sccm-exploitation

You can extract Network Access Account (NAA) credentials from SCCM by automating policy requests and leveraging WMI queries on clients. This credential harvesting technique requires domain user access for enumeration and local admin rights on target clients.

Moving laterally using Microsoft SCCM infrastructure involves leveraging management point relay to MSSQL and client push account relay. These techniques exploit SCCM's built-in communication channels to pivot and escalate privileges within the target domain.

Yes, you can harvest PXE boot credentials during SCCM exploitation. By intercepting PXE boot requests using specialized tools, you can capture transmitted credentials, provided you have the necessary network access to the target management points.

You do not need local admin rights to enumerate SCCM site servers and management points. Basic SCCM enumeration only requires standard domain user access, though local admin on clients is necessary for deeper WMI credential extraction.

Deploying a malicious application through SCCM leads to remote code execution by abusing the management infrastructure to push payloads to domain-joined machines. After harvesting elevated credentials, you can force the SCCM server to distribute and execute the payload remotely.

Advanced SCCM attacks like management point relay to MSSQL require direct network access to the target management points and MSSQL servers. This network positioning allows you to intercept and relay authentication traffic effectively.