Red Team Story: Offline SCCM backup secrets decryption#

Martino

• Why: SCCM/MECM is high-value, AD-integrated infrastructure, and its backups — often sitting readable on network shares — carry encrypted secrets. This is a common real-world exposure with no complete public walkthrough until now.
• What: The first concrete, end-to-end offline decryption of SCCM backup secrets with no access to a live SCCM server: the exact artifacts required, the encryption scheme, and a released script to reproduce the workflow. (from abstract only)
• How: Explanation of how SCCM backup-secret encryption works, which artifacts must be collected from a backup, and a step-by-step decryption workflow, demonstrated against the public GOAD SCCM lab.
• Where applicable: On-prem SCCM deployments where backup files are readable (network shares or other exposed locations); requires only read access to the backup artifacts. Vendor-specific to Microsoft SCCM.