CVE-2021-42278

This PoC exploits CVE-2021-42278 and CVE-2021-42287 to impersonate a Domain Admin from a standard domain user by manipulating machine account quotas and sAMAccountName spoofing. It uses Impacket and LDAP interactions to achieve privilege escalation.

This repository contains a Python-based exploit for CVE-2021-42278 and CVE-2021-42287, which allows a standard domain user to impersonate a Domain Admin (DA) by chaining vulnerabilities in Active Directory. The exploit includes functionality for obtaining a Kerberos ticket, executing commands via SMB, and dumping hashes.

This is a Python implementation of CVE-2021-42278, an Active Directory privilege escalation exploit. It leverages a flaw in the Kerberos S4U2Self process to impersonate domain controllers or other machines, allowing an attacker to escalate privileges to domain admin.

This repository contains a functional exploit for CVE-2021-42278 (noPac), which leverages a Kerberos authentication bypass to escalate privileges in Active Directory environments. The exploit chains CVE-2021-42278 with CVE-2021-42287 to achieve remote code execution (RCE) or credential dumping via SMB.

This repository contains a detection script for CVE-2021-42278 and CVE-2021-42287, which checks for vulnerabilities in Active Directory by analyzing TGT sizes and MachineAccountQuota values. It uses Impacket and LDAP queries to determine potential exploitability.

This repository contains a PowerShell script that exploits CVE-2021-42278, a vulnerability in Active Directory allowing privilege escalation via sAMAccountName spoofing. The script uses Rubeus for exploitation and demonstrates the attack by manipulating Kerberos authentication.

This repository contains a PowerShell script (Invoke-noPac.ps1) that exploits CVE-2021-42278, a privilege escalation vulnerability in Active Directory domain controllers. The script leverages a flaw in the SAM protocol to impersonate a domain controller and escalate privileges.

This repository contains a functional exploit for CVE-2021-42278, a vulnerability in Active Directory Domain Controllers that allows domain user to domain admin privilege escalation. The exploit leverages Kerberos ticket manipulation to bypass authentication and gain elevated privileges.