AD-SCCM-RELAYPrivilege Escalation

SCCM Site Takeover (Takeover-1…8)

Yannos's SCCM relay chains: relay site server / SMS Provider / MSSQL to gain Full Administrator.

§ Where this technique fits

AD-SCCM-RELAY is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

§ Dossiers chaining this technique

SCCM site takeover via NTLM relay (Takeover-1)
Coerce the SCCM site server to authenticate, relay to MSSQL on the site database, and grant yourself Full Administrator inside SCCM.
step 6 / 7

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

SCCM site takeover via NTLM relay (Takeover-1)

§ What commonly comes next