> ## Documentation Index > Fetch the complete documentation index at: https://docs.specterops.io/llms.txt > Use this file to discover all available pages before exploring further. # SharpSCCM Documentation > Comprehensive guide to using SharpSCCM for SCCM security assessment and penetration testing SharpSCCM Banner SharpSCCM Banner # SharpSCCM: SCCM Security Assessment Toolkit SharpSCCM is a powerful post-exploitation tool designed to leverage Microsoft System Center Configuration Manager (SCCM) / Microsoft Endpoint Configuration Manager for credential gathering, lateral movement, and privilege escalation without requiring access to the SCCM administration console GUI. **For Authorized Use Only**: SharpSCCM is intended for authorized security testing, red team exercises, and defensive research. Always ensure you have proper authorization before using this tool. ## What is SharpSCCM? SharpSCCM exploits common SCCM misconfigurations and inherent design weaknesses to demonstrate the security risks associated with poorly configured SCCM environments. The tool operates from any Windows machine running the SCCM client software and leverages Windows Management Instrumentation (WMI) and the ConfigMgr Client Messaging SDK to communicate with SCCM infrastructure. **Research Foundation**: This tool is built upon extensive security research by [@\_Mayyhem](https://twitter.com/_Mayyhem) and incorporates techniques developed by the security community, including work by Matt Nelson, Adam Chester, Duane Michael, and Garrett Foster. ## Core Capabilities Extract sensitive credentials from SCCM infrastructure: * **Network Access Accounts (NAAs)**: Retrieve domain credentials used for distribution point access * **Collection Variables**: Access credentials stored in collection-level variables * **Task Sequence Credentials**: Extract passwords from operating system deployment sequences * **Policy Secret Decryption**: Decrypt DPAPI-protected credential blobs Move laterally through the environment using SCCM as a C2 framework: * **Application Deployment**: Execute commands on remote systems via application deployment * **Script Execution**: Run PowerShell scripts and binaries across collections * **User Impersonation**: Execute applications in specific user contexts * **Collection Targeting**: Target specific devices or users for operations Force authentication for credential relay attacks: * **Client Push Installation**: Coerce NTLM authentication from site servers * **WebClient Exploitation**: Leverage WebClient for HTTP-based authentication * **SMB Relay**: Force connections to attacker-controlled SMB shares * **Domain Controller Targeting**: Relay authentication to domain controllers Enumerate SCCM infrastructure and gather intelligence: * **Site Discovery**: Identify site servers and management points via LDAP * **Admin Enumeration**: List SCCM administrators and their roles * **Device & User Discovery**: Enumerate managed devices and users * **Configuration Analysis**: Analyze site settings and security configurations Leverage the SCCM AdminService REST API for advanced operations: * **CMPivot Queries**: Execute arbitrary CMPivot queries for data collection * **Real-time Intelligence**: Gather system information from managed endpoints * **Custom Queries**: Run tailored queries for specific intelligence requirements * **JSON Output**: Retrieve structured data for further analysis ## Attack Methodology SharpSCCM follows a structured approach to SCCM exploitation: Identify SCCM infrastructure, site codes, management points, and site servers through LDAP queries and local client configuration analysis. Extract stored credentials from policies, task sequences, and collection variables using DPAPI decryption techniques. Leverage extracted credentials or SCCM roles to gain higher privileges within the domain or SCCM hierarchy. Use SCCM's application deployment and script execution capabilities to move laterally across the network. Establish persistence through SCCM configurations and maintain control over managed endpoints. ## Key Features Operates without needing access to the SCCM administration console GUI Runs from any Windows machine with the SCCM client installed Leverages WMI and ConfigMgr Client Messaging SDK for communication Addresses multiple attack vectors and SCCM security weaknesses ## Prerequisites & Requirements **Minimum Requirements:** * Windows machine with SCCM client installed * Domain-joined system (for most operations) * Network connectivity to SCCM management