> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# local secrets

> Get policy secrets stored locally in the WMI repository

## Overview

Get policy secrets (e.g., network access accounts, task sequences, and collection variables) stored locally in the WMI repository. This command extracts and decrypts DPAPI-protected credentials from the local SCCM client.

<Warning>
  This command requires Local Administrators group membership on an SCCM client and involves accessing sensitive credentials.
</Warning>

## Syntax

```bash theme={null}
SharpSCCM local secrets [options]
```

**Aliases:** `local naa`

## Parameters

<ParamField path="method" type="string" required>
  The method of obtaining the DPAPI-protected blobs: `wmi` or `disk`

  * **wmi**: Extract from WMI repository namespace
  * **disk**: Extract from OBJECTS.DATA file (can retrieve historic secrets)
</ParamField>

<ParamField path="get-system" type="boolean">
  Escalate to SYSTEM via token duplication (default modifies LSA secrets registry permissions)
</ParamField>

## Examples

<CodeGroup>
  ```bash WMI Method theme={null}
  # Extract secrets from WMI namespace
  SharpSCCM local secrets -m wmi
  ```

  ```bash Disk Method theme={null}
  # Extract secrets from OBJECTS.DATA file (includes historic secrets)
  SharpSCCM local secrets -m disk
  ```

  ```bash SYSTEM Escalation theme={null}
  # Use token duplication to escalate to SYSTEM
  SharpSCCM local secrets -m wmi -s
  ```
</CodeGroup>

## Extraction Methods

<Accordion title="WMI Method">
  Extracts secrets from the `root\ccm\policy\Machine\ActualConfig` namespace:

  * Network Access Account credentials
  * Task sequence variables
  * Collection variables
  * Currently active secrets only
</Accordion>

<Accordion title="Disk Method">
  Extracts secrets from the CIM repository `OBJECTS.DATA` file:

  * All secrets including historic/deleted ones
  * Network Access Accounts
  * Task sequences with embedded credentials
  * More comprehensive but requires file system access
</Accordion>

## Output Format

The command outputs discovered secrets in structured format:

```text theme={null}
[+] Secret: DPAPI_SYSTEM
    full: D88A555FF23B7BD491E17C729230CF72DADCB3208E8F4FFDCDC156EAA9BA4465BD207D865B66A2DA
     m/u: D88A555FF23B7BD491E17C729230CF72DADCB320 / 8E8F4FFDCDC156EAA9BA4465BD207D865B66A2DA

[+] SYSTEM master key cache:
    {1c383f70-2563-4e97-a0fb-6818e143f5cb}:833327774AA9CD63EEC2E0D6E37CFD6CABDA79F7

[+] Decrypting network access account credentials

    NetworkAccessUsername: APERTURE\networkaccess
    NetworkAccessPassword: P@ssw0rd
```

## Types of Secrets Extracted

<Accordion title="Network Access Accounts (NAA)">
  Domain accounts used by SCCM clients to access distribution points:

  * Often over-privileged domain accounts
  * Used when computer account cannot authenticate
  * Critical for lateral movement and privilege escalation
</Accordion>

<Accordion title="Task Sequence Variables">
  Variables embedded in task sequences that may contain:

  * Domain join credentials
  * Service account passwords
  * Application installation credentials
</Accordion>

<Accordion title="Collection Variables">
  Variables assigned to device collections:

  * Environment-specific credentials
  * Application-specific secrets
  * Configuration passwords
</Accordion>

## Security Implications

<Warning>
  Network Access Accounts are often over-privileged and can provide:

  * Domain authentication capabilities
  * Access to distribution points and file shares
  * Potential for lateral movement within the domain
  * Privilege escalation opportunities
</Warning>

## DPAPI Decryption Process

<Accordion title="Key Extraction">
  1. **DPAPI\_SYSTEM Secret**: Retrieved from LSA secrets
  2. **Master Key Cache**: Extracted for SYSTEM account
  3. **Blob Decryption**: DPAPI-protected blobs are decrypted
  4. **Credential Parsing**: Plain-text credentials are extracted
</Accordion>

<Accordion title="Privilege Requirements">
  * **Local Administrator**: Required for registry access
  * **SYSTEM Token**: Optional for enhanced access
  * **File System Access**: Required for disk method
</Accordion>

## Common Use Cases

<Accordion title="Credential Harvesting">
  Extract NAA credentials for domain authentication and lateral movement.
</Accordion>

<Accordion title="Historical Analysis">
  Use disk method to recover deleted or changed credentials from the CIM repository.
</Accordion>

<Accordion title="Privilege Escalation">
  Leverage discovered credentials for domain privilege escalation.
</Accordion>

## Mitigation Recommendations

<Info>
  Organizations should:

  * **Enable Enhanced HTTP** to eliminate NAA requirements
  * **Use least privilege** for any required NAAs
  * **Regular rotation** of NAA passwords
  * **Monitor NAA usage** for unauthorized access
</Info>

## Related Commands

* [`get naa`](/sharpsccm/commands/creds/get-naa) - Extract NAA from SCCM Management Point
* [`local triage`](/sharpsccm/commands/local/triage) - Comprehensive local reconnaissance
* [`local site-info`](/sharpsccm/commands/local/site-info) - Get site configuration details