Identify if SCCM (MECM) is Present

Technique Info

port scan for SCCM/MECM/PXE Specific Ports

Command

# search sccm
nmap -p 80,443,445,1433,10123,8530,8531 -T4 -Pn -n -sV -sT [ip/cidr] -oA tcp-sccm-port-scan
 
# search pxe
nmap -p 67,68,69,4011,547 -Pn -n --open -sU 192.168.33.11 [ip/cidr] -oA udp-pxe-port-scan

Identify SCCM/MECM from Pxeboot information

Command

pxethief.py explore -i eth1

How to Interpret Results (source: thehackerrecipes)

• pxethiefy.py uses broadcast requests to request DHCP PXE boot options. An SCCM setup does not have to support PXE boot and a “found” PXE server does not have to be an SCCM component. Be cautious of false positive results.
• In this case a PXE server was found and PXE media was downloaded. The location of the PXE media on the TFTP server is \SMSTemp\..., which indicates that this is indeed an SCCM server.

Enumerate PXE with pxethiefy.py

Command

pxethiefy.py explore -i eth1

Example

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "active-directory") OR contains(tags, "sccm")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

active-directory

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "active-directory")
SORT file.ctime DESC

sccm

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "sccm")
SORT file.ctime DESC