safebuffer/sam-the-admin

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1067 stars · 191 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Python CLI exploit tool that chains CVE-2021-42278 and CVE-2021-42287 to impersonate a Domain Admin from a standard Active Directory domain user via sAMAccountName spoofing. It is a red-team weaponization of the s4u2self Kerberos technique.

Use cases

• escalate from standard domain user to domain admin in Active Directory
• exploit CVE-2021-42278 and CVE-2021-42287 during a penetration test
• demonstrate sAMAccountName spoofing in a lab environment
• test whether domain controllers are patched against the sAMAccountName spoofing chain
• red team assessment of Active Directory privilege escalation paths

When to choose

• you are a red teamer or pentester testing unpatched Active Directory domain controllers
• you need a ready-made weaponized exploit for CVE-2021-42278/42287
• you run Kali Linux and want a quick privilege escalation PoC

When to avoid

• your domain controllers are patched for CVE-2021-42278/42287
• you need a supported tool with a license or ongoing maintenance
• you are not on Kali Linux, since the tool is known to break elsewhere
• you want defensive or detection tooling rather than an offensive exploit

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing developer-tools python cli active-directory kerberos privilege-escalation redteam exploit cve-2021-42278 cve-2021-42287 s4u2self samaccountname-spoofing linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="safebuffer/sam-the-admin")