What is configmanbearpig?

ConfigManBearPig is a security tool that helps penetration testers and red teams find hidden vulnerabilities in Microsoft's SCCM (System Center Configuration Manager) setups. It connects to a network, gathers information about how SCCM is configured, and maps out potential "attack paths", step-by-step routes a hacker could take to escalate their privileges or take over systems. It then feeds this data into BloodHound, a popular interface used by security professionals to visualize these complex attack routes. The tool runs through a three-step pipeline: collect, preprocess, and convert. First, it discovers SCCM sites and systems on a network using standard directory queries. Then, it connects to each discovered server to gather detailed configuration data, such as administrative roles, SQL database settings, and user permissions. Finally, it packages all this raw data into a visual graph that you can drag and drop directly into BloodHound's interface. Once uploaded, the map reveals how a low-level user might exploit SCCM settings to gain full administrator control over an organization's devices. Security consultants, internal red teams, and IT defenders would use this tool during security assessments. For example, a penetration tester hired to audit a company's network could run this collector to show the client exactly how an attacker could leverage an SCCM misconfiguration to move from a single compromised laptop to controlling thousands of managed machines. Along with the visual map, the project includes 24 ready-made search queries that automatically highlight common takeover scenarios, saving testers hours of manual investigation. The project is notably a Python rewrite of an older, self-contained PowerShell script, rebuilt to run on a shared framework called OpenHound. This framework approach makes the tool more modular and maintainable. One important tradeoff noted in the documentation is that to get the full experience, including visual search and pathfinding features in the BloodHound interface, users must run BloodHound with a PostgreSQL database backend rather than the default Neo4j setup. Without PostgreSQL, users are limited to writing manual search queries to explore the collected data.