SCCM: The Tree That Always Bears Bad Fruits
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Summary
SCCM as an Enterprise Management Engine
Microsoft System Center Configuration Manager (SCCM / MECM) manages software deployment, operating system imaging, and patch compliance across thousands of enterprise endpoints with high administrative privileges.
Discovering New SCCM Attack Paths
Mehdi Elyassa demonstrates novel exploitation techniques targeting SCCM client enrollment, network access accounts, unencrypted PXE boot media, and site server database trusts.
Lateral Movement and Domain Dominance
Exploiting misconfigured administrative roles and abusing site control scripts allows attackers with low-privilege domain access to coerce credentials, deploy malicious client policies, and achieve full Domain Admin.
Hardening SCCM Architectures
Securing SCCM deployments requires eliminating Network Access Accounts, enforcing enhanced security for PXE environments, and auditing administrative role assignments across site hierarchies.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·21 min
Antoine Goichot
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.
Creator Stage·43 min
Brandon Colley
Walks through attack paths in the Game of Active Directory lab environment and demonstrates practical misconfiguration mitigations.