I’d Like to Speak to Your Manager Stealing Secrets with Mana...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/
• Blog Title: I’d Like to Speak to Your Manager: Stealing Secrets with Management Point Relays
• Suggested Section: generic-hacking/ntlm-relay-sql-server-sccm-management-point.md

🎯 Content Summary

Attack Overview

Coerce an SCCM Management Point (MP) to retrieve OSD policy secrets by relaying its machine-account authentication to the site database.

OSD Client Authentication & Unknown Computer GUIDs

During PXE-based OSD, clients borrow a DP certificate and call the unauthenticated HTTP endpoint /SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA to obtain site public keys and two GUIDs for the “All Unknown Computers” collection (x86/x64). These GUIDs...

🔧 Technical Details

By querying the unauthenticated SCCM MP endpoint /SMS_MP/.sms_aut?MPKEYINFORMATIONMEDIA, an attacker retrieves the site’s public keys and the GUIDs for the x86/x64 “All Unknown Computers” collection. These GUIDs serve as clientIDs for policy requests, allowing further abuse without prior enrollment or authentication.

Using PetitPotam and Impacket’s ntlmrelayx.py, the attacker relays the MP’s machine account authentication to the SQL Server hosting the SCCM site databas...

🤖 Agent Actions

Added SCCM Management Point NTLM relay technique with MSSQL stored-procedure abuse.

Key updates:

1. New detailed page:
   src/windows-hardening/active-directory-methodology/sccm-management-point-relay-sql-policy-secrets.md
   • Full attack chain (enumeration → relay → stored procs → PXEthief decryption).
   • Commands, SQL, detection & hardening, references.

2. Cross-reference inserted into existing MSSQL abuse page for discoverability.

These additions integrate the SpecterOps research into HackTricks while reusing existing NTLM and MSSQL pages.

✅ Review Checklist

• Content is technically accurate
• Formatting follows HackTricks style guidelines
• Links and references are working
• Content adds educational value
• No sensitive information is exposed

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 855
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://specterops.io/blog/2025/07/15/id-like-to-speak-to-your-manager-stealing-secrets-with-management-point-relays/

Content Categories: Based on the analysis, this content was categorized under "generic-hacking/ntlm-relay-sql-server-sccm-management-point.md".

Repository Maintenance:

• MD Files Formatting: 855 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge