Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FEATURE] Parse NAA blobs from CIM Repository #13

Closed
subat0mik opened this issue Oct 19, 2022 · 1 comment
Closed

[FEATURE] Parse NAA blobs from CIM Repository #13

subat0mik opened this issue Oct 19, 2022 · 1 comment
Assignees
Labels
enhancement New feature or request

Comments

@subat0mik
Copy link
Collaborator

Is your feature request related to a problem? Please describe.
The tool parses NAAs from WMI but not the CIM repository, as outlined in @subat0mik 's blog here: https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9

Describe the solution you'd like
Code to parse objects.data for blobs then pass to decryption function

Describe alternatives you've considered
Currently feasible manually

Additional context
Add any other context or screenshots about the feature request here.

@subat0mik
Copy link
Collaborator Author

Completed with: #14

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants