noPac (CVE-2021-42278 combined with CVE-2021-42287) is a privilege escalation from any authenticated user to Domain Admin. The attacker creates a machine account, renames its sAMAccountName to match a domain controller (dropping the trailing dollar sign), requests a TGT, renames it back, and then uses S4U2self to get a service ticket as a privileged user, because a KDC validation flaw resolves the ticket to the DC. Defend by patching and setting the machine account quota to zero.
What noPac is
noPac chains two flaws. CVE-2021-42278 let a machine account's sAMAccountName be set to a name that clashes with a domain controller's; CVE-2021-42287 was a KDC ticket-validation weakness that then resolved a request to the real DC. Together they let an ordinary user impersonate a domain controller and, through Kerberos delegation, obtain a ticket as any user.
How the attack works
By default any authenticated user can create machine accounts (ms-DS-MachineAccountQuota is 10). The attacker creates one, renames its sAMAccountName to a DC's name without the trailing dollar sign, requests a TGT, renames the account back, then requests an S4U2self ticket for a privileged user, which the KDC issues as the DC. Tools such as noPac.py -dc-ip <dc> <domain>/<user>:<pass> --impersonate administrator -dump automate the whole chain. Shown for defensive testing.
How to defend against it
Patch (November 2021) to fix both CVEs. Set ms-DS-MachineAccountQuota to 0 so ordinary users cannot create machine accounts, which removes the starting point. Monitor for machine-account creation and for sAMAccountName changes that collide with domain controller names, and alert on unusual S4U2self activity.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: CVE-2021-42278 SAM name spoofing(Microsoft)
An unpatched domain plus a nonzero machine-account quota is a one-command path to Domain Admin. Talk to a security expert about validating both.