From e7619df4fdcc778679df863d8be1c8baf06f32e6 Mon Sep 17 00:00:00 2001
From: Duane Michael <dmichaeljr@pm.me>
Date: Mon, 11 Jul 2022 16:30:59 -0600
Subject: [PATCH] Adjusted SCCM output

---
 SharpDPAPI/Commands/SCCM.cs | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/SharpDPAPI/Commands/SCCM.cs b/SharpDPAPI/Commands/SCCM.cs
index 5cda746..d764799 100755
--- a/SharpDPAPI/Commands/SCCM.cs
+++ b/SharpDPAPI/Commands/SCCM.cs
@@ -138,7 +138,7 @@ namespace SharpDPAPI.Commands
                                 }
                                 else
                                 {
-                                    Console.WriteLine("{0}: {1}", prop.Name, prop.Value);
+                                    //Console.WriteLine("{0}: {1}", prop.Name, prop.Value);
                                 }
                             }
                         }
@@ -152,7 +152,7 @@ namespace SharpDPAPI.Commands
             }
         }
 
-        public static void NAADecrypt(string blob, Dictionary<string, string> masterkeys)
+        public static string NAADecrypt(string blob, Dictionary<string, string> masterkeys)
         {
             byte[] blobBytes = new byte[blob.Length / 2];
             for (int i = 0; i < blob.Length; i += 2)
@@ -181,19 +181,31 @@ namespace SharpDPAPI.Commands
                             byte[] decBytes = new byte[finalIndex + 1];
                             Array.Copy(decBytesRaw, 0, decBytes, 0, finalIndex);
                             data = Encoding.Unicode.GetString(decBytes);
+                            return data;
                         }
                         else
                         {
                             data = Encoding.ASCII.GetString(decBytesRaw);
+                            return data;
                         }
+
                         Console.WriteLine("    dec(blob)        : {0}", data);
                     }
                     else
                     {
                         string hexData = BitConverter.ToString(decBytesRaw).Replace("-", " ");
                         Console.WriteLine("    dec(blob)        : {0}", hexData);
+                        return hexData;
                     }
                 }
+                else
+                {
+                    return null;
+                }
+            }
+            else
+            {
+                return null;
             }
         }
 
@@ -232,8 +244,15 @@ namespace SharpDPAPI.Commands
 
                             try
                             {
-                                NAADecrypt(protectedUsername, mappings);
-                                NAADecrypt(protectedPassword, mappings);
+                                string username = "";
+                                string password = "";
+
+                                Console.WriteLine("\r\n[*] Triaging SCCM Network Access Account Credentials\r\n");
+                                username = NAADecrypt(protectedUsername, mappings);
+                                password = NAADecrypt(protectedPassword, mappings);
+
+                                Console.WriteLine("    Plaintext NAA Username        : {0}", username);
+                                Console.WriteLine("    Plaintext NAA Password        : {0}", password);
                             }
                             catch (Exception e)
                             {