exploiting-nopac-cve-2021-42278-42287

Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments. Use when exploiting the nopac vulnerability chain (cve-2021-42278 samaccountname spoofing and cve-2021-42287.

Ir a la instalación

Repositorio: oyi77/1ai-skills
Última actividad en el origen: 31 de julio de 2026 a las 15:22
Idioma detectado de SKILL.md: inglés
Estrellas: 8
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/oyi77/1ai-skills --skill exploiting-nopac-cve-2021-42278-42287

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

mobile-hacking

Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.

2026-08-10

self-improving

Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.

2026-08-09

conducting-full-scope-red-team-engagement

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.

2026-08-09

Ver todos los de este repositorio

name	exploiting-nopac-cve-2021-42278-42287
description	Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments. Use when exploiting the nopac vulnerability chain (cve-2021-42278 samaccountname spoofing and cve-2021-42287.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.

When to Use

Trigger phrases:

"exploiting nopac cve 2021 42278 42287"
"Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing an"
When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287
When analyzing malware samples or attack artifacts in a controlled environment
When conducting red team exercises or penetration testing engagements
When building detection capabilities based on offensive technique understanding

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Scan the target domain for noPac vulnerability (CVE-2021-42278/42287)
Create or leverage a machine account with modified sAMAccountName
Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller
Use the DC ticket to perform DCSync and dump domain credentials
Achieve Domain Admin access from a standard domain user account
Document the complete exploitation chain with evidence

MITRE ATT&CK Mapping

T1068 - Exploitation for Privilege Escalation
T1136.002 - Create Account: Domain Account

Tool	Purpose	Platform
noPac (cube0x0)	Automated scanner and exploiter	Python
noPac (Ridter)	Alternative exploit implementation	Python
Impacket	Kerberos ticket manipulation, DCSync	Python
CrackMapExec	Vulnerability scanning module	Python
Rubeus	Windows Kerberos ticket operations	Windows (.NET)
secretsdump.py	Post-exploitation credential dumping	Python

CVE	Description	CVSS	Patch
CVE-2021-42278	sAMAccountName spoofing (machine accounts)	7.5	KB5008102
CVE-2021-42287	KDC PAC confusion / privilege escalation	7.5	KB5008380

Indicator	Detection Method
Machine account sAMAccountName change	Event 4742 (computer account changed) with sAMAccountName modification
New machine account creation	Event 4741 (computer object created)
TGT request for account without trailing $	Kerberos audit log analysis
S4U2self requests from non-DC machine accounts	Event 4769 with unusual service ticket requests
Rapid sequence: create account, rename, request TGT	SIEM correlation rule for noPac attack pattern

Rationalization	Reality
"We are too small to be targeted"	Automated attacks target everyone. Size does not matter.
"Security slows us down"	A breach slows you down 100x more. Build security in from the start.
"We will fix it after launch"	Vulnerabilities in production are exploited within hours. Fix before deploy.

exploiting-nopac-cve-2021-42278-42287

Opciones de instalación

Revisa los archivos de origen

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: Vulnerability Scanning

Phase 2: Exploitation with noPac Tool

Phase 3: Post-Exploitation

Phase 4: Manual Exploitation Steps

When NOT to Use

Red Flags

Verification

Tools and Resources

CVE Details

Detection Signatures

Validation Criteria

Process

Anti-Rationalization Table

exploiting-nopac-cve-2021-42278-42287

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: Vulnerability Scanning

Phase 2: Exploitation with noPac Tool

Phase 3: Post-Exploitation

Phase 4: Manual Exploitation Steps

When NOT to Use

Red Flags

Verification

Tools and Resources

CVE Details

Detection Signatures

Validation Criteria

Process

Anti-Rationalization Table