PT-2021-5121 · Microsoft+1 · Windows Server+3

Andrew Bartlett · Published 2021-11-09 · Updated 2026-03-10 · CVE-2021-42287

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions prior to the patchday that contains the fix for the vulnerability

Description The issue is related to an elevation-of-privilege vulnerability in Microsoft Active Directory Domain Services. This vulnerability is associated with insecure privilege management, which can be exploited by a remote attacker to elevate their privileges. The vulnerability is linked to the Privilege Attribute Certificate (PAC) in the Kerberos authentication protocol, which stores additional user authorization information. Microsoft updated the PAC by adding two new data structures, PAC ATTRIBUTES INFO and PAC REQUESTOR, to address this issue. The PAC REQUESTOR structure checks the username in the ticket, which is resolved to a SID included in the PAC. As a result, any ticket without the new PAC structure (or a ticket for a non-existent user) will be rejected if the update is installed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

ALT-PU-2022-2581

ALT-PU-2022-2677

ALT-PU-2022-2866

ALT-PU-2022-2892

ALT-PU-2023-1656

ALT-PU-2024-14683

BDU:2021-05914

CVE-2021-42287

Affected Products

Alt Linux

Active Directory Domain Services

Windows Server

Windows

References · 91

• 🔥 https://github.com/cube0x0/noPac · Exploit
• 🔥 https://github.com/knightswd/NoPacScan · Exploit
• 🔥 https://github.com/ricardojba/Invoke-noPac · Exploit
• 🔥 https://github.com/XiaoliChan/Invoke-sAMSpoofing · Exploit
• 🔥 https://github.com/TryA9ain/noPac · Exploit
• 🔥 https://github.com/waterrr/noPac · Exploit
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-42287 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42287 · Security Note
• https://bdu.fstec.ru/vul/2021-05914 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-42287 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42287 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42287 · Vendor Advisory
• https://t.me/redteambro/79 · Telegram Post
• https://t.me/win_def/61 · Telegram Post