Microsoft Configuration Manager SQL Injection Remote Code Execution Vulnerability

This repository is a Go-based exploit for CVE-2024-43468, a critical unauthenticated SQL injection vulnerability in Microsoft Configuration Manager (SCCM/ConfigMgr) Management Points. The exploit targets SCCM servers accessible over the network and leverages mutual TLS (mTLS) authentication using client certificates stored in the macOS Keychain. The main exploit logic is implemented in 'main.go', which constructs and sends specially crafted requests to the '/ccm_system/request' endpoint on the target SCCM server. The exploit allows the attacker to execute arbitrary SQL queries on the SCCM site database, enabling actions such as creating new admin users or running other privileged commands. The 'signer/keychain.go' file provides Go bindings to access and use client certificates from the macOS Keychain for mTLS, while 'get_cert_name.py' is a helper script to list and select certificate common names from the Keychain. The repository is operational and requires the attacker to have a valid client certificate in their macOS Keychain. The exploit supports optional SOCKS5 proxying for network traffic. The code is well-structured, with clear separation between the main exploit logic, certificate handling, and helper utilities.

This repository contains a Python exploit script (CVE-2024-43468.py) and a detailed README for CVE-2024-43468, a critical unauthenticated SQL injection vulnerability in Microsoft Configuration Manager (SCCM) Management Points. The exploit targets the '/ccm_system/request' endpoint, allowing an attacker with network access to execute arbitrary SQL queries on the SCCM site database as the MP machine account, which typically has sysadmin privileges. The script supports both HTTP and HTTPS targets, with optional mutual TLS authentication if required by the server. The attacker can use this exploit to create new database administrator users, escalate privileges, or achieve remote code execution via SQL features like xp_cmdshell. The README provides usage instructions, affected versions, and example payloads. The code is operational and requires the attacker to supply the target URL and SQL query, with optional parameters for client certificate authentication.