{"version":1,"type":"rich","provider_name":"Libsyn","provider_url":"https:\/\/www.libsyn.com","height":90,"width":600,"title":"7MS #740: Tales of Pentest Pwnage - Part 90","description":"Hey friends! We\u2019ve been on a bit of a Tales of Pentest Pwnage bender lately, so let\u2019s keep it rolling with Part 90. (And Mom, relax \u2014 this is not one pentest story chopped into 90 parts.) Today is less of an A-to-Z story and more a pile of tips and tricks pulled from a recent string of SCCM-flavored internals \u2014 plus a tangent about a video game and a little robot Claude and I built to get my life back. Multi-tier SCCM is having a moment \u2014 I\u2019ve never administered SCCM a day in my life, but 2026 keeps dropping me into these split-role environments. Here\u2019s where I go to figure out my attack surface when all I\u2019ve got is a low-priv cred. SMB signing on? Cool, I\u2019ll go around it \u2014 relaying from one SCCM box to the one with SQL on it, and the easy-button tool that vacuums the good stuff out of the database once you\u2019re there. (NAA creds, clear-text local admin passwords, install scripts with creds baked in\u2026yes please.) Then relay the other direction \u2014 when the loot came back stale, a nudge from a Slack channel had me pointing the relay backwards, and I giggled like a little schoolboy at what popped out. Adding yourself to the local admin group: still weirdly undetected \u2014 an old episode of ours reminded me of an Impacket tool I don\u2019t see written up on many pentest blogs, and it slipped right by. My favorite cheat code hit a snag \u2014 the evil-scheduled-task-under-a-logged-in-DA trick kept coughing up permission errors, so I had to get creative. Plus the defensive recs I\u2019m still trying to sharpen up \u2014 if you\u2019ve got a better way to close this loophole, I\u2019m all ears! Tangent: Halloween (the video game) and the lobby watcher \u2014 a million players and I\u2019m still staring into the lobby abyss for 10 minutes at a time. So Claude and I built something that watches the screen and texts me when it\u2019s time to sprint back to the keyboard. It\u2019s not cheating. It\u2019s not! (The Texas Chainsaw crowd disagreed, loudly.) ","author_name":"7 Minute Security","author_url":"https:\/\/7MinSec.com","html":"