| name | exploiting-nopac-cve-2021-42278-42287 |
| description | Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.
When to Use
- When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287
- When analyzing malware samples or attack artifacts in a controlled environment
- When conducting red team exercises or penetration testing engagements
- When building detection capabilities based on offensive technique understanding
Most Often Missed & How to Confirm
- Not checking MachineAccountQuota first. noPac's easy path needs MAQ > 0 so a normal user can create a machine account. If MAQ is 0, you need an existing controlled computer account — confirm via the
ms-DS-MachineAccountQuota LDAP attribute before attempting.
- Failing to restore the sAMAccountName. Leaving the machine account renamed to the DC name breaks things and is loud; the chain must rename back to
ATTACKPC$ after the TGT request.
- Targeting a patched DC. KB5008380/KB5008602 (Nov 2021) close the PAC confusion — verify patch status, a fully patched DC will reject the spoofed-name TGT.
- Wrong
-dc-host / SPN format causing S4U2self to fail.
- Clock skew breaking Kerberos — sync time to the DC.
- How to confirm a hit: the success signal is a usable DC-level ticket —
noPac.py ... -shell drops a SYSTEM shell on the DC, or KRB5CCNAME=administrator.ccache secretsdump.py -k -no-pass ...@DC01 returns the krbtgt:502: hash via DCSync. Don't conclude the domain is patched until the scanner (cube0x0 / CME ) reports vulnerable AND a spoofed-name actually issues a ticket; a scanner "not vulnerable" with MAQ=0 may just mean you lack account-creation rights, not that the CVE is patched.
