SCCMSecrets

SCCMSecrets.py is an SCCM policies exploitation tool. It goes beyond NAA credentials extraction, and aims to provide a comprehensive approach regarding SCCM policies exploitation. The tool can be executed from various levels of privileges, and will attempt to uncover potential misconfigurations related to policies distribution. More detail regarding the tool and its usage is available in the associated article: https://www.synacktiv.com/publications/sccmsecretspy-exploiting-sccm-policies-distribution-for-credentials-harvesting-initial

Two subcommands are available: policies and files.

Policies

This subcommand interacts with an SCCM Management Point in order to dump the contents of all secret policies (including NAA configuration, task sequences containing credentials, or collection variables). To do so, an approved SCCM device is needed, which can be obtained in three ways.

• If you do not provide a machine account, SCCMSecrets will attempt to register a device and abuse automatic device approval. This is a (non-default) SCCM configuration which automatically grants the "Approved" state to new devices registered anonymously.
• If you provide a machine account, SCCMSecrets will register a new device using the authenticated registration endpoint. By default, SCCM will grant the "Approved" state to devices registered through this endpoint.
• If you provide the --altauth flag, SCCMSecrets will exploit an alternate authentication endpoint, allowing to bypass mTLS requirements, and to get an approved device without credentials and without the automatic device approval misconfiguration (more information here). This only works when the MP is configured to use HTTPS, AND the SCCM site is configured to enforce HTTPS site-wide (if the MP is using HTTPS but the site allows either HTTP or HTTPS, devices are not automatically approved).
• You can also provide an existing device (--use-existing-device). This argument expects a directory containing the guid.txt file (device GUID) and the key.pem file (device private key). This can be a device created by a previous SCCMSecrets execution, or the one corresponding to a compromised legitimate SCCM client.

Note that SCCM policies are associated with collections. Registering a new device will place this device in default collections - thus, only secret policies from default collections will be retrieved. This is why impersonating a compromised legitimate SCCM client with the --use-existing-device can be interesting. Indeed, this legitimate client could be part of custom collections associated with additional secret policies.

Output will be placed in a subdirectory of the loot directory (format: [timestamp]_policies).