Push comes to shove: exploring SCCM attack paths - Brandon Colley
Channel: BSidesKC
Date: 2022-10-23

Push comes to shove: exploring SCCM attack paths - Brandon Colley

Configuration Manager (SCCM) is a systems management product used by many companies to mange endpoints. When configuring SCCM, the simplest, and most popular client install method is the “client push installation”. This method has been around for years and is listed first in Microsoft’s documentation. Awkwardly, Microsoft recommends against the use of the client push installation. Environments continue to use this method despite these recommendations and the vulnerabilities associated with them. When push comes to shove, an attacker can fully compromise AD in multiple ways.

This talk discusses current security recommendations, the vulnerabilities they mitigate, and the ways an attacker can still infiltrate workstations, servers, or SCCM itself. Three new attack paths will be demonstrated using simple techniques that leverage known Windows and SCCM behaviors. These attacks will extract administrative credentials, move laterally, and fully bypass security settings. Such an attack can provide a vehicle for Ransomware or quickly elevate an attacker to Domain Admin.

Each attack path shown will challenge current best practices and prove the mitigations in place are easily circumvented. These demonstrations include NTLM hash dump, NTLM relay, and clever strategies that force undesirable SCCM behaviors. Finally, new mitigations and recommendations will be explored that can help protect against these attacks and generally improve security posture. At the end of this talk, it becomes clear that the push account cannot be secured and therefore should never be used.

Brandon Colley (Security Consultant at Trimarc Security)
Brandon has 15 years of experience administering and securing Active Directory and Windows environments. He specializes in providing “reality-based” AD and Azure AD security assessments for clients of Trimarc. Brandon’s community focus includes answering the “whys and hows” in relation to recent vulnerabilities. He delivers infosec content that is built for a Blue Team through a Red lens.