SharpPXE

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/leftp/SharpPXE
• Blog Title: SharpPXE
• Suggested Section: Windows Hardening -> Active Directory Methodology (or a new SCCM/ConfigMgr subsection) / alternatively Network Services Pentesting (PXE/TFTP) with SCCM PXE-specific attack chain

🎯 Content Summary

Title / Purpose

SharpPXE is a C# red-team tool that extracts sensitive deployment/configuration data from Microsoft SCCM (ConfigMgr) PXE boot infrastructure by emulating a PXE client. It connects to a PXE-enabled Distribution Point (DP), harvests PXE boot media metadata, downloads the encrypted boot media configuration, and either decrypts it (when a key is provided) or outputs a crackable hash for offline password recovery.

No admin privileges required on the attack...

🔧 Technical Details

A PXE-harvesting technique against SCCM PXE infrastructure: send a PXE boot request to the SCCM PXE service on UDP/4011, parse the PXE response to obtain boot file locations (e.g., SMSBoot\x64\pxe\variables.dat, SMSBoot\x64\pxe\boot.bcd) and sometimes a decryption key, then retrieve the encrypted variables file via TFTP. If key material is provided, decrypt variables.dat and parse the resulting XML to extract SCCM deployment parameters (Management Point URL, site code, Media GUIDs, identifiers). If no key is provided (password-protected media), extract an offline-crackable hash (example format $sccm$aes128$<hash>) for Hashcat, then decrypt and parse after password recovery.

🤖 Agent Actions

Updated SCCM Management Point relay page with a new PXE boot media harvesting section: added SharpPXE workflow (PXE/UDP 4011 request parsing, TFTP retrieval of variables.dat, decrypt vs. Hashcat hash path, XML parsing and SharpSCCM follow-up), clarified requirements, expanded detection/hardening with PXE/TFTP monitoring controls, and included SharpPXE in references.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/leftp/SharpPXE

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (or a new SCCM/ConfigMgr subsection) / alternatively Network Services Pentesting (PXE/TFTP) with SCCM PXE-specific attack chain".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0