exploiting-nopac-cve-2021-42278-42287

Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments. Use when exploiting the nopac vulnerability chain (cve-2021-42278 samaccountname spoofing and cve-2021-42287.

インストールへ移動

リポジトリ: oyi77/1ai-skills
ソースの最終更新活動: 2026年7月31日 15:22
検出された SKILL.md の言語: 英語
スター: 8
フォーク: 0

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/oyi77/1ai-skills --skill exploiting-nopac-cve-2021-42278-42287

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

mobile-hacking

Android and mobile application security testing — emulators, rooting, traffic interception, dynamic instrumentation. Use when testing mobile apps for vulnerabilities, reversing APKs, or bypassing security controls on Android.

2026-08-10

self-improving

Self-reflection + Self-criticism + Auto-learning from corrections + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when working with self improving.

2026-08-09

conducting-full-scope-red-team-engagement

Plan and execute a comprehensive red team engagement covering reconnaissance through post-exploitation using MITRE ATT&CK-aligned TTPs to evaluate an organization's detection and response capabilities. Use when working with conducting full scope red team engagement.

2026-08-09

このリポジトリのすべてを見る

name	exploiting-nopac-cve-2021-42278-42287
description	Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing and CVE-2021-42287 KDC PAC confusion) to escalate from standard domain user to Domain Admin in Active Directory environments. Use when exploiting the nopac vulnerability chain (cve-2021-42278 samaccountname spoofing and cve-2021-42287.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Platform Monitoring","Process Code Segment Verification","Stack Frame Canary Validation","Segment Address Offset Randomization","Process Analysis"]
nist_csf	["ID.RA-01","GV.OV-02","DE.AE-07"]

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.

When to Use

Trigger phrases:

"exploiting nopac cve 2021 42278 42287"
"Exploit the noPac vulnerability chain (CVE-2021-42278 sAMAccountName spoofing an"
When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287
When analyzing malware samples or attack artifacts in a controlled environment
When conducting red team exercises or penetration testing engagements
When building detection capabilities based on offensive technique understanding

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Scan the target domain for noPac vulnerability (CVE-2021-42278/42287)
Create or leverage a machine account with modified sAMAccountName
Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller
Use the DC ticket to perform DCSync and dump domain credentials
Achieve Domain Admin access from a standard domain user account
Document the complete exploitation chain with evidence

MITRE ATT&CK Mapping

T1068 - Exploitation for Privilege Escalation
T1136.002 - Create Account: Domain Account

Tool	Purpose	Platform
noPac (cube0x0)	Automated scanner and exploiter	Python
noPac (Ridter)	Alternative exploit implementation	Python
Impacket	Kerberos ticket manipulation, DCSync	Python
CrackMapExec	Vulnerability scanning module	Python
Rubeus	Windows Kerberos ticket operations	Windows (.NET)
secretsdump.py	Post-exploitation credential dumping	Python

CVE	Description	CVSS	Patch
CVE-2021-42278	sAMAccountName spoofing (machine accounts)	7.5	KB5008102
CVE-2021-42287	KDC PAC confusion / privilege escalation	7.5	KB5008380

Indicator	Detection Method
Machine account sAMAccountName change	Event 4742 (computer account changed) with sAMAccountName modification
New machine account creation	Event 4741 (computer object created)
TGT request for account without trailing $	Kerberos audit log analysis
S4U2self requests from non-DC machine accounts	Event 4769 with unusual service ticket requests
Rapid sequence: create account, rename, request TGT	SIEM correlation rule for noPac attack pattern

Rationalization	Reality
"We are too small to be targeted"	Automated attacks target everyone. Size does not matter.
"Security slows us down"	A breach slows you down 100x more. Build security in from the start.
"We will fix it after launch"	Vulnerabilities in production are exploited within hours. Fix before deploy.

exploiting-nopac-cve-2021-42278-42287

インストール方法

ソースファイルを確認

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: Vulnerability Scanning

Phase 2: Exploitation with noPac Tool

Phase 3: Post-Exploitation

Phase 4: Manual Exploitation Steps

When NOT to Use

Red Flags

Verification

Tools and Resources

CVE Details

Detection Signatures

Validation Criteria

Process

Anti-Rationalization Table

exploiting-nopac-cve-2021-42278-42287

ソース情報

インストール方法

ソースファイルを確認

このリポジトリの他の Skills

このリポジトリの他の Skills

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: Vulnerability Scanning

Phase 2: Exploitation with noPac Tool

Phase 3: Post-Exploitation

Phase 4: Manual Exploitation Steps

When NOT to Use

Red Flags

Verification

Tools and Resources

CVE Details

Detection Signatures

Validation Criteria

Process

Anti-Rationalization Table