PrintNightmare
CVE-2021-1675 & CVE-2021-34527
Last updated
Was this helpful?
CVE-2021-1675 & CVE-2021-34527
Last updated
Was this helpful?
The Print Spooler is a Microsoft built-in service that manages printing jobs. It is enabled by default and runs within the SYSTEM context.
3 RPC protocols are registered by the spooler:
MS-RPRN: Microsoft’s Print System Remote Protocol. It defines the communication of print job processing and print system management between a print client and a print server synchronously.
MS-PAR: Microsoft’s Print System Asynchronous Remote Protocol. It has the same functionalities as MS-RPRN, but works asynchronously.
MS-PAN: Microsoft’s Print System Asynchronous Notification Protocol. It is used to receive print status notifications from a print server and to send server-requested responses to those notifications back to the server.
"PrintNightmare" refers to an RCE (Remote Command Execution) vulnerability. If the vulnerable machine is configured to reject remote connection, this vulnerability could still be exploited in an LPE (Local Privilege Escalation) context.
In a detailed blogpost (), Cyberwatch describes that the vulnerability lies in the functions allowing remote driver installation by users, RpcAddPrinterDriverEx and RpcAddPrinterDriver:
The attacker stores the driver DLL file on a SMB share reachable from the server.
The client creates a object containing the path to the attacker's DLL and passes it into the DRIVER_CONTAINER object.
The client calls with the DRIVER_CONTAINER to load the attacker's DLL into the server's dynamic library and with multiple bit values within the dwFileCopyFlags in order to bypass the SeLoadDriverPrivilege privilege verification by the server.
The attacker's DLL is executed on the server within SYSTEM context.
From Unix-like systems, the attack can be conducted as follows
Profit from the DLL being executed by the target
As stated on Twitter, there are some constraints depending on the protocol used for the attack.
Check if the target's RPC pipes are available: Impacket's
Generate a DLL payload:
Host an SMB server from which the DLL can be fetched: Impacket's
Exploit PrintNightmare: CVE-2021-1675.py (, )
From Windows systems, the attack can be conducted in an LPE or RCE context with the following PoC: .
