Exploring SCCM by Unobfuscating Network Access Accounts

This blog post reverse-engineers SCCM's HTTP API and client registration to show a practical abuse path: an attacker able to create a computer account can register a fake SCCM client, cause it to be Approved, download secret NAAConfig policies encrypted to the client's key, and recover Network Access Account credentials offline by decrypting the PKCS#7 payload and applying the client-side unobfuscation routine; the author provides analysis, debugging notes, and proof-of-concept code.