Mayfly - Hack, Code, Sleep, Repeat

On the previous post (SCCM LAB part 0x0) we setup an environment to play with SCCM. If all is going well you should get something like that : Ok so let’s try this out :) Recon Recon without user scan with nmap (full port list used here : https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports) # search sccm nmap -p 80,443,445,1433,10123,8530,8531 -sV 192.168...

On the previous post (SCCM LAB part 0x1) we started the recon and exploit the PXE feature. On this part we will start SCCM exploitation with low user credentials. Exploit with low user Takeover 1 - relay to mssql (low user -> mssql server admin) A super cool technic by default on mecm when the database is separate of the site server is that the server site is necessary sysadmin of the d...

On the previous post (SCCM LAB part 0x2) we have done SCCM exploitation with a low privilege user. On this part we will exploit SCCM with an admin access on one vm. On part 0x1 we discovered the credentials of local administrator user on CLIENT vm. nxc smb 192.168.33.10-13 -u administrator -p 'EP+xh7Rk6j90' --local-auth So we will start by exploit with local admin account. also on pa...

In the previous blog post on ADCS (Goad Pwning Part 6), ESC1, ESC2, ESC3, ESC4, ESC6, and ESC8 were exploited. This post examines additional ESC vulnerabilities within the domains. Several modifications have been made to GOAD (excluding goad-light and goad-mini) to support various ADCS attack techniques. Updating an existing GOAD instance will incorporate these changes. Some of these mod...

Full view and regulary updated Active Directory Pentest mindmap is available on orange cyberdefense mindmap site : https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap_ad_dark_classic_2025.03.excalidraw.svg Upgrade A lot of stuff (timeroasting, SCCM attacks, adcs 11-15,…) But the main upgrade is the generation from markdown ! Now we can integrate pull request easily....

Some time ago i discovered the work of some researchers about SCCM, i was very interested by their research and as i reading i thought that i really need a lab to test all these cool attacks ! Thanks a lot to my colleague Issam (@KenjiEndo15), who start the project and provide me some of ansible roles to start from ! After few hours, days, weeks of install, ansible recipe creation, try and ...