Hey friends, in last week’s podcast I talked about a fun pentest where I relayed an SCCM machine account cred to a SCCM server with SQL installed, then dumped delicious information out of the database - which contained clear text SCCM creds! Today I show this in more detail, and how the credential stealing process was made much easier with the help of mssqlkaren.
Other reference links:
7MS #695 - where we talk about this attack in more detail
Pentesting GOAD SCCM - shows how to make a SQL connection to an SCCM server (I was wrong in today’s video in that we didn’t actually show an SCCM relay in the YouTube video, but at least you can see things from a SQL prompt POV)
Enjoy!
Brian
