cube0x0/noPac

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1412 stars · 314 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A C# tool that scans for and exploits the CVE-2021-42287/CVE-2021-42278 Active Directory vulnerability chain, allowing a standard domain user to escalate to domain admin on unpatched Domain Controllers. It detects vulnerable controllers by requesting a TGT without a PAC and then performs the privilege escalation exploit.

Use cases

• scan domain controllers for CVE-2021-42287/CVE-2021-42278 vulnerability
• escalate from domain user to domain admin on unpatched Active Directory
• test whether domain controllers have the December 2021 patches applied
• request a TGT without a PAC to identify vulnerable Kerberos setups
• demonstrate impact of missing domain controller patches during penetration tests

When to choose

• you are pentesting or red-teaming a Windows Active Directory environment and need to check or exploit the sAMAccountName spoofing chain
• you want a single C# binary that both scans for and exploits CVE-2021-42287/CVE-2021-42278
• you need a quick proof-of-concept to convince admins to patch their domain controllers

When to avoid

• your domain controllers are patched against CVE-2021-42287/CVE-2021-42278
• you need a maintained tool with ongoing support - the project has had no releases since December 2021 and no license
• you are looking for a general-purpose AD security auditing tool rather than a targeted exploit
• licensing restrictions matter, since the repository has no license and reuse is not explicitly permitted

Facets

cli-tool · maturity maintenance

penetration-testing security vulnerability-scanning security penetration-testing windows dotnet cli active-directory domain-escalation cve-2021-42287 cve-2021-42278 kerberos privilege-escalation exploit domain-controller c-sharp red-team

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cube0x0/noPac")