{"uuid": "a54c949f-6ff5-439e-b3b5-8ade1b289206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42287", "type": "seen", "source": "https://t.me/hacking_Attack/35785", "content": "Black Hat Ethical Hacking\nMicrosoft warns of easy Windows domain takeover via Active Directory bugs\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft warns of easy Windows domain takeover via Active Directory bugsPost Views: 127 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nMicrosoft warned customers today to patch two Active Directory domain service privilege escalation security flaws that, when combined, allow attackers to easily takeover Windows domains.\nThe company released security updates to address the two security vulnerabilities (tracked as CVE-2021-42287\u00a0and CVE-2021-42278\u00a0and reported by Andrew Bartlett of Catalyst IT) during the November 2021 Patch Tuesday.\n\nRedmond\u2019s warning to immediately patch the two bugs \u2014 both allowing attackers to impersonate domain controllers \u2014 comes after a proof-of-concept (PoC) tool that can leverage these vulnerabilities was shared on Twitter and GitHub on December 11.\n\n\u201cWhen combining these two vulnerabilities, an attacker can create a straightforward path to a Domain Admin user in an Active Directory environment that hasn\u2019t applied these new updates,\u201d Microsoft explains in an advisory published today.\n\n\u201cThis escalation attack allows attackers to easily elevate their privilege to that of a Domain Admin once they compromise a regular user in the domain.\n\n\u201cAs always, we strongly advise deploying the latest patches on the domain controllers as soon as possible.\u201d\nSee Also: Complete Offensive Security and Ethical Hacking Course\nWindows admins are urged to update devices exposed to attacks using the steps and information detailed in the following knowledgebase articles: KB5008102, KB5008380, KB5008602.\n\nResearchers who tested the PoC stated that they were able to easily use the\u00a0tool\u00a0to escalate privileges from standard Active Directory user to a Domain Admin in default configurations.\nhttps://www.bleepstatic.com/images/news/u/1109292/2021/CVE-2021-42278_exploit_tool.jpg \n ago(1d)\n| where ActionType == \"SAM Account Name changed\"\n| extend FROMSAM = parse_json(AdditionalFields)['FROM SAM Account Name']\n| extend TOSAM = parse_json(AdditionalFields)['TO SAM Account Name']\n| where (FROMSAM has \"$\" and TOSAM !has \"$\")\n        or TOSAM in (\"DC1\", \"DC2\", \"DC3\", \"DC4\") // DC Names in the org\n| project Timestamp, Application, ActionType, TargetDeviceName, FROMSAM, TOSAM, ReportId, AdditionalFields4. Replace the marked area with the naming convention of your domain controllers\n5. Run the query and analyze the results which contain the affected devices. You can use Windows Event 4741\u00a0to find the creator of these machines if they were newly created\n6. We recommend investigating these co[...]", "creation_timestamp": "2026-09-01T20:02:02.229433Z"}