Skip to main content

​
sccm

Microsoft System Center Configuration Manager (SCCM / MECM) enumeration and exploitation.

​
Usage

r4t sccm [flags]
Status: Base command registered. Subcommands are not yet implemented.
SCCM support is planned for enumerating SCCM infrastructure via Active Directory, discovering management points, distribution points, and clients, as well as exploitation techniques such as credential extraction from the SCCM database and lateral movement via script/application deployment. SCCM servers can currently be identified via AD SPN lookups: 
r4t ldap get spn
# or
r4t adws query --filter "(servicePrincipalName=SMS*)" --attrs samAccountName,servicePrincipalName