Section 1

SCCM Relay Exploit Workflow

1. Use the auxiliary/admin/dcerpc/samr_account module to create a new computer account for testing the relay
2. Use the auxiliary/gather/ldap_query to enumerate SCCM target information
3. Use the new auxiliary/server/relay/relay_get_naa_credentials module to attack SCCM
4. For demonstration or testing purposes, use net use to trigger an authentication attempt to Metasploit

Section 2

SMB to LDAP Relaying Workflow followed by ESC15 exploitation

1. Use the auxiliary/server/relay/smb_to_ldap module to start a relaying listener
2. For demonstration or testing purposes, use net use to trigger an authentication attempt to Metasploit
3. Use the auxiliary/gather/ldap_esc_vulnerable_cert_finder module with the newly opened LDAP session to identify exploitable certificate templates
4. Use the auxiliary/admin/dcerpc/icpr_cert to exploit ESC15 by setting the new ADD_CERT_APP_POLICY datastore option a. See: https://docs.metasploit.com/docs/pentesting/active-directory/ad-certificates/attacking-ad-cs-esc-vulnerabilities.html#exploiting-esc15
5. Use the auxiliary/admin/kerberos/get_ticket module to obtain a TGT from the certificate

Section 3

Meterpreter with PoolParty

1. Use the exploit/windows/smb/psexec to open a Meterpreter session to the target
2. Reusing the TGT from the previous demo by setting the SMB::Krb5Ccname option
3. Use API Monitor to log NtCreateThreadEx syscalls, showing an instance with a process handle in use
4. Switch to the latest version of Metasploit
5. Repeat step #1 to open a new, updated session
6. Rerun the test to validate that no calls to CreateRemoteThread are taking place