> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Credential Extraction Commands

> Commands for extracting and decrypting credentials from SCCM

## decrypt

### Description

Decrypt provided encrypted blob using the site server's encryption capabilities.

### Usage

```
decrypt [blob]
```

### Example

<Info>
  This command decrypts encrypted data blobs found within SCCM. Provide the encrypted blob as a parameter to decrypt it using the site server's keys.
</Info>

## decryptEx

### Description

Decrypt provided blob with a specific session key for enhanced decryption capabilities.

### Usage

```
decryptEx [session key] [blob]
```

### Example

<Info>
  Use this command when you have both an encrypted blob and its corresponding session key. This provides more control over the decryption process.
</Info>

## get\_azurecreds

### Description

Extract Azure application credential blobs from the SCCM database.

### Usage

```
get_azurecreds
```

### Example

<Info>
  This command retrieves Azure application credentials that may be stored within SCCM for cloud integration features.
</Info>

## get\_azuretenant

### Description

Get Azure Tenant information configured within SCCM.

### Usage

```
get_azuretenant
```

### Example

<Info>
  Retrieves Azure tenant configuration details that SCCM uses for cloud services integration.
</Info>

## get\_creds

### Description

Extract encrypted credential blobs from the SCCM database.

### Usage

```
get_creds
```

### Example

<Info>
  This command searches for and retrieves encrypted credential blobs stored in the SCCM database. These may include service account credentials, application passwords, and other sensitive data.
</Info>

## get\_forestkey

### Description

Extract forest discovery session key blobs from SCCM.

### Usage

```
get_forestkey
```

### Example

<Info>
  Retrieves session keys used for Active Directory forest discovery processes. These keys may be useful for accessing other domain resources.
</Info>

## get\_pxepassword

### Description

Extract PXE boot encrypted credential blobs.

### Usage

```
get_pxepassword
```

### Example

<Info>
  This command extracts encrypted credentials used for PXE boot processes. PXE passwords are often used to secure network boot environments.
</Info>

<Warning>
  Credential extraction commands require appropriate SCCM administrative privileges. The extracted credentials should be handled securely and used only for authorized security testing purposes.
</Warning>