Skip to main content

​
Overview

Extract collection variable credentials from SCCM policies. Collection variables are key-value pairs assigned to device or user collections that often contain sensitive credentials used for application deployment and system configuration.
Collection variables frequently contain service account passwords, application credentials, and other sensitive information used for automated deployments.

​
Syntax

SharpSCCM get collection-variables [options]

​
Parameters

​
management-point
string
Management point server address
​
site-code
string
The three-character site code (e.g., “PS1”)
​
collection-id
string
Specific collection ID to target (e.g., “PS100001”)
​
collection-name
string
Collection name pattern for filtering
​
client-id
string
SMS client GUID for authentication
​
certificate
string
Base64 certificate blob for client authentication
​
output-file
string
Save extracted variables to file

​
Examples

# Extract all collection variables
SharpSCCM get collection-variables -mp SCCM01.corp.local -sc PS1

# Target specific collection
SharpSCCM get collection-variables -i PS100001 -mp SCCM01.corp.local -sc PS1

​
Required Permissions

Local Administrator on SCCM client OR Computer account credentials OR Valid SCCM client certificate

​
Collection Variables Overview

Application Credentials:
  • Database connection strings
  • Service account passwords
  • API keys and tokens
  • Application-specific secrets
Infrastructure Credentials:
  • Domain join accounts
  • Service installation accounts
  • Administrative passwords
  • Network access credentials
Configuration Data:
  • Server names and endpoints
  • Network configuration
  • Application settings
  • Environment-specific data
Variable Scope:
  • Device collections: System-level access
  • User collections: User-level access
  • Mixed collections: Variable context dependent
Credential Exposure:
  • Variables visible to collection members
  • Plaintext storage in policies
  • Network transmission exposure

​
Extraction Process

Authentication Options:
  1. Local Client Certificate - Use existing SCCM client
  2. Device Registration - Register new device identity
  3. Certificate Impersonation - Use provided certificate
Variable Discovery:
  1. Request machine policies from management point
  2. Parse policy XML for collection variable definitions
  3. Extract variable names and values
  4. Decrypt any encrypted values
Broad Discovery:
  • Request policies for multiple collections
  • Enumerate all accessible variables
  • Map variable distribution patterns
Targeted Extraction:
  • Focus on specific high-value collections
  • Target application-specific collections
  • Concentrate on administrative collections

​
Variable Intelligence

Database Credentials:
DBPassword, SqlPassword, DatabaseUser
ConnString, ConnectionString
Service Account Credentials:
ServicePassword, SvcPassword, AccountPassword
ServiceUser, SvcAccount, RunAsAccount
Application Secrets:
APIKey, Token, Secret, Key
Password, Pass, Credential, Cred
Password Variables:
  • Password, Pass, Pwd
  • Secret, Key, Token
  • Credential, Cred, Auth
Account Variables:
  • User, Username, Account
  • ServiceAccount, SvcUser
  • RunAs, ExecuteAs, Identity
Connection Variables:
  • ConnectionString, ConnString
  • Server, Host, Endpoint
  • URL, URI, Address

​
Output Format

Extracted variables are displayed with collection context: 
[+] Collection: Application Servers (PS100001)
    Variable: DBPassword
    Value: P@ssw0rd123!

    Variable: ServiceAccount
    Value: DOMAIN\svc_app

[+] Collection: Web Servers (PS100002)
    Variable: APIKey
    Value: abc123def456ghi789

​
Attack Opportunities

Lateral Movement:
  • Use extracted credentials on target systems
  • Test credentials across multiple systems
  • Exploit password reuse patterns
Service Account Abuse:
  • Identify service account credentials
  • Map service account usage patterns
  • Exploit service account privileges
Database Access:
  • Use database credentials for direct access
  • Bypass application security controls
  • Access sensitive data repositories
API and Service Access:
  • Leverage API keys and tokens
  • Access web services and APIs
  • Exploit service authentication

​
Operational Security

Policy Requests:
  • Policy requests may be logged
  • Avoid unusual request patterns
  • Use legitimate client identities
Variable Access:
  • Collection membership affects access
  • Target appropriate collections
  • Avoid excessive enumeration

​
Common Use Cases

Application Deployment Credentials:
  • Service account passwords for application installation
  • Database credentials for application configuration
  • API keys and tokens for service integration
Infrastructure Credentials:
  • Domain join account credentials
  • Administrative account passwords
  • Network service credentials
Infrastructure Discovery:
  • Server names and network locations
  • Service endpoints and URLs
  • Configuration and connection details
Application Architecture:
  • Database server locations
  • Service dependencies
  • Integration points and APIs