sAMAccountName Impersonation Class (CVE-2021-42278 / CVE-2021-42287)

This is a naming-and-PAC lab for defenders, not noPac. Target is a lab domain where I am allowed to create a computer object (the default ms-DS-MachineAccountQuota is 10; I treat that quota as part of the threat model). Goal: capture 4742 (computer changed) and 4768 (TGT issued) from a benign rename of a lab computer I own, then write down what the 2021 CVEs changed about sAMAccountName and PAC validation. I do not rename a machine to a DC’s short name, I do not request a TGT for dc01 without $, I do not chain 42278+42287.

1Figure 1. The KDC must reject names that impersonate other principals and must bind PAC to the requester.
24742 computer rename (sAMAccountName ends $)
34768 TGT for labpc01b$  etype 0x12  result 0

Lab layout

1labs/nopac_lab/          # directory name is historical; no exploit inside
2  4742.txt
3  4768.txt
4  quota.txt
5  hotfix.txt

1C:\lab> whoami
2lab\labuser
3
4C:\lab> net accounts /domain | findstr /i "lock"
5# not relevant; quota is an AD attribute:
6
7C:\lab> powershell -NoP -C "(Get-ADObject (Get-ADRootDSE).defaultNamingContext -Properties ms-DS-MachineAccountQuota).'ms-DS-MachineAccountQuota'"
810

Quota 10 means a standard user can create computer objects. That is the pre-condition the 2021 class used. I do not need to abuse it to file “quota is 10”.

Artifact: 4742 on a benign rename

I created LAB\labpc01$ with a privileged account, then renamed its display attributes in a supported way (Rename-Computer to labpc01b on the member). 4742 on the DC:

 1Event 4742  A computer account was changed.
 2Subject:
 3  Security ID:          S-1-5-21-[REDACTED]-1001
 4  Account Name:         labuser
 5  Account Domain:       LAB
 6  Logon ID:             0x[REDACTED]
 7Computer Account That Was Changed:
 8  Security ID:          S-1-5-21-[REDACTED]-1110
 9  Account Name:         labpc01b$
10  Account Domain:       LAB
11Changed Attributes:
12  SAM Account Name:     labpc01b$
13  Display Name:         LABPC01B
14  User Principal Name:  -
15  DNS Host Name:        labpc01b.lab.internal
16  Service Principal Names:
17        RestrictedKrbHost/labpc01b
18        RestrictedKrbHost/labpc01b.lab.internal
19        HOST/labpc01b
20        HOST/labpc01b.lab.internal
21  Additional Information:
22    Privileges:         -

What I require in this event for it to look normal:

SAM Account Name ends with $.
It does not equal a domain controller short name (DC01, DC01$ confusion).
Subject is either the machine itself, a join account, or an admin I know.
SPNs match the new DNS name.

The 2021 issue (CVE-2021-42278) was insufficient validation that a computer sAMAccountName was well-formed and not colliding with another principal in ways the KDC later trusted. I do not demonstrate the collision.

Artifact: 4768 for the same machine account

 1Event 4768  A Kerberos authentication ticket (TGT) was requested.
 2Account Information:
 3  Account Name:         labpc01b$
 4  Supplied Realm Name:  LAB.INTERNAL
 5  User ID:              S-1-5-21-[REDACTED]-1110
 6Service Information:
 7  Service Name:         krbtgt
 8  Service ID:           S-1-5-21-[REDACTED]-502
 9Network Information:
10  Client Address:       10.[REDACTED]
11  Client Port:          49212
12Additional Information:
13  Ticket Options:       0x40810010
14  Result Code:          0x0
15  Ticket Encryption Type: 0x12
16  Pre-Authentication Type: 2
17  Certificate Issuer Name: -
18  Certificate Serial Number: -
19  Certificate Thumbprint: -

Match row: Account Name labpc01b$ (with dollar), User ID equals the 4742 computer SID, etype AES256, preauth 2, result 0. That is a healthy machine TGT.

Anomalous 4768 I would escalate (and have not produced):

Account Name without $ that still maps to a computer SID.
Account Name equal to a DC / privileged user while Client Address is a workstation.
Result 0 immediately after a 4742 that stripped $ or copied a privileged sAMAccountName.

CVE-2021-42287: KDC did not adequately verify that the PAC in a TGS-REQ belonged to the requesting principal in a specific sequence. Combined with the naming bug, public reporting described domain-admin-equivalent PAC on unpatched DCs. I file “PAC must bind to requester” as the invariant. I do not request that TGS.

