> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# get secrets

> Extract stored credentials from SCCM policies

## Overview

Request machine policies from management points to extract stored credentials including Network Access Accounts, collection variables, and task sequence passwords. This command leverages SCCM's policy distribution mechanism to retrieve sensitive credentials.

<Warning>
  **High-Impact Operation**: This command extracts sensitive credentials including Network Access Account passwords that are often over-privileged domain accounts.
</Warning>

## Syntax

```bash theme={null}
SharpSCCM get secrets [options]
```

## Parameters

<ParamField path="management-point" type="string">
  Management point server address
</ParamField>

<ParamField path="site-code" type="string">
  The three-character site code (e.g., "PS1")
</ParamField>

<ParamField path="register-client" type="string">
  Register new device name for policy request
</ParamField>

<ParamField path="username" type="string">
  Computer account with trailing \$ for device registration
</ParamField>

<ParamField path="password" type="string">
  Computer account password for device registration
</ParamField>

<ParamField path="certificate" type="string">
  Base64 certificate blob for client authentication
</ParamField>

<ParamField path="client-id" type="string">
  SMS client GUID for certificate authentication
</ParamField>

<ParamField path="output-file" type="string">
  Save policy XML to file for analysis
</ParamField>

## Authentication Methods

<Accordion title="Local Client Certificate">
  **Prerequisites:** Local Administrator on SCCM client

  **Process:**

  1. Uses existing SCCM client certificate
  2. Requests machine policy from management point
  3. Extracts credentials from policy response

  **Advantages:**

  * No additional credentials required
  * Uses legitimate client identity
  * Minimal audit trail
</Accordion>

<Accordion title="Device Registration">
  **Prerequisites:** Computer account credentials

  **Process:**

  1. Registers new device with SCCM using computer account
  2. Receives client certificate from management point
  3. Requests policy using new device identity
  4. Extracts credentials from policy

  **Advantages:**

  * Works from any system
  * Creates legitimate device record
  * Bypasses client installation requirements
</Accordion>

<Accordion title="Certificate Impersonation">
  **Prerequisites:** Existing SCCM client certificate

  **Process:**

  1. Uses provided certificate for authentication
  2. Impersonates existing SCCM client
  3. Requests policy using certificate identity

  **Advantages:**

  * Reuses existing client certificates
  * No device registration required
  * Works with extracted certificates
</Accordion>

## Examples

<CodeGroup>
  ```bash Local Client theme={null}
  # Use local SCCM client certificate
  SharpSCCM get secrets

  # Save policy to file for analysis
  SharpSCCM get secrets -o policy.xml
  ```

  ```bash Device Registration theme={null}
  # Register new device with computer account
  SharpSCCM get secrets -r NEWDEVICE -u COMPUTER$ -p password

  # Specify management point and site
  SharpSCCM get secrets -r TESTDEV -u WORKSTATION01$ -p P@ssw0rd -mp SCCM01.corp.local -sc PS1
  ```

  ```bash Certificate-Based theme={null}
  # Use existing certificate and client ID
  SharpSCCM get secrets -c <base64-cert-blob> -i <client-guid>

  # Certificate with specific management point
  SharpSCCM get secrets -c <cert> -i <guid> -mp SCCM01.corp.local -sc PS1
  ```
</CodeGroup>

## Required Permissions

<Info>
  **Local Administrator** OR **Computer account credentials** OR **Valid SCCM client certificate**
</Info>

## Credential Types Extracted

<Accordion title="Network Access Accounts (NAA)">
  **Purpose:** Domain accounts used for distribution point access

  **Characteristics:**

  * Often have excessive domain privileges
  * Frequently shared across environments
  * Used when computer account authentication fails
  * Critical for SCCM client operations

  **Security Impact:**

  * High-value targets for lateral movement
  * Often members of privileged groups
  * May have admin rights on multiple systems
</Accordion>

<Accordion title="Collection Variables">
  **Purpose:** Credentials stored in collection properties

  **Characteristics:**

  * Used for application deployment authentication
  * Scoped to specific device/user collections
  * May contain service account passwords
  * Often overlooked in security reviews

  **Security Impact:**

  * Application-specific credential exposure
  * Potential service account compromise
  * Collection-wide credential sharing
</Accordion>

<Accordion title="Task Sequence Credentials">
  **Purpose:** Accounts used during OS deployment

  **Characteristics:**

  * Often domain administrator accounts
  * Used for domain join operations
  * Required for automated deployments
  * High privilege requirements

  **Security Impact:**

  * Domain admin credential exposure
  * Full domain compromise potential
  * Automated deployment abuse
</Accordion>

## Technical Details

<Accordion title="Policy Request Process">
  **Policy Retrieval Steps:**

  1. **Client Authentication** - Certificate or device registration
  2. **Policy Request** - HTTP(S) request to management point
  3. **Policy Response** - Encrypted policy XML containing secrets
  4. **Credential Decryption** - Extract plaintext credentials
</Accordion>

<Accordion title="Encryption and Security">
  **Policy Protection:**

  * Policies are encrypted with client-specific keys
  * Requires valid SCCM client identity for decryption
  * HTTPS transport encryption (typically)
  * Client certificate authentication

  **Audit Considerations:**

  * Policy requests are logged on management points
  * Device registration creates database entries
  * Certificate usage may be audited
  * Network traffic can be monitored
</Accordion>

## Output Format

Extracted credentials are displayed in structured format:

```text theme={null}
[+] Network Access Account found:
    Domain: CORP
    Username: svc_naa
    Password: P@ssw0rd123!

[+] Collection variables found:
    Variable: AppPassword
    Value: ServiceP@ss
    Collection: Application Servers

[+] Task sequence credentials found:
    Domain Join Account: CORP\svc_domainjoin
    Password: Dom@inP@ss123
```

## Operational Security

<Accordion title="Stealth Considerations">
  **Low-Profile Techniques:**

  * Use existing client certificates when possible
  * Avoid device registration if not necessary
  * Request policies during normal business hours
  * Use legitimate-looking device names
</Accordion>

<Accordion title="Detection Avoidance">
  **Reduce Detection Risk:**

  * Limit policy request frequency
  * Use existing management point connections
  * Avoid unusual certificate patterns
  * Clean up registered devices if needed
</Accordion>

## Common Issues

<Accordion title="Authentication Failures">
  **Error:** Policy request denied or authentication failed

  **Solutions:**

  * Verify management point address and site code
  * Check computer account credentials
  * Ensure certificate validity
  * Verify network connectivity
</Accordion>

<Accordion title="No Secrets Found">
  **Error:** Policy received but no credentials extracted

  **Solutions:**

  * Site may not use Network Access Accounts
  * Enhanced HTTP may be enabled
  * Collection variables may not be configured
  * Task sequences may not contain credentials
</Accordion>

## Related Commands

* [`local secrets`](/commands/local/secrets) - Extract credentials from local SCCM client
* [`get naa`](/commands/creds/get-naa) - Alternative NAA extraction method
* [`get collections`](/commands/get/collections) - Identify collections with variables
* [`local site-info`](/commands/local/site-info) - Get management point information