garrettfoster13/sccmhunter

GitHub: garrettfoster13/sccmhunter

一款针对 Microsoft SCCM/MECM 的后渗透工具，用于在 Active Directory 环境中发现、剖析和攻击 SCCM 相关资产。

Stars: 892 | Forks: 116

[![由 SpecterOps 赞助](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fspecterops%2F.github%2Fmain%2Fconfig%2Fshield.json)](https://github.com/garrettfoster13/sccmhunter) [![BlackHat USA Arsenal 2024](https://img.shields.io/badge/Black%20Hat%20USA%20Arsenal-2024-brightgreen?style=plastic)](https://www.blackhat.com/us-24/arsenal/schedule/index.html#sccmhunter-38141) [![BlackHat USA Arsenal 2025](https://img.shields.io/badge/Black%20Hat%20USA%20Arsenal-2025-brightgreen?style=plastic)](https://www.blackhat.com/us-25/arsenal/schedule/#sccmhunter-45602) [![@unsigned_sh0rt 的 Twitter](https://img.shields.io/twitter/follow/unsigned_sh0rt?style=social)](https://x.com/unsigned_sh0rt)

# SCCMHunter SCCMHunter 是一款后渗透工具，旨在简化 Active Directory 域中 SCCM 相关资产的识别、剖析和攻击过程。请查看 [Wiki](https://github.com/garrettfoster13/sccmhunter/wiki) 了解详细用法。 ### 请注意该工具是在实验室环境中开发和测试的。实际环境中的性能表现可能有所不同。如果您遇到任何问题，请随时提交 issue。 ## 安装说明强烈建议使用 Python 虚拟环境进行安装 ``` git clone https://github.com/garrettfoster13/sccmhunter.git cd sccmhunter virtualenv --python=python3 . source bin/activate pip3 install -r requirements.txt python3 sccmhunter.py -h ``` 也可以使用 `pipx` 进行全局安装 ``` pipx install git+https://github.com/garrettfoster13/sccmhunter/ ``` # 参考文献非常感谢以下各位的所有研究和辛勤工作
[@\_mayyhem](https://twitter.com/_Mayyhem)
[强制 SCCM 进行 NTLM 身份验证](https://posts.specterops.io/coercing-ntlm-authentication-from-sccm-e6e23ea8260a)
[通过自动客户端推送安装实现 SCCM 站点接管](https://posts.specterops.io/sccm-site-takeover-via-automatic-client-push-installation-f567ec80d5b1)

[@TechBrandon](https://twitter.com/TechBrandon)
[推推搡搡：探索 SCCM 客户端推送账户的攻击面](https://www.hub.trimarcsecurity.com/post/push-comes-to-shove-exploring-the-attack-surface-of-sccm-client-push-accounts)
[推推搡搡：绕过 SCCM 客户端推送账户的 Kerberos 身份验证](https://www.hub.trimarcsecurity.com/post/push-comes-to-shove-bypassing-kerberos-authentication-of-sccm-client-push-accounts)

[@Raiona_ZA](https://twitter.com/Raiona_ZA)
[识别并从 SCCM/MECM 任务序列中检索凭据](https://www.mwrcybersec.com/research_items/identifying-and-retrieving-credentials-from-sccm-mecm-task-sequences)

[@\_xpn\_](https://twitter.com/_xpn_)
[通过去混淆网络访问账户来探索 SCCM](https://blog.xpnsec.com/unobfuscating-network-access-accounts/)

[@subat0mik](https://twitter.com/subat0mik)
[SCCM 的幽灵凭据：为何 NAA 不会消亡](https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9)

[@HackingDave](https://twitter.com/HackingDave)
[攻陷一个即可统领全局](https://www.youtube.com/watch?v=Mz9Bg9KAKBs)

标签：Active Directory, BlackHat Arsenal, HTTP/HTTPS抓包, Modbus, PE 加载器, Plaso, Python, SCCM, System Center Configuration Manager, Web报告查看器, 企业安全, 协议分析, 域渗透, 态势感知, 插件系统, 无后门, 权限提升, 横向移动, 活动目录, 电子数据取证, 编程规范, 网络安全, 网络资产管理, 逆向工具, 隐私保护