Skip to content
attack.paths
Sign in
← RegistryDossier · 7 steps · 6 edges

noPac / sAMAccountName spoofing → Domain Admin

Combine CVE-2021-42278 (sAMAccountName validation) and CVE-2021-42287 (PAC confusion) to impersonate a DC as a low-priv user.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: a low-priv domain user with rights to create machine accounts (default ms-DS-MachineAccountQuota = 10) and an unpatched DC.

§ Steps

  1. 01
    Low-priv domain userInitial Access
    T1078— Valid Accounts
  2. 02
    Create machine accountPersistence
    T1136— Create Account

    addcomputer.py — MachineAccountQuota allows any user.

  3. 03
    Request TGT as fake DCCredential Access
    T1558— Steal or Forge Kerberos Tickets

    getTGT.py — Kerberos pre-auth succeeds with the spoofed name.

  4. 04
    S4U2self → cifs/DC ticket as DAPrivilege Escalation
    AD-NOPAC— sAMAccountName Spoofing — noPac (CVE-2021-42278/42287)

    getST.py -self -impersonate Administrator -spn cifs/<DC>

  5. 05
    Rename machine backPrivilege Escalation
    AD-NOPAC— sAMAccountName Spoofing — noPac (CVE-2021-42278/42287)

    Forces the KDC to fall back to <DCname>$ when looking up the principal.

  6. 06
    Rename computer to DC's sAMAccountName (no $)Privilege Escalation
    AD-NOPAC— sAMAccountName Spoofing — noPac (CVE-2021-42278/42287)
  7. 07
    DCSync as AdministratorCredential Access
    T1003.006— DCSync

§ References

§ Frequently asked

What is the "noPac / sAMAccountName spoofing → Domain Admin" attack path?
Combine CVE-2021-42278 (sAMAccountName validation) and CVE-2021-42287 (PAC confusion) to impersonate a DC as a low-priv user. It chains 7 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Low-priv domain user (T1078) — a initial access primitive. Assumed environment: a low-priv domain user with rights to create machine accounts (default ms-DS-MachineAccountQuota = 10) and an unpatched DC.
What is the final impact of this kill-chain?
The final step lands on DCSync as Administrator (T1003.006), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers