noPac (CVE-2021-42278/42287)

Escalates from domain user to DA by abusing sAMAccountName spoofing.

Exploits the CVE-2021-42278 / CVE-2021-42287 pair (nicknamed *noPac* or *sAMAccountName spoofing*). Any domain user can, by default, create a machine account and rename it to match a domain controller's; when a ticket is then requested, the KDC gets confused and hands one out with that DC's privileges. The result is going from a plain user to impersonating the domain administrator in a single command, without cracking anything. It is one of the most direct escalations you see in unpatched AD.

Family AD abuse (ACL, ADCS, coercion)

Flags -dc-ip -dc-host --impersonate --shell

Concepts sAMAccountName Spoofing (noPac), Pass-the-Ticket, Kerberoasting

Cheatsheet Coercion & DC CVEs (NoPac, PetitPotam, PrintNightmare)

Installation

pipx install impacket

Repositorygithub.com/Ridter/noPac

Useful commands2 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.