Permissions, Privileges, and Access Controls in Windows Server - CVE-2021-42287

Vulnerability details

The vulnerability allows a remote authenticated attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Active Directory Domain Services, which leads to security restrictions bypass and privilege escalation.

Affected software

How to mitigate CVE-2021-42287

Links to Public Exploits and PoC-codes

• Exploit #9329 - sam-the-admin (Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user ) (September 18, 2023)
• Exploit #8844 - Invoke-noPac (.Net Assembly loader for the [CVE-2021-42287 - CVE-2021-42278] Scanner & Exploit noPac) (February 16, 2023)
• Exploit #8694 - noPac (CVE-2021-42287/CVE-2021-42278 Exploiter) (December 25, 2022)
• Exploit #7577 - Invoke-sAMSpoofing (CVE-2021-42287/CVE-2021-42278 exploits in powershell) (April 3, 2022)
• Exploit #7354 - NoPacScan (NoPacScan is a CVE-2021-42287/CVE-2021-42278 Scanner,it scan for more domain controllers than other script) (February 16, 2022)
• Exploit #7170 - Pachine (Python implementation for CVE-2021-42278 (Active Directory Privilege Escalation)) (December 14, 2021)
• Exploit #7161 - noPac (Exploiting CVE-2021-42278 and CVE-2021-42287) (December 13, 2021)
• Exploit #7154 - noPac (Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user ) (December 13, 2021)
• Exploit #7148 - sam-the-admin (Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user ) (December 12, 2021)
• Exploit #7140 - noPac (CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.) (December 12, 2021)

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42287

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Active Directory Domain Services