ConfigManBearPig 2.0: A Python Tool for Finding Attack Paths in SCCM

SpecterOps has released ConfigManBearPig 2.0 — a Python rewrite of the original PowerShell script that collects data from Microsoft Configuration Manager (SCCM) and identifies dangerous misconfigurations. The collected data can be uploaded to BloodHound, where graph analysis can be used to identify potential attack paths and remediation options.

Coverage of techniques from Misconfiguration Manager: • RECON — 6/7 • CRED — 1/8 • ELEVATE — 1/6 • TAKEOVER — 9/9 (when used together with SharpHound and MSSQLHound) • EXEC — 2/2 What is especially interesting is that most techniques, including 8 out of 9 TAKEOVER techniques that can provide full control over the SCCM hierarchy, can be identified from the context of a regular low-privileged domain user.

What's new in 2.0 The main improvements are performance and scalability. The author reports an approximately 56% increase in speed in their SCCM lab. The release also includes the following features: • support for running on Linux • integration with the new OpenGraph schema for BloodHound • SOCKS proxy support • authentication using an NT hash or a Kerberos ticket • identification of potential CVEs based on the SCCM version • parallel data collection from multiple targets • separate diagnostic logs

ConfigManBearPig was not designed for stealth on the system where it is executed: data collection may generate a large number of network connections and local files. However, it supports limited collection modes and can route traffic through SOCKS.

Tool: https://github.com/SpecterOps/ConfigManBearPig