Attacking SCCM with SCCMHunter | Garrett Foster

Overview: Garrett Foster of SpecterOps presents at Wild West Hackin' Fest on attacking Microsoft SCCM using the SCCMHunter toolset.

Key Topics: SCCM architecture and excessive enterprise trust in endpoint management; community research on SCCM attack paths; distribution point discovery via WDS service connection points; and BloodHound graph integration.

Technical Details: Foster demonstrates identifying SCCM distribution points by querying Active Directory for WDS service connection point child objects. SCCMHunter automates enumeration and exploitation of SCCM misconfigurations.

Takeaways: Endpoint management platforms like SCCM represent high-trust infrastructure that attackers actively target. Red and blue teams should assess SCCM configurations and monitor for unauthorized queries.