AI
SCCM as Microsoft’s Native C2
SCCM, now called Microsoft Configuration Manager, is an IT asset management platform that installs an agent on every managed device and provides remote code execution. For red teamers, this makes it Microsoft’s built-in C2. Most SCCM services run as IIS web apps, combining ASP.NET API modules with heavy COM call chains between components. Two communication modes exist: enhanced HTTP for plain transport, and HTTPS backed by mutual TLS with certificates from an internal PKI such as ADCS. Attackers who take over an SCCM instance can push PowerShell to any enrolled device in the organization.
Bypassing Mutual TLS Without a Client Certificate
The HTTPS mutual TLS requirement has a bypass. The SMS management point service exposes four entry points; three use anonymous authentication. Hitting the standard SMS_MP endpoint without a client certificate returns 403. Hitting the SMS_MP_TokenAuth entry point returns 200. CCM messaging has the same pattern: use CCM_System_AltAuth (available since SCCM 2403) to reach the service without a certificate. This allows unauthenticated reconnaissance across a site hierarchy, including management point enumeration, version numbers, and SSL state. The bypass also lets an attacker register a fake SCCM client without Windows credentials.
Two SQL Injections: Discovery and Exploitation
Elyassa disclosed two SQL injections in SCCM. CVE-2024 is unauthenticated: the CCM messaging MP location manager handler has a visibility=all configuration, meaning no device identity is required. The injection point sits in the SourceID header field, which the client does not sign. Since management point and site server roles typically share a server, and the site server holds sysadmin on the SQL database, exploitation yields full database takeover. CVE-2025 hits the SMS provider admin service. Any SCCM RBAC role, including read-only, can trigger it because the injection occurs inside the permission check itself.
Script Execution and Credential Decryption via Database Access
With database access, the admin service API’s double-approval requirement for script execution can be bypassed entirely. Insert a row into the scripts table with approval=3 (pre-approved) and hidden=1 (invisible in the admin console), write a task to the BGB task table, and assign it to a target device via the BGB res task table. That insertion triggers a push notification to the client, which downloads and runs the script as SYSTEM. Elyassa’s SCCMsql client tool automates these steps, prepends a command to wipe the script store folder, and provides last-task-clean to remove all database artifacts.
Persistence: Rogue Service Handlers and Backdoored Procedures
With SCCM admin access, two persistence methods are available. The first plants a rogue COM service handler into the CCM messaging protocol. Create a DLL implementing the CCM endpoint interface, register its CLSID on the management point, then add a WMI CCM service endpoint configuration object pointing to it with visibility=all. The handler persists across reboots and accepts unauthenticated connections. The second backdoors stored procedures called by unauthenticated management point endpoints. Altered procedures detect a specific input pattern and execute injected SQL, letting the management point act as a SQL client even when direct database access is unavailable.
Notable Quotes
So you can’t fix that. Mehdi Elyassa · ▶ 12:12
automatically marked as approved. Mehdi Elyassa · ▶ 10:24
all actions are logged. Mehdi Elyassa · ▶ 22:02
Key Takeaways
- CVE-2024 allows unauthenticated SQL injection into SCCM via unsigned CCM message headers
- CVE-2025 hits the SMS provider admin service using any SCCM RBAC role including read-only
- Mutual TLS bypass works on HTTPS deployments via anonymous authentication entry points
- Direct database access bypasses SCCM’s double-approval script execution mechanism with minimal log trace
- Rogue COM service handlers persist across reboots and accept unauthenticated CCM connections
About the Speaker(s)
Mehdi Elyassa is a red team operator at Synacktiv, a French offensive information security firm. With over seven years in IT security, he began on the blue team before moving to full-time red teaming. He conducts adversary simulation engagements for large French and international organizations, with a focus on web application attacks and Active Directory.