synacktiv/sccm_sql_backdoorCVE-2024-43468 및 CVE-2025-59213을 악용하여 SCCM Management Point의 SQL 저장 프로시저에 제어된 백도어를 이식하고, HTTP를 통한 원격 SQL 실행을 가능하게 합니다.
Management Point 저장 프로시저에 제어된 백도어를 주입하여, 합법적인 MP HTTP 서비스를 통해 간접적으로 SQL을 실행할 수 있게 해주는 개념 증명(PoC) 도구입니다.
저장소를 클론하고 의존성을 설치하면 설치할 수 있습니다.
$ git clone --recurse-submodules https://github.com/synacktiv/sccm_sql_backdoor
$ cd sccm_sql_backdoor
$ python3 -m venv .venv && source .venv/bin/activate
$ pip install -e .
$ python3 sccm_sql_backdoor.py -h
usage: sccm_sql_backdoor.py [-h] -t TARGET [-debug] {CVE-2024-43468,CVE-2025-59213,revert} ...
SCCM SQL Backdoor
positional arguments:
{CVE-2024-43468,CVE-2025-59213,revert}
CVE-2024-43468 Use CVE-2024-43468 to inject the SPO backdoor
CVE-2025-59213 Use CVE-2025-59213 to inject the SPO backdoor
revert Revert the changes to the original SPO
options:
-h, --help show this help message and exit
-t, --target TARGET Target (http://sccm-mp.local/)
-debug Turn DEBUG output ON
$ python3 sccm_sql_backdoor.py CVE-2025-59213 -h
usage: sccm_sql_backdoor.py CVE-2025-59213 [-h] [-a] [-m MARKER] [-k KEY] [-c CERT] [-sk SIGKEY] [-v] -cn CLIENT_NAME [-rs REGISTRATION_SLEEP]
options:
-h, --help show this help message and exit
-a, --altauth Use the MP's alternate authentication endpoint (Default: False)
-m, --marker MARKER Override marker to trigger the backdoor (Default: ABC)
-k, --key KEY Private key file for mTLS
-c, --cert CERT Certificate file
-sk, --sigkey SIGKEY SMS signature key
-v, --verbose Verbose output, print requests
-cn, --client-name CLIENT_NAME
Name of the client that will be created in SCCM
-rs, --registration-sleep REGISTRATION_SLEEP
The amount of time, in seconds, that should be waited after registrating a new device (2 seconds by default)
$ python3 sccm_sql_backdoor.py CVE-2024-43468 -h
usage: sccm_sql_backdoor.py CVE-2024-43468 [-h] [-a] [-m MARKER] [-k KEY] [-c CERT]
options:
-h, --help show this help message and exit
-a, --altauth Use the MP's alternate authentication endpoint (Default: False)
-m, --marker MARKER Override marker to trigger the backdoor (Default: ABC)
-k, --key KEY Private key file for mTLS
-c, --cert CERT Certificate file
$ python3 sccm_sql_backdoor.py revert -h
usage: sccm_sql_backdoor.py revert [-h] [-m MARKER]
options:
-h, --help show this help message and exit
-a, --altauth Use the MP's alternate authentication endpoint (Default: False)
-m, --marker MARKER Override marker to trigger the backdoor (Default: ABC)
-k, --key KEY Private key file for mTLS
-c, --cert CERT Certificate file