Lateral movement
SCCM by design is an excellent software for lateral movement. Agents are installed throughout the environment; highly privileged accounts are used to perform administrative tasks. Also, it is a good opportunity to blend in legitimate traffic and activities. We will start our discussion about lateral movement by extending coercion authentication to relay attacks.
Client push authentication relay attack
This attack is very similar to the one we did in the Privilege escalation section previously. The only difference is that this time, we would like to relay the captured NTLM response to another machine. (Just a reminder: the relay requires signing to be disabled). On the client side, the attack is exactly the same. On our listening machine, we start ntlmrelayx:
impacket-ntlmrelayx -t 192.168.56.106 -smb2support
After enforcing the client push installation, we relayed it to the Exchange server and dumped SAM hashes, as shown in the following screenshot:
