Description

Added functionality to get secrets based on the work of PXEThief to harvest secrets using PXE boot media certificates. These allow for collection of additional secrets, which are contained in TaskSequences scoped to "Unknown Devices" (used for PXE boots).
An example of how this might be used in an attack can be seen on the last screenshot of this page.

Additionally added code to decrypt secrets on the fly and decompress XML structures to enrich the output of get secrets.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Testing

Used the forked version, with all changes in my Lab to run attacks against my SCCM setup.
Amongst others, ran the following commands to ensure non-breaking changes:

.\SharpSCCM.exe local secrets -m disk
.\SharpSCCM.exe local secrets -m wmi
.\SharpSCCM.exe get secrets

Bonus Points:

• I have commented my code, particularly in hard-to-understand areas
• I have incremented the build/revision number in https://github.com/Mayyhem/SharpSCCM/blob/main/Properties/AssemblyInfo.cs
• I have made corresponding changes to the documentation
• I have added unit tests that prove my fix is effective or that my feature works