Skip to content

Back to the catalog

bencteux.frwriteup

Manual Configuration Manager (SCCM) credential harvesting

A step-by-step method for harvesting Configuration Manager (SCCM/MECM) credentials by pulling DPAPI-encrypted secret policy blobs (Network Access Accounts, task sequences, collection variables) via WMI or the local CIM repository, then exfiltrating DPAPI master keys and LSA SYSTEM/SECURITY/SAM hives for fully offline decryption with Impacket's dpapi and secretsdump modules. The approach avoids running known SCCM-abuse tools like SharpDPAPI on-target, reducing signature-based detection while still noting which steps (registry hive backup, DPAPI folder copy, WMI queries) a SOC could realistically catch.

TL;DR Offline DPAPI decryption workflow to harvest SCCM Network Access Account, task sequence, and collection variable credentials without running SCCM-abuse tools on the compromised host.
Open original ↗

Organisations named here

  • Duane Michael
  • Matt Nelson
  • Quentin Roland
  • SpecterOPS
  • Synacktiv

Technologies named here

  • Impacket
  • Configuration Manager
  • Active Directory
  • SharpDPAPI
  • Windows
  • Mimikatz
  • Get-WmiObject
  • reg save
  • custom Python decode script
  • WMI
  • PowerShell
  • DPAPI
  • SCCM

Techniques named here

  • Offline DPAPI decryption
  • CIM repository parsing
  • WMI querying of CCM policy namespaces
  • Registry hive backup and exfiltration
  • DPAPI master key file copy/export
  • Blob preprocessing for DPAPI decryption

Related in Offensive Security