sccm-exploitation

Automate SCCM/MECM enumeration and credential harvesting for lateral movement.

253|37|Updated Feb 22, 2026

Search Tags:#privilege escalation #lateral movement #credential harvesting #active directory #sccm #mecm

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill sccm-exploitation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sccm-exploitation
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/ad/sccm-exploitation
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill sccm-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sccmhunter, SharpSCCM, MalSCCM, ntlmrelayx, PetitPotam, pxethiefy, CMLoot, Mimikatz, SQLRecon, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers identify and exploit vulnerabilities within Microsoft SCCM/MECM infrastructure to gain credentials, move laterally, and escalate privileges within a target domain.

Core Features & Use Cases

SCCM Enumeration: Discover SCCM site servers, management points, and client configurations.
Credential Harvesting: Extract Network Access Account (NAA) credentials, PXE boot secrets, and database credentials.
Lateral Movement & Escalation: Utilize management point relay, client push account relay, and application deployment for advanced attacks.
Use Case: After discovering an SCCM server, use this Skill to harvest the Network Access Account credentials, which are often used for automated tasks, and then leverage those credentials to deploy a malicious payload to all domain-joined machines.

Quick Start

Use the sccm-exploitation skill to enumerate SCCM infrastructure in the domain.

Frequently Asked Questions about sccm-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract Network Access Account credentials from SCCM?▼

You can extract Network Access Account (NAA) credentials from SCCM by automating policy requests and leveraging WMI queries on clients. This credential harvesting technique requires domain user access for enumeration and local admin rights on target clients.

What is the best way to move laterally using Microsoft SCCM infrastructure?▼

Moving laterally using Microsoft SCCM infrastructure involves leveraging management point relay to MSSQL and client push account relay. These techniques exploit SCCM's built-in communication channels to pivot and escalate privileges within the target domain.

Can I harvest PXE boot credentials during an SCCM exploitation engagement?▼

Yes, you can harvest PXE boot credentials during SCCM exploitation. By intercepting PXE boot requests using specialized tools, you can capture transmitted credentials, provided you have the necessary network access to the target management points.

Do I need local admin rights to enumerate SCCM site servers and management points?▼

You do not need local admin rights to enumerate SCCM site servers and management points. Basic SCCM enumeration only requires standard domain user access, though local admin on clients is necessary for deeper WMI credential extraction.

How does deploying a malicious application through SCCM lead to remote code execution?▼

Deploying a malicious application through SCCM leads to remote code execution by abusing the management infrastructure to push payloads to domain-joined machines. After harvesting elevated credentials, you can force the SCCM server to distribute and execute the payload remotely.

What level of network access is required for advanced SCCM attacks like MSSQL relay?▼

Advanced SCCM attacks like management point relay to MSSQL require direct network access to the target management points and MSSQL servers. This network positioning allows you to intercept and relay authentication traffic effectively.