Patch and control verification

1C:\lab> wmic qfe get HotFixID,InstalledOn | findstr /i "5008602 5008601 5008380 5008452"
2KB5008380   11/10/2021
3# exact IDs depend on SKU; I record what is installed, then:
4
5C:\lab> powershell -NoP -C "Get-ADDomainController | Select Name,OperatingSystem,OperatingSystemVersion"
6Name  OperatingSystem       OperatingSystemVersion
7DC01  Windows Server 2019   10.0 (17763)

November 2021 updates plus the February 2022 enforcement phase are the historical line. On a 2026 image this is “is the DC build after those CUs”. I also check:

1# PAC validation / related:  Krbtgt and DC secure channel healthy
2C:\lab> nltest /sc_query:LAB
3Flags: 30 HAS_IP  HAS_TIMESERV
4Trusted DC Name \\dc01.lab.internal
5Trusted DC Connection Status Status = 0 0x0 NERR_Success

ms-DS-MachineAccountQuota → 0 if users must not join machines (the actual structural fix for “any user creates a computer”):

1C:\lab> powershell -NoP -C "Set-ADDomain (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'='0'}"
2# lab only; in production this is a change ticket

I ran it, then set it back to 10 on this lab so other notes still join. Production: 0, plus a dedicated join account with constrained rights.

Sanitized reproduction (failed rename / failed AS)

Attempt to set a computer sAMAccountName to a user name via a UI I do not have rights for:

1C:\lab> net user labpc01b$ /domain
2# not a user; expected
3
4# LDAP modify as labuser of sAMAccountName → "DC01"  (NOT executed as a working exploit)
5# result on a patched DC:
6Insufficient access / constraint violation
7# Event 4742 does not fire
8# LDAP error 19  (constraint)  or  50  (insufficientAccess)

I stop at the constraint error. That deny is the control.

Failed 4768 (unknown account), redacted:

1Event 4768
2  Account Name:         nosuchpc$
3  Result Code:          0x6     # KDC_ERR_C_PRINCIPAL_UNKNOWN
4  Client Address:       10.[REDACTED]

0x6 is not 42287. Do not mix unknown-principal with PAC-mismatch.

Crash analog: none in kernel. The closest is LSASS handling a malformed AS-REQ — I do not fuzz LSASS. I keep the constraint-violation LDAP error as the “loud fail”.

Computer-account SPN inventory after the rename

1C:\lab> setspn -L labpc01b$
2Registered ServicePrincipalNames for CN=labpc01b,CN=Computers,DC=lab,DC=internal:
3    RestrictedKrbHost/labpc01b.lab.internal
4    RestrictedKrbHost/labpc01b
5    HOST/labpc01b.lab.internal
6    HOST/labpc01b

SPNs still matching the old name (labpc01) after a 4742 are a hygiene finding, not 42278. SPNs matching HOST/DC01 on a workstation object are the impersonation class and I would page. I have not produced that row. Detection is a daily setspn -X (duplicate SPNs) plus a query for computer objects whose sAMAccountName does not end with $.

1# lab check, should return 0 rows
2Get-ADComputer -Filter * -Properties sAMAccountName |
3  Where-Object { $_.sAMAccountName -notlike '*$' } |
4  Select-Object Name, sAMAccountName

Mitigation

Patch DCs past the 2021-11 / 2022-02 PAC enforcement KBs (verify build, not a blog).
ms-DS-MachineAccountQuota=0 unless a join workflow needs it; then a dedicated OU + delegated join account.
Alert:
- 4742 where SAM Account Name does not end in $
- 4742 where new SAM equals a privileged user or DC name
- 4768 Account Name for a computer without $
- burst of computer creates from one user SID (quota burn)
dSHeuristics / PAC validation: do not disable PAC validation “for compatibility” without a named vendor ticket.

What I file after this lab

Quota was 10 (finding for a hardened domain)
4742: labpc01$ → labpc01b$, SPNs updated, subject labuser, SID [REDACTED]-1110
4768: Account Name labpc01b$, etype 0x12, preauth 2, result 0, same SID
Patched DC: constraint on a bad sAMAccountName, no 4742
Unknown nosuchpc$: 4768 result 0x6
Fix: CU on DCs, quota 0, 4742/4768 detections on name shape
Out of scope: noPac chain, TGT for a DC name, PAC editing

Commands appendix

1powershell -NoP -C "(Get-ADObject (Get-ADRootDSE).defaultNamingContext -Properties ms-DS-MachineAccountQuota).'ms-DS-MachineAccountQuota'"
2wevtutil qe Security /q:"*[System[(EventID=4742)]]" /c:1 /f:text
3wevtutil qe Security /q:"*[System[(EventID=4768)]]" /c:1 /f:text
4nltest /sc_query:LAB

Lab layout#

Artifact: 4742 on a benign rename#

Artifact: 4768 for the same machine account#

Patch and control verification#

Sanitized reproduction (failed rename / failed AS)#

Computer-account SPN inventory after the rename#

Mitigation#

What I file after this lab#

Commands appendix#