Configuration-management platforms exist to push software, scripts, and settings to thousands of managed machines from one console. That is also precisely what an attacker wants: code execution across the whole estate from a single compromised component. These systems are deeply trusted, run agents as SYSTEM on every client, hold or broker credentials, and are usually integrated with Active Directory, so abusing one is often equivalent to owning the domain's endpoints.
This area covers the offensive surface of those platforms: how to find them, pull the credentials they store, take over their control plane, and turn their own deployment features into mass code execution.
Products#
- SCCM / MECM: Microsoft Configuration Manager, the dominant on-premises platform and the richest attack surface of the group.