Interface Control Commands

interact

Description

Sets the target device for command line interactions to a specified ResourceID. This setting must be configured prior to any remote enumeration or script execution.

Usage

interact [ResourceID]

Example

In the below example, the dp device is queried. In the result the 16777221 is returned. The operator can now interact with that device and configure the command line.

() (C:\) >> get_device dp
[19:54:23] INFO     ------------------------------------------
                    Active: 1
                    Client: 1
                    DistinguishedName: CN=DP,OU=SCCM_SiteSystems,DC=internal,DC=lab
                    FullDomainName: INTERNAL.LAB
                    IPAddresses: 10.10.100.11
                    LastLogonUserDomain: LAB
                    LastLogonUserName: administrator
                    Name: DP
                    OperatingSystemNameandVersion: Microsoft Windows NT Server 10.0
                    PrimaryGroupID: 515
                    ResourceId: 16777221
                    ResourceNames: dp.internal.lab
                    SID: S-1-5-21-4004054868-2969153893-1580793631-1105
                    SMSInstalledSites: LAB
                    SMSUniqueIdentifier: GUID:7484EE6B-8D62-40CE-97A4-079F30EDA5A0
                    ------------------------------------------
() (C:\) >> interact 16777221
(16777221) (C:\) >>

Notice how the command prompt changes from () (C:\) >> to (16777221) (C:\) >> after setting the target device. This indicates that you are now targeting the device with ResourceID 16777221.

Finding ResourceIDs

You can find ResourceIDs using several methods:

Using get_device

Query a specific device by hostname to get its ResourceID:

() (C:\) >> get_device hostname

Using get_lastlogon

Find devices where a specific user last logged on:

() (C:\) >> get_lastlogon username

Using get_puser

Find devices where a user is configured as the primary user:

() (C:\) >> get_puser username

Using get_collection

List all devices in a collection:

() (C:\) >> get_collection SMS00001
() (C:\) >> get_collectionmembers SMS00001

exit

Description

Exit the admin console and return to the command line.

Usage

exit

Example

(16777221) (C:\) >> exit

┌──(root㉿kali)-[/opt/sccmhunter]
└─#

The exit command terminates the admin shell session and returns you to your local command line. Any active target device interactions will be closed.

Command Flow

Here’s the typical workflow for using the admin module:

Start the admin module with appropriate credentials
Query for devices using database commands like get_device, get_lastlogon, or get_collection
Set target device using interact [ResourceID]
Execute commands on the target device using situational awareness or administrative commands
Exit when finished using the exit command

Example Workflow

# Start admin module
└─# python3 sccmhunter.py admin -u administrator -p P@ssw0rd -ip 10.10.100.9

# Query for a device
() (C:\) >> get_device workstation01

# Set target device (using ResourceID from previous command)
() (C:\) >> interact 16777250

# Execute commands on target
(16777250) (C:\) >> administrators
(16777250) (C:\) >> ps
(16777250) (C:\) >> ls

# Exit when done
(16777250) (C:\) >> exit

Some commands require an active target device interaction to function properly. Make sure to use the interact command with a valid ResourceID before attempting to run situational awareness commands or execute scripts.

Getting Started

Enumeration

Exploitation

Post-Exploitation

interact

Description

Usage

Example

Finding ResourceIDs

Using get_device

Using get_lastlogon

Using get_puser

Using get_collection

exit

Description

Usage

Example

Command Flow

Example Workflow

​interact

​Description

​Usage

​Example

​Finding ResourceIDs

​Using get_device

​Using get_lastlogon

​Using get_puser

​Using get_collection

​exit

​Description

​Usage

​Example

​Command Flow

​Example Workflow

interact

Description

Usage

Example

Finding ResourceIDs

Using get_device

Using get_lastlogon

Using get_puser

Using get_collection

exit

Description

Usage

Example

Command Flow

Example Workflow