Microsoft Configuration Manager AdminService RBAC Bypass to SYSTEM via Console Extension Chain

<# CVE-2026-47301 - Microsoft Configuration Manager RBAC Bypass
   noisgate verification script | 2026-10-07
   Run on: SCCM Primary Site Server
   Requires: Local administrator privileges
   Output: VULNERABLE / PATCHED / UNKNOWN
#>
$ErrorActionPreference = 'SilentlyContinue'

# Patched build numbers per current branch (KB38232642)
$PatchedBuilds = @{
    '9135' = [version]'5.0.9135.1031'  # CB 2503
    '9141' = [version]'5.0.9141.1030'  # CB 2509
    '9146' = [version]'5.0.9146.1021'  # CB 2603
}

$setupKey = 'HKLM:\SOFTWARE\Microsoft\SMS\Setup'
if (-not (Test-Path $setupKey)) {
    Write-Output 'UNKNOWN - ConfigMgr site server role not detected (registry key absent).'
    exit 2
}

$props = Get-ItemProperty $setupKey
$installDir = $props.'Installation Directory'
if (-not $installDir) {
    Write-Output 'UNKNOWN - Installation Directory not found in registry.'
    exit 2
}

$smsExecPath = Join-Path $installDir 'bin\X64\smsexec.exe'
if (-not (Test-Path $smsExecPath)) {
    Write-Output 'UNKNOWN - smsexec.exe not found. Confirm this is a site server.'
    exit 2
}

$ver = [version](Get-Item $smsExecPath).VersionInfo.FileVersion
$branch = $ver.Build.ToString()
Write-Output "[*] ConfigMgr build detected: $ver (branch $branch)"

# --- IOC checks ---
$adsOriginal = Join-Path $installDir 'bin\X64\adsource_original.dll'
$adsource    = Join-Path $installDir 'bin\X64\adsource.dll'
$iocFound = $false

if (Test-Path $adsOriginal) {
    Write-Output "[!] IOC: adsource_original.dll EXISTS at $adsOriginal"
    Write-Output '    This file is created by the public exploit and should not exist.'
    $iocFound = $true
}
if (Test-Path $adsource) {
    $sig = Get-AuthenticodeSignature $adsource -ErrorAction SilentlyContinue
    if ($sig -and $sig.SignerCertificate) {
        if ($sig.SignerCertificate.Subject -notmatch 'O=Microsoft') {
            Write-Output "[!] IOC: adsource.dll signed by '$($sig.SignerCertificate.Subject)' - NOT Microsoft"
            $iocFound = $true
        }
    } elseif ($sig.Status -eq 'NotSigned') {
        Write-Output '[!] IOC: adsource.dll is UNSIGNED'
        $iocFound = $true
    }
}
if ($iocFound) {
    Write-Output '[!!] ACTION REQUIRED: Investigate for active compromise BEFORE patching.'
    Write-Output ''
}

# --- Version check ---
if ($PatchedBuilds.ContainsKey($branch)) {
    $required = $PatchedBuilds[$branch]
    if ($ver -ge $required) {
        Write-Output "PATCHED - Build $ver >= $required. KB38232642 applied."
        Write-Output 'Note: Links 2-4 (CabSlip, cert bypass, DLL hijack) remain open until ConfigMgr 2609.'
        exit 0
    } else {
        Write-Output "VULNERABLE - Build $ver < $required. KB38232642 NOT applied."
        Write-Output 'Any domain user with network reach to AdminService can exploit this chain.'
        exit 1
    }
} elseif ([int]$branch -gt 9146) {
    Write-Output "PATCHED - Build $ver is newer than all known-affected branches."
    exit 0
} else {
    Write-Output "UNKNOWN - Branch $branch not in known-affected list. Verify against MSRC advisory."
    exit 2
}