NoPAC / sAMAccountName Spoofing

NoPAC chains CVE-2021-42278 and CVE-2021-42287 against domain controllers that lack the corresponding hardening. An authenticated domain user who can control a computer account (commonly by creating one when MachineAccountQuota is positive) changes its sAMAccountName to a domain controller's short name without the trailing $. The attacker obtains a TGT for that account, restores the controlled account's name, then requests an S4U2Self service ticket. On a vulnerable KDC, the name-resolution fallback and PAC/requestor handling can cause the ticket to be issued as the matching DC computer account for a selected user. The resulting ticket can enable service access according to the target service and privileges; creating a ticket alone does not perform DCSync or start a shell.