NoPAC
The NoPAC attack is a chained exploitation technique that combines two vulnerabilities: a privilege escalation method called sAMAccountName spoofing and a Key Distribution Center (KDC) flaw.
The first vulnerability, sAMAccountName spoofing (CVE-2021-42278), relies on an attacker having permission to modify the sAMAccountName attribute of, typically, a machine account. The attacker changes this attribute so that it matches the name of a Domain Controller (DC), but without the trailing $. For example, from DC01$ to DC01.
The second vulnerability, NoPAC (CVE-2021-42287), exists in the KDC. When the KDC receives a request for a service ticket (TGS) for an account that does not exist, it automatically appends a $ to the account name and attempts to resolve it again. This behaviour can cause the KDC to mistakenly associate the request with the legitimate machine account.
A system vulnerable to NoPAC is not necessarily vulnerable to sAMAccountName spoofing. Both conditions must be present for the full attack chain to succeed.
A key component in this process is the Privilege Attribute Certificate (PAC). The PAC contains critical information about the authenticated user, including:
The user’s Security Identifier (SID)
Group SIDs
User rights and privileges
Logon information
When a user requests a TGT, the KDC embeds the PAC in the ticket. Services later rely on this information to make authorization decisions. If a DC returns a TGT without a PAC, the normal authorization checks can be bypassed, potentially allowing an attacker to gain elevated privileges.
Attack
The NoPAC attack typically proceeds through the following steps:
Create a new computer account (e.g.,
TEST01) and remove the automatically created Service Principal Names (SPNs). In some cases, an existing machine account or a user account can also be used.Modify the
sAMAccountNameof the computer account so that it matches the DC name, but without the trailing$.Request a TGT using the credentials of the modified machine account.
Restore the original
sAMAccountNamevalue.Use
S4U2Selfto request a TGS that impersonates a privileged user such as Administrator.
Windows
The noPac binary can be used to determine whether a DC is vulnerable to the NoPAC attack. The tool requests a TGT without a PAC. If the DC is vulnerable, the returned ticket is typically smaller than 1000 bytes, indicating that the PAC was not included.
Next, the MachineAccountQuota (MAQ) value should be checked. By default, this setting allows a standard domain user to join up to 10 machines to the domain. It is also useful to determine how many machine accounts a specific user has already created by querying the ms-DS-CreatorSID attribute on computer objects.
Even if MAQ is set to its default value, Access Control Lists (ACLs) may still prevent a user from creating new machine accounts.
Linux
In addition to machine accounts, this attack can also be performed using user accounts. For example, if user x7331 has GenericAll permissions over another user (e.g., bob), the attack can be carried out through that account instead. In this scenario, the target user must have an empty SPN attribute.
On Linux systems, the NoPAC scanner can be used to determine whether a DC is vulnerable.
Last updated