@@ -0,0 +1,1856 @@
+# Credit to https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html%0A#%C2%A0@exploitph @Evi1cg%0A# module by @mpgn_x64%0A%0Afrom binascii import unhexlify%0Afrom impacket.krb5.kerberosv5 import getKerberosTGT%0Afrom impacket.krb5 import constants%0Afrom impacket.krb5.types import Principal%0A%0Aclass CMEModule:%0A%0A    name = 'nopac'%0A    description = %22Check if the DC is vulnerable to CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user%22%0A    supported_protocols = %5B'smb'%5D%0A    opsec_safe = True%0A    multiple_hosts = True%0A%0A    def options(self, context, module_options):%0A        '''%0A        '''     %0A%0A    def on_login(self, context, connection):%0A%0A        userName = Principal(connection.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)%0A        tgt_with_pac, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, connection.password, connection.domain,%0A                                                                unhexlify(connection.lmhash), unhexlify(connection.nthash), connection.aesKey,%0A                                                                connection.host,requestPAC=True)%0A        context.log.highlight(%22TGT with PAC size %22 + str(len(tgt_with_pac)))%0A        tgt_no_pac, cipher, oldSessionKey, sessionKey = getKerberosTGT(userName, connection.password, connection.domain,%0A                                                                unhexlify(connection.lmhash), unhexlify(connection.nthash), connection.aesKey,%0A                                                                connection.host,requestPAC=False)%0A        context.log.highlight(%22TGT without PAC size %22 + str(len(tgt_no_pac)))%0A        if len(tgt_no_pac) %3C len(tgt_with_pac):%0A            context.log.highlight(%22%22)%0A            context.log.highlight(%22VULNEABLE%22)%0A            context.log.highlight(%22Next step: https://github.com/Ridter/noPac%22)

Add nopac module