110 matches found
CVE-2023-36884-Scripts-for-Intune-Remediation-SCCM-Compliance-Baseline
This repository does not have a README...
SCCMSecrets
SCCMSecrets SCCMSecrets.py is an SCCM policies exploitation tool. It goes beyond NAA credentials extraction, and aims to provide a comprehensive approach regarding SCCM policies exploitation. The tool can be executed from various levels of privileges, and will attempt to uncover potential...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell scripts Detection.ps1 This is a quick and dirty script to see if a machine may be vulnerable. It writes out a message to the shell indicating if BUILTIN\Users was detected in the permission list and includes the current permissions on the SAM path for...
SCCMVersionGuesser
SCCMVersionGuesser Automated SCCM build and patch level detection tool Requirements requests Usage $ python3 SCCMVersionGuesser.py https://sccm.example.com Reference https://learn.microsoft.com/en-us/intune/configmgr/hotfix/ https://github.com/MicrosoftDocs/memdocs/tree/main/intune/configmgr/hotf...
CMLoot
CMLoot CMLoot was created to easily find interesting files stored on System Center Configuration Manager SCCM/CM SMB shares. The shares are used for distributing software to Windows clients in Windows enterprise environments and can contains scripts/configuration files with passwords, certificate...
PySQLRecon
PySQLRecon PySQLRecon is a Python port of the awesome SQLRecon project by @sanjivkawa. See the commands section for a list of capabilities. Post demonstrating SCCM TAKEOVER-1 with PySQLRecon. Install PySQLRecon can be installed with pip3 install pysqlrecon or by cloning this repository and runnin...
SharpSCCM
Tool Overview SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager a.k.a. ConfigMgr, formerly SCCM for lateral movement and credential gathering without requiring access to the SCCM administration console GUI. SharpSCCM was initially created to execu...
sccmhunter
SCCMHunter SCCMHunter is a post-ex tool built to streamline identifying, profiling, and attacking SCCM related assets in an Active Directory domain. Please checkout the wiki for detailed usage. Please note This tool was developed and tested in a lab environment. Your mileage may vary on...
sccmsqlclient
sccmsqlclient A dedicated MSSQL client for SCCM database exploration and exploitation. Recon queries Run PowerShell scripts on managed clients Extract secrets Installation PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP You can install by cloning the repository and...
Misconfiguration-Manager
Misconfiguration Manager 修復クイックスタート 1. 既知および文書化された攻撃テクニックのリストと、対応する防御テクニックを確認し、自環境に存在する可能性のある問題とその修復方法を特定する このプロジェクトの紹介を参照 2. ConfigManBearPigを実行し、結果をBloodHoundで無料で可視化する このウォークスルーを参照 3. あるいは、MisconfigurationManager.ps1を実行する このウォークスルーを参照 4. 特定された設定不備に対する緩和策を実装する このウォークスルー（またはこの録画（スライド））を参照 概要...
MalSCCM
MalSCCM This tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server. Typically deployments of SCCM will either have the management server and the primary server ...
CVE-2025-59287---WSUS-SCCM-RCE
CVE-2025-59287 - WSUS / SCCM RCE Based on the original exploit at: https://gist.github.com/hawktrace/76b3ea4275a5e2191e6582bdc5a0dc8b You can now specify the ysoserial.exe and execute whatever you want: https://hawktrace.com/blog/cve-2025-59287/ https://hawktrace.com/blog/cve-2025-59287-unauth/...
CVE-2025-59501
CVE-2025-59501 Entra ID統合が有効なSCCMのAdminService APIを悪用して、フル管理者に昇格しSCCM階層を乗っ取るためのPoCです。詳細はこちらのブログをご覧ください。 必要条件 uv インストール git clone https://github.com/garrettfoster13/CVE-2025-59501.git cd CVE-2025-59501/ uv sync 使用方法 このツールにはtokenとadminの2つのモジュールがあります。 ➜ CVE-2025-59501 git:main ✗ uv run poc.py usage:...
CVE-2021-36934
MSRC に記載されている CVE。 ECM（別名 SCCM）構成項目を使用して修復済み: リポジトリ内の修復スクリプトと Discovery スクリプトを参照してください。 構成項目は、コンプライアンスを判定するためのブール値 $false チェックを行います。 修復 本番環境では、ClientAccessible 以外のコピーもパージ（削除）して修復する必要性が判明しました。 削除 できない Backup タイプと DataVolumeRollback タイプを確認しています。 残念ながら、vssadmin は「ClientAccessible タイプを持つシャドウ...
sccm-http-looter
SCCM HTTP Looter How it works SCCM distribution points DPs are the servers used by Microsoft SCCM to host all the files used in software installs, patches, script deployments, etc. By default, these servers allow access via SMB TCP/445 and HTTP/S TCP/80 and/or TCP/443 and require some type of...
CVE-2024-43468_mTLS_go
CVE-2024-43468 SCCM SQL Injection Exploit mTLS client certs from MacOS keychain version Go implementation of CVE-2024-43468 exploit that uses macOS Keychain for mTLS authentication without need to export keys from keychain. Additionally: Added proxy support to not use problematic proxychains. Add...
sccm_sql_backdoor
sccmsqlbackdoor A proof‑of‑concept tool that implants a controlled backdoor into a Management Point stored procedure, enabling indirect SQL execution through a legitimate MP HTTP service. Installation You can install by cloning the repository and installing the dependencies. $ git clone...
Misconfiguration-Manager — Updated!
Misconfiguration Manager Remediation Quick Start 1. Review the list of known and documented Attack Techniques and corresponding Defense Techniques to identify issues that may be present in your environment and how to remediate them Refer to this introduction to the project 2. Run ConfigManBearPig...
