Understanding the NoPac Exploit: A Deep Dive into CVE-2021-42278 and CVE-2021-42287

Oct 21, 2024    #active-directory   #windows   #nopac   #cve-2021-42278   #cve-2021-42287  

Introduction:

In late 2021 the “NoPac” exploit leveraged two critical vulnerabilities in Microsoft’s Active Directory, potentially allowing an attacker to escalate from a standard user account to domain administrator privileges with alarming ease.

Key Points:

Let’s delve into the intricacies of NoPac, exploring the underlying vulnerabilities, mechanics, and the significant threat it posed to organizational security.

Understanding the Vulnerabilities:

At its core, the NoPac exploit takes advantage of two distinct but interrelated vulnerabilities in Microsoft’s Active Directory. Let’s examine each in detail:

CVE-2021-42278: SAM Bypass Vulnerability:

The first vulnerability, CVE-2021-42278 , is a bypass vulnerability in the Security Account Manager (SAM).

Key Characteristics:

Impact:

CVE-2021-42287: Kerberos PAC Vulnerability:

The second vulnerability, CVE-2021-42287 , resides within the Kerberos Privilege Attribute Certificate (PAC) in Active Directory Domain Services (AD DS).

Key Characteristics:

Impact:

The NoPac Exploit Process:

To better understand the flow of the NoPac exploit, let’s look at a simplified diagram of the process:

+--------------------------------------------------+
|                                                  |
|  +--------------------------------------------+  |
|  |                                            |  |
|  |  1. Initial Access                         |  |
|  |     - Standard domain user credentials     |  |
|  |                                            |  |
|  +--------------------------------------------+  |
|                       |                          |
|                       v                          |
|  +--------------------------------------------+  |
|  |                                            |  |
|  |  2. Exploit CVE-2021-42278                 |  |
|  |     - Change computer account name         |  |
|  |     - Match Domain Controller name         |  |
|  |                                            |  |
|  +--------------------------------------------+  |
|                       |                          |
|                       v                          |
|  +--------------------------------------------+  |
|  |                                            |  |
|  |  3. Request TGT                            |  |
|  |     - For the renamed computer account     |  |
|  |                                            |  |
|  +--------------------------------------------+  |
|                       |                          |
|                       v                          |
|  +--------------------------------------------+  |
|  |                                            |  |
|  |  4. Exploit CVE-2021-42287                 |  |
|  |     - Request service ticket               |  |
|  |     - KDC issues ticket for DC             |  |
|  |                                            |  |
|  +--------------------------------------------+  |
|                       |                          |
|                       v                          |
|  +--------------------------------------------+  |
|  |                                            |  |
|  |  5. Privilege Escalation                   |  |
|  |     - Obtain Domain Admin privileges       |  |
|  |                                            |  |
|  +--------------------------------------------+  |
|                                                  |
+--------------------------------------------------+

This diagram outlines the five main steps an attacker would typically follow when exploiting NoPac. Let’s dive deeper into each step.

Step 1: Initial Access

The attack begins with standard domain user credentials. It’s crucial to note that by default, authenticated users can add up to 10 computers to a domain, which is a key factor in this exploit.

Step 2: Exploiting CVE-2021-42278:

The attacker leverages CVE-2021-42278 to change the name of a new computer account to match a Domain Controller’s SamAccountName. This step exploits the vulnerability in how Active Directory handles computer account naming.

Step 3: Requesting a TGT:

With the renamed computer account, the attacker requests a Ticket Granting Ticket (TGT) from the Key Distribution Center (KDC).

Step 4: Exploiting CVE-2021-42287:

The attacker then exploits CVE-2021-42287 by requesting a service ticket. Due to the vulnerability in the Kerberos PAC, the KDC issues a ticket for the Domain Controller.

Step 5: Privilege Escalation:

With the obtained service ticket for the Domain Controller, the attacker can now escalate their privileges to Domain Admin level, effectively compromising the entire domain.

Real-World Exploitation Example:

To better understand how the NoPac exploit works in practice, let’s walk through a real-world example. This demonstration will show each step of the process, from initial access to achieving domain admin privileges.

Prerequisites:

Before we begin, ensure you have the following:

Step-by-Step Exploitation:

1 - Prepare the Exploit:

2. Enumerate to find out if the target is vulnerable to the NoPac Exploit:

3. Execute the Exploit:

4. Verify Privilege Escalation:

C:\Windows\system32>whoami /groups

GROUP INFORMATION
-----------------

Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
BUILTIN\Administrators                 Alias            S-1-5-32-544 Enabled by default, Enabled group, Group owner
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
Mandatory Label\System Mandatory Level Label            S-1-16-16384

5. Post-Exploitation:

Defending Against NoPac Attacks:

Given the severity of the NoPac exploit, it’s crucial for system administrators to take steps to mitigate the risks. Here are some key defensive measures:

  1. Apply Security Updates:

    • Immediately apply the patches released by Microsoft for CVE-2021-42278 and CVE-2021-42287.
    • Regularly check for and apply new security updates.

  2. Implement Least Privilege:

    • Restrict user permissions to the minimum necessary for their roles.
    • Regularly audit and review user and computer account permissions.

  3. Monitor Active Directory:

    • Implement robust logging and monitoring for Active Directory events.
    • Pay special attention to computer account name changes and unusual service ticket requests.

  4. Use Advanced Threat Detection:

    • Employ security information and event management (SIEM) tools to detect suspicious activities.
    • Consider using Active Directory-specific security tools that can detect exploitation attempts.

  5. Conduct Regular Security Assessments:

    • Perform frequent vulnerability scans and penetration tests.
    • Use tools like PingCastle to assess the overall security posture of your Active Directory environment.

  6. Implement Network Segmentation:

    • Separate critical assets and limit lateral movement within the network.
    • Use firewalls and access controls to restrict unnecessary communication between network segments.

  7. Educate and Train:

    • Ensure IT staff are aware of the latest threats and mitigation strategies.
    • Conduct regular security awareness training for all users.

Remember, no single measure can provide complete protection against sophisticated attacks like NoPac. A defense-in-depth strategy, combining multiple layers of security controls, is crucial for comprehensive protection.

Conclusion:

By leveraging two seemingly minor vulnerabilities, attackers can potentially compromise an entire domain with alarming ease. This underscores the critical importance of prompt patching, continuous monitoring, and a proactive approach to security.

Further Reading:

For those interested in diving deeper into this topic, I recommend exploring:

Frequently Asked Questions:

Q: How quickly should organizations patch for NoPac vulnerabilities?

A: Organizations should treat these vulnerabilities as critical and apply patches as soon as possible, ideally within days of their release.

Q: Can NoPac be exploited remotely?

A: While initial access to the domain is required, once an attacker has standard domain user credentials, they can potentially exploit NoPac remotely.

Q: Are there any signs that might indicate a NoPac attack has occurred?

A: Signs may include unexpected computer account name changes, unusual service ticket requests. However, skilled attackers will attempt to cover their tracks.

Q: Can NoPac be mitigated without applying patches?

A: While patching is the most effective mitigation, other measures like restricting user permissions and monitoring Active Directory events can help reduce the risk. However, these should be considered temporary measures until patching can be completed.

Q: How does NoPac compare to other Active Directory exploits?

A: NoPac is particularly dangerous due to its relative simplicity and the potential for rapid privilege escalation. Unlike some exploits that require specific misconfigurations, NoPac could potentially affect any unpatched Active Directory environment.


Next: Understanding SeLoadDriverPrivilege Escalation: A Deep Dive