⬇ Download holy card: ·
⚔ Commemorated today: The Scourge of SUNBURST (2020)Saint noPac, Who Passed Himself Off as the Domain Controller
Patron of Active Directory, machine accounts, and everyone who forgets the dollar sign.
Life
In December 2021 the first public exploits appeared for noPac, the pairing of CVE-2021-42278 and CVE-2021-42287. All it took was to create a machine account, rename it like a domain controller without the trailing dollar, and abuse the way the KDC retried its lookup: a service ticket was then issued for the controller's far more powerful account. From ordinary user to domain admin in a few steps, with ransomware in reach.
Prayer
O Saint noPac, who introduces yourself to the domain under its keeper's name, let our controllers distrust namesakes. Amen.
How to celebrate
Celebrated by installing Microsoft's KBs and limiting who may create machine accounts in the domain.
One dollar short, one domain too many.