points * Local administrator privileges (for credential extraction) **Optimal Setup:** * SCCM administrative access for full functionality * Valid domain credentials * PKI certificates (if site requires them) **Required SCCM Roles (varies by operation):** * Read-only Analyst (minimum for discovery) * Application Administrator (for deployment operations) * Full Administrator (for site modification) * Custom roles with specific scope permissions **Domain Permissions:** * Domain user (minimum) * Local administrator on target systems * Service account permissions (for advanced techniques) **Required Connectivity:** * HTTP/HTTPS to management points (ports 80/443) * WMI access to SMS Provider (port 135 + dynamic RPC) * SMB access for file-based operations (port 445) * LDAP to domain controllers (port 389/636) ## Quick Start Guide Compile the tool from source code with Visual Studio Learn the command-line syntax and common options Start with credential harvesting techniques Execute commands on remote systems via SCCM ## Command Categories **`get` Command Group** - Extract information from SCCM infrastructure: * `get site-info` - Discover site servers and management points * `get admins` - Enumerate SCCM administrators * `get devices` - List managed devices and users * `get collections` - Discover device and user collections * `get applications` - View available applications **`get secrets` / `local secrets`** - Extract stored credentials: * Network Access Account credentials * Collection variable passwords * Task sequence credentials * DPAPI-protected policy secrets **`exec` Command** - Execute code on remote systems: * Application deployment for command execution * Script execution across collections * NTLM coercion and relay operations * User impersonation techniques **`new` / `remove` Commands** - Modify SCCM infrastructure: * Create and delete applications * Manage collections and deployments * Add/remove collection members * Device registration operations **`invoke` Command Group** - Advanced SCCM operations: * CMPivot query execution via AdminService * Client push authentication coercion * Policy update enforcement * Custom WQL query execution ## Security Considerations **Important Security Notice**: This tool can cause significant impact to production SCCM environments. Always test in isolated lab environments first and ensure you have proper authorization before use. ### Responsible Use Guidelines Obtain explicit written authorization before testing against any SCCM infrastructure Clearly define the scope of testing and avoid systems outside the authorized scope Understand the potential impact of operations, especially application deployments Document all activities for compliance and remediation purposes Remove any artifacts created during testing (applications, collections, etc.) ### Defensive Recommendations For comprehensive defensive guidance, see our [Security Recommendations](/sharpsccm-docs/security/defensive-recommendations) page, which covers: * SCCM hardening best practices * Detection and monitoring strategies * Incident response procedures * Security configuration checklists ## Development & Lab Setup **Quick Lab Deployment**: Microsoft's [Windows and Office 365 deployment lab kit](https://docs.microsoft.com/en-us/microsoft-365/enterprise/modern-desktop-deployment-and-management-lab?view=o365-worldwide) can deploy a fully operational SCCM lab in Hyper-V in less than an hour. **Minimum Lab Components:** * **CM1**: Configuration Manager Primary Site Server, Management Point, and Site Database Server * **GW1**: Configuration Manager Client * **DC1**: Domain Controller **Alternative Lab Options:** * [Azure QuickStart Templates](https://learn.microsoft.com/en-us/samples/azure/azure-quickstart-templates/sccm-technicalpreview/) * [AutomatedLab](https://automatedlab.org/en/latest/) * [Snaplabs](https://twitter.com/an0n_r0/status/1687230842601451522) ## Research & Publications **Primary Research by [@\_Mayyhem](https://twitter.com/_Mayyhem):** * [Coercing NTLM Authentication from SCCM](https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a) * [Relaying NTLM Authentication from SCCM Clients](https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867) * [SCCM Site Takeover via Automatic Client Push Installation](https://posts.specterops.io/sccm-site-takeover-via-automatic-client-push-installation-f567ec80d5b1) * [SCCM Hierarchy Takeover](https://posts.specterops.io/sccm-hierarchy-takeover-41929c61e087) **Black Hat USA Arsenal Presentations:**