sAMAccountName Spoofing (noPac)

sAMAccountName spoofing, known as noPac (CVE-2021-42278 + CVE-2021-42287), lets an unprivileged domain user become Domain Administrator by abusing how the KDC resolves machine accounts. It is one of the fastest paths to Domain Admin on an unpatched DC.

What it is based on. By default a user can create up to 10 computer accounts (ms-DS-MachineAccountQuota). The attack creates a machine account and renames it to match the DC name (for example DC01, without the trailing $). It requests a TGT for that account and then renames it back; when the KDC receives an S4U2Self and cannot find the renamed account, it falls back to the DC account and issues a PAC with its privileges. The result is a service ticket as Administrator against the DC.

How it is executed. The full chain is automated in Impacket's noPac.py:

# check MachineAccountQuota > 0 and that the DC is vulnerable
netexec ldap <ip> -u <user> -p <pass> -M maq
netexec smb <ip> -u <user> -p <pass> -M nopac
# full chain with impacket
python3 noPac.py <domain>/<user>:<pass> -dc-ip <ip> --impersonate administrator -use-ldap -dump
KRB5CCNAME=administrator.ccache psexec.py -k -no-pass <domain>/administrator@<dc>

With -dump the tool itself launches a secretsdump (NTDS dump) after obtaining the ticket, closing out the domain takeover in a single step.

Requirements. MachineAccountQuota > 0 (default 10) and a DC without the November 2021 patches. No special privilege beyond a valid domain account is needed.

How to detect it. Look for a computer account creation (Event ID 4741) followed within seconds by name changes of that account (Event ID 4781) and by ticket requests (4769) for an account with a DC name. The create -> rename-to-DC -> request-TGT -> rename sequence is very characteristic.

Defence. Apply the patches (KB5008102/KB5008380), set ms-DS-MachineAccountQuota to 0 so users cannot create machine accounts, and monitor computer-account renames. Related to constrained delegation (it uses the same S4U extension) and the Silver Ticket.