wtf is cred1py?

Cred1Py is a security testing tool that helps penetration testers and red teamers extract sensitive credentials from SCCM (Microsoft's system management software) servers. Specifically, it exploits a weakness called CRED-1 to retrieve network access account usernames and passwords that are stored in boot configuration files on PXE servers, the systems organizations use to remotely install operating systems on new machines. In plain terms, when a company sets up remote computer imaging, the PXE server holds encrypted files containing credentials needed to join new machines to the network. Cred1Py requests those files from the server, extracts the cryptographic keys or password hashes protecting them, and either hands you the decryption key directly or produces a hash you can crack offline using a tool like HashCat. Once decrypted, the credentials inside can be used to access the network. What makes this tool distinct is that it runs through a SOCKS5 proxy, essentially a tunnel that routes traffic through an already-compromised machine. This means a security professional who has gained a foothold inside a network can reach the PXE server through that foothold, without needing direct network access from their own machine. This mirrors how real attackers operate once inside an environment. The tool is designed for security professionals conducting authorized penetration tests or red team engagements. For example, if a tester has compromised a server and established a command-and-control connection, they could use this tool to pivot to the organization's PXE server and extract credentials that might open doors to broader network access. Cred1Py works alongside another tool called PxeThiefy, which handles the final decryption step. Because SOCKS5 has limitations with certain file transfer methods, this tool retrieves only a small portion of the boot file through the proxy, the rest must be downloaded separately through a standard file-sharing connection to the distribution server. The project credits Christopher Panayi for the original CRED-1 research and Carsten Sandker for the Pxethiefy tool it builds upon.