Reconnaissance
In this section, we will discuss reconnaissance, as well as enumeration. We will briefly cover how to identify SCCM only with network access and then dive deeper into the assume breach scenario.
To identify SCCM infrastructure from a non-domain-joined machine, the attacker may perform a simple port scan looking for TCP ports 8530 and 8531 (Software Update point), 10123 (Management point), and 4022 and 1433 (SQL Server). Also, the UDP port 4011 might be an indicator of the Preboot Execution Environment (PXE) boot media being offered. SCCM can be deployed with or without a PXE offering called Operating System Deployment (OSD). We do not have PXE deployed in our lab, but there are some promising vectors to consider.
To check whether PXE is available in the environment, there is a tool called PXEThief[11]. This tool sends a DHCP discover request to search for PXE servers and fetch PXE boot files. If PXE media is encrypted, then the attacker needs to guess or crack...
