A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Between June 2021 and January 2022, three vulnerabilities were disclosed that each independently allow domain compromise from a standard user account or even unauthenticated access. NoPac (CVE-2021-42278/42287). PrintNightmare (CVE-2021-34527). PetitPotam (CVE-2021-36942). If your target hasn't patched all three, you're looking at a five-minute path to Domain Admin.
Vulnerability Profile
SamAccountName Spoofing. Allows authenticated users to rename a computer account to match a Domain Controller's name, then request Kerberos tickets that impersonate the DC. Combined with CVE-2021-42287 (PAC validation bypass), this grants Domain Admin from any standard domain user.
MachineAccountQuota of 10 means any authenticated user can add 10 computer accounts to the domain. The scanner confirms the DC is vulnerable: it issued a TGT with a PAC for our fake machine account. If the ticket sizes differ (one with PAC, one without), the system is exploitable.
PetitPotam coerces the DC to authenticate to your attack host via MS-EFSRPC. Your ntlmrelayx.py instance (already running, targeting the AD CS web enrollment URL) catches that authentication and requests a certificate for the DC's machine account. That certificate gets you a TGT. That TGT gets you DCSync. Unauthenticated. No credentials needed at any point.
These exploits can destabilize production environments. PrintNightmare can crash the print spooler service. NoPac creates and (attempts to) delete machine accounts. PetitPotam generates authentication traffic that looks like a DC compromise to any monitoring system. Get written approval. Document everything. Have a rollback plan.
Three CVEs. Three paths to Domain Admin. All disclosed within seven months of each other. All patched. All still found in production environments years later because patch management in large enterprises is slow and painful. Check for these on every engagement. They're low-effort, high-reward, and the client will thank you for finding them before a real attacker does.
Finish the lesson once you have worked through the material. This awards ★ 50 XP.