{"id":17992,"date":"2022-02-02T10:18:53","date_gmt":"2022-02-02T18:18:53","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11725\/"},"modified":"2022-02-02T10:18:53","modified_gmt":"2022-02-02T18:18:53","slug":"news-11725","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11725\/","title":{"rendered":"From User to Domain Admin in (less than) 60 seconds: CVE-2021-42278\/CVE-2021-42287"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Threat\u00a0Research Report<\/h2>\n

Affected Platforms:<\/b> Windows
Impacted Users: <\/b>Any organization with an Active Directory environment
Impact: <\/b>Unprivileged user can escalate privileges to domain administrator
Severity Level: <\/b>Critical
\u00a0<\/p>\n

On Patch Tuesday of last November, Microsoft released advisories to address several vulnerabilities in Active-Directory. Analysis of these vulnerabilities showed that by combining CVE-2021-42278 and CVE-2021-42287 it is possible, under default conditions, for a regular user to easily impersonate a domain admin. This means that any domain user can effectively become a domain administrator, which makes these vulnerabilities extremely severe. Moreover, there are already several Github repositories with free-to-use PoC code that facilitates the exploitation of these vulnerabilities.<\/p>\n

In this post, we will describe how the exploitation of these vulnerabilities works and show how the attack is mitigated by FortiEDR.<\/p>\n

CVE-2021-42278 – Invalid Computer Account Name<\/h2>\n

Computer account names in Active Directory environments should always end with \u201c$\u201d, however, this is not enforced correctly. The computer account name attribute is \u201csAMAccountName\u201d. It is possible to see and edit the this attribute manually using the ADSIEdit Tool, as can be seen in Figure 1.\u00a0 <\/p>\n<\/p><\/div>\n