NetExec SMB NoPAC

Check for and exploit the NoPAC (CVE-2021-42278/42287) Kerberos privilege escalation vulnerability

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Privilege Escalation / Trust Attacks
Platform: linux
Requires: password
Protocols: SMB, KERBEROS

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M nopac

Examples

nxc smb '192.168.1.100' -u 'user' -p 'password' -M nopac

Tags

nxc smb nopac cve-2021-42278 cve-2021-42287 privilege-escalation kerberos

Impacket PSExec Execute commands via PSExec service
Impacket Secrets Dump Dump hashes from remote Windows system (SAM, LSA, NTDS)
Impacket goldenPac (MS14-068) Exploit MS14-068 Kerberos privilege escalation to obtain Domain Admin via forged PAC
Impacket LookupSID Enumerate domain SIDs and discover trust relationships via SID brute-forcing
Impacket raiseChild Escalate from child domain DA to forest root DA via inter-realm Kerberos trust
Inter-Realm Golden Ticket Forge a cross-domain Golden Ticket to escalate from child to parent domain
LDAPSearch Shadow Principals (PAM Trust) Enumerate msDS-ShadowPrincipal objects to identify PAM trust shadow principals
NetExec LDAP Raise Child Escalate from child domain DA to forest root DA via inter-realm Kerberos trust abuse