identifies MSSQL services and SMS Provider roles * **Attack Surface Mapping**: Builds a comprehensive picture of potential attack paths ### 3. **Exploitation Modules** Abuse client enrollment processes using techniques from @*xpn* Leverage MSSQL relay attacks for complete site server takeover (@\_mayyhem) Extract Network Access Accounts from compromised SCCM clients Post-exploitation command and control for lateral movement and persistence ## Tool Capabilities SCCMHunter provides end-to-end capabilities for SCCM security assessment: * **Automated Discovery**: LDAP-based enumeration of SCCM infrastructure * **Intelligent Profiling**: SMB-based service and role identification * **Multiple Attack Vectors**: HTTP, MSSQL, and DPAPI exploitation techniques * **Post-Exploitation**: Administrative access and lateral movement capabilities ## Prerequisites SCCMHunter requires existing network access and should only be used in authorized penetration testing scenarios. * Valid Active Directory credentials * Network access to target SCCM infrastructure * Python 3.x environment * Understanding of SCCM architecture and security implications ## Next Steps Installation and initial setup instructions Begin with LDAP discovery and target identification Explore available attack vectors and techniques Administrative access and lateral movement capabilities ## Acknowledgments Thanks to [@\_Mayyhem](https://twitter.com/_Mayyhem) for the documentation format inspiration and [@*xpn*](https://twitter.com/_xpn_) for HTTP enumeration techniques.