CVE-2021-42287: Kerberos KDC PAC Validation Impersonation (noPac Part 2)

HERMES

HERMES THREAT SCORE & KERBEROS KDC IMPERSONATION

Target: Microsoft Active Directory Kerberos KDC (kdcsvc.dll / lsass.exe)

Confidence: 99%

93 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 19 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 17 / 20

Prevalence 20 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2021-42287 at 8.8 (HIGH, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns 93 (HIGH) reflecting instant enterprise domain takeover when combined with CVE-2021-42278.

🕸️ Connected Knowledge Graph & Provenance

CVE-2021-42287: Kerberos KDC PAC Validation Impersonation (noPac)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTPaperCut MF/NG

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in PaperCut MF/NG documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Active Directory Domain Seizure: noPac Completion

CVSS v3.1: 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) / CWE-287: Improper Authentication. In CISA KEV since April 19, 2022. Pairs with CVE-2021-42278 to allow instantaneous domain takeover by coercing the KDC into issuing a PAC signed as the Domain Controller.

Executive Summary

CVE-2021-42287 is an authentication validation bypass within the Kerberos Key Distribution Center (KDC) running on Microsoft Active Directory Domain Controllers. When a Service Ticket (TGS) is requested for a service whose account name cannot be resolved, the KDC automatically appends a trailing $ character and performs a second lookup. By acquiring a TGT under a spoofed name (CVE-2021-42278) and renaming the account back before requesting the TGS, an attacker forces the KDC to issue a ticket identifying them as the Domain Controller itself.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2021-42287	Microsoft Security Response Center (MSRC) & CISA KEV
Affected Product	microsoft:windows	Active Directory Domain Controllers (Windows Server)
Vulnerable Component	Kerberos KDC (kdcsvc.dll / lsass.exe)	S4U2self Ticket Generation & PAC Verification
Weakness Class	CWE-287: Improper Authentication	Kerberos Ticket Confusion / Identity Spoofing
CVSS v3.1 Score	8.8 (HIGH / Hermes Score 93)	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remediation Updates	KB5008102, KB5008380	Cumulative Windows Server Security Releases
MITRE ATT&CK	T1558.003 - Kerberoasting, T1558 - Steal or Forge Kerberos Tickets	Credential Access / Privilege Escalation
Chained Campaign	AI-Orchestrated PaperCut Campaign	Automated domain admin acquisition

---

2. In-Depth Technical Decomposition & Root Cause

The flaw resides in how the Kerberos Key Distribution Center (kdcsvc.dll) handles fallback lookup when resolving target principal names during Ticket-Granting Service (TGS) processing:

// Decompiled representation of KDC principal resolution fallback (pre-patch)
KDC_STATUS KdcFindAccountByPrincipalName(UNICODE_STRING *principal_name, PKDC_ACCOUNT *out_account) {
    KDC_STATUS status = SamLookupAccount(principal_name, out_account);

    /* VULNERABILITY (CVE-2021-42287):
     * If the account is not found, the KDC assumes it might be a machine account
     * requested without the trailing '$'. It automatically appends '$' and queries again.
     * When an attacker requested a TGT as 'DC01' (via CVE-2021-42278) and renamed the account,
     * the KDC resolves 'DC01' -> 'DC01$' and generates a PAC for the Domain Controller! */
    if (status == KDC_STATUS_NO_SUCH_USER && !EndsWithDollar(principal_name)) {
        UNICODE_STRING machine_name = AppendDollar(principal_name);
        status = SamLookupAccount(&machine_name, out_account);
    }
    return status;
}

By requesting an S4U2self ticket using the TGT obtained under the spoofed name DC01, the KDC treats the request as originating from DC01$ (the Domain Controller machine account). The resulting ticket contains group memberships for Domain Admins and Enterprise Admins.

---

3. Attack Scenarios & noPac Chain

1. Name Spoofing (CVE-2021-42278): Attacker creates machine$ and renames it to DC01.
2. TGT Acquisition: Attacker requests a Kerberos TGT for DC01.
3. Name Restoration: Attacker renames DC01 back to machine$.
4. TGS Request (CVE-2021-42287): Attacker uses the TGT for DC01 to request a service ticket for krbtgt or CIFS.
5. KDC Fallback: KDC cannot find DC01, appends $, and issues a TGS as DC01$.
6. Full Domain Seizure: With Domain Admin tickets, attacker performs DCSync and extracts all domain hashes.

---

4. Forensic Detection & Log Signatures

Inspect Domain Controller Event Logs:

• Event ID 4768 (A Kerberos authentication ticket (TGT) was requested): Check for TGT requests where the account name matches a DC but omits $.
• Event ID 4769 (A Kerberos service ticket was requested): Look for S4U2self requests where the service name and client name reflect machine account mismatch.

---

5. Remediation Guidelines

1. Install Cumulative Updates: Apply KB5008380 across all Domain Controllers.
2. Verify PAC Validation: Ensure registry key PacRequestorEnforcement is set to 2 (Full Enforcement).
3. Cross-Reference: Read our report on the AI-Orchestrated PaperCut Campaign.