Pulling Passwords out of Configuration Manager
Christopher Panayi demonstrates exploiting Microsoft Endpoint Configuration Manager (MECM/SCCM) OS deployment mechanisms and network booting to extract enterprise Active Directory credentials.
Summary
Microsoft Endpoint Configuration Manager in the Enterprise
Microsoft Endpoint Configuration Manager (MECM/SCCM) is ubiquitous across corporate networks, managing automated operating system deployments and administrative workflows for thousands of workstations and servers.
Exploiting Network Boot and OS Deployment Workflows
Christopher Panayi details how PXE booting and task sequence executions expose sensitive domain credentials across enterprise networks during client provisioning.
Extracting Active Directory Credentials
Panayi explores common MECM architecture misconfigurations—including unencrypted network shares, weakly protected media, and cleartext task sequence variables—that allow unauthenticated attackers to harvest elevated domain credentials.
Defensive Hardening and Mitigation Guidance
The presentation concludes with detection strategies and remediation guidance, demonstrating how administrators can secure task sequence variables and enforce network-level authentication across deployment points.
Related talks
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·46 min
Tianze Ding
Tianze Ding demonstrates chaining Microsoft Exchange vulnerabilities with Active Directory trusts, escalating a low-privilege domain user to full Domain Admin.
Password Village·13 min
EvilMog
Demonstrates pivoting from compromised networked printers into Active Directory environments to forge Kerberos silver tickets.