# sAMAccountName Spoofing in the Forest

### Description

Parent domain can be compromised from a user of the child domain using the `noPac.exe` (sAMAccountName spoofing exploit) is written by cube0x0. I notice that he didn't refer example command to compromise the parent domain. 

{% hint style="info" %}
**Forest Information**

unsafe.local = parent domain

gotham.unsafe.local = child domain

user1 = user of the gotham domain
{% endhint %}

For above scenario, you must set `-dc` parameter as a domain controller of the parent domain without specifying `-domain` parameter because if you specify a parent domain name with the credentials of a child domain user, invalid credentials error occurs in the `NetworkCredential` class. 

![](https://1825299558-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MOWsiA3y7BsN5oohlsn%2Fuploads%2FsLmIKoXLnf0A8LBXf9bk%2F7.JPG?alt=media\&token=fcba36a5-b00e-4273-826f-654cea7e3567)

If you specify the child domain name, a machine account will be added to `gotham.unsafe.local` by the noPac exploit and it fails our objective. So `NetworkCredential.argDomain` should be empty. Username and password are enough to connect parent DC successfully. (trust relations) We can see this adding line 399.

![](https://1825299558-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MOWsiA3y7BsN5oohlsn%2Fuploads%2F9KgpQR7ATphxBDeHynQV%2F14.JPG?alt=media\&token=92c6d91d-9784-4007-a60b-83fb1bcda661)

The domain name that is required for adding a machine will be extracted from the specified DC name (line 421).

![](https://1825299558-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MOWsiA3y7BsN5oohlsn%2Fuploads%2F49vMqauKCNO80JTTiyuY%2F12.JPG?alt=media\&token=b7d84a77-0dc0-4975-bf24-4b1f10922a9e)

{% code title="Commands" %}

```
noPac.exe -user [child-user] -pass [pass] -dc [parent-dc] -mAccount [machine-name] -mPassword [machine-pass] -service cifs -ptt
dir \\parent-dc\c$
```

{% endcode %}

![](https://1825299558-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MOWsiA3y7BsN5oohlsn%2Fuploads%2Fn5sXtHXeIA9MCY50xNXu%2F13.JPG?alt=media\&token=ed620896-1068-4324-afdd-b98b68a861a9)

<pre><code><strong># Author: Metin Yunus Kandemir
</strong></code></pre>

### Reference

<https://github.com/cube0x0/noPac>