We covered the Print Nightmare Exploit from a defensive perspective where we performed an incident response and extracted the related artifacts to the exploit using Wireshark, Brim and Windows event viewer. This was part of TryHackMe Printermare room.
Understanding Denial of Service (DoS) Attacks
I learned that a Denial of Service (DoS) attack aims to make a machine or network resource unavailable to its intended users. This is typically achieved by temporarily or indefinitely disrupting services of a host connected to the internet.
The video specifically focused on Slowloris, which is a type of DoS attack tool. It works by opening many partial HTTP connections to a target web server and keeping them open for as long as possible. This ties up the server’s resources, eventually making it unable to accept new connections from legitimate users.
How Slowloris Works
I understood that Slowloris operates by:
- Sending a complete HTTP request, but not a complete one. It sends a partial request, like just the headers, and then slowly sends additional headers at regular intervals.
- This makes the server wait for the rest of the request to arrive.
- By doing this with many concurrent connections, Slowloris exhausts the server’s connection pool. Once the server runs out of available connections, it can no longer serve legitimate users, leading to a denial of service.
The attack is effective because it uses minimal bandwidth from the attacker’s side and can be executed from a single machine. It’s particularly effective against web servers that rely on a limited number of worker threads or processes to handle connections.
Practical Demonstration and Technical Commands
The video demonstrated how to use Slowloris, including setting up a test environment.
Setting up a Test Environment (Implied Commands/Actions):
- I would need a Kali Linux machine (attacker) and a Windows Server (target) with IIS (Internet Information Services) installed.
- I’d configure the firewall on the Windows Server to allow HTTP traffic on port 80.
Using Slowloris:
- Downloading Slowloris:
- I’d typically clone it from a GitHub repository.
- Command:
git clone https://github.com/gkbrk/slowloris.git(This command was not explicitly shown but is the standard way to get it). - Then, I would navigate into the cloned directory:
cd slowloris.
- Running Slowloris:
- The basic command to launch a Slowloris attack is:
python3 slowloris.py <target_IP_address>- Example:
python3 slowloris.py 10.10.10.100(assuming10.10.10.100is the target IP).
- Example:
- The basic command to launch a Slowloris attack is:
- Monitoring the Attack:
- On the attacker machine, the Slowloris script would show output indicating the number of open connections.
- On the target Windows Server, I would monitor the Task Manager (specifically the “Performance” tab or “Resource Monitor”) to observe the CPU and memory usage, and the number of active HTTP connections. I’d expect to see a significant increase in connections and potentially high resource utilization as the attack progresses.
- I’d also try to access the web server from another machine to confirm the denial of service.
To better understand the PrintNightmare vulnerability (or any vulnerability), you should get into the habit of researching the vulnerabilities by reading Microsoft articles on any Windows-specific CVE or browsing through the Internet for community and vendor blogposts.
There has been some confusion if the CVE-2021-1675 and CVE-2021-34527 are related to each other. They go under the same name: Windows Print Spooler Remote Code Execution Vulnerability and are both related to the Print Spooler.
As Microsoft states in the FAQ, the PrintNightmare (CVE-2021-34527) vulnerability “is similar but distinct from the vulnerability that is assigned CVE-2021-1675. The attack vector is different as well.”
What did Microsoft mean by the attack vector? To answer this question, let’s look into the differences between the two vulnerabilities and append the timeline of events.
Per Microsoft’s definition, PrintNightmare vulnerability is “a remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”.
Running arbitrary code involves executing any commands of the attacker’s choice and preference on a victim’s machine.
Suppose you had a chance to look at both CVE’s on Microsoft. You would notice that the attack vectors for both are different.
To exploit the CVE-2021-1675 vulnerability, the attacker would need to have direct or local access to the machine to use a malicious DLL file to escalate privileges. To exploit the CVE-2021-34527 vulnerability successfully, the attacker can remotely inject the malicious DLL file.
What date was the CVE assigned for the vulnerability in the previous question? (mm/dd/yyyy)
What date was the CVE assigned for the vulnerability in the previous question? (mm/dd/yyyy)
Provide the function that is used to install printer drivers.
What tool can the attacker use to scan for vulnerable print servers?
Find the source name and the event ID when the Print Spooler Service stopped unexpectedly and how many times was this event logged? (format: answer,answer,answer)
Oh no! You think you’ve found the attacker’s connection. You need to know the attacker’s IP address and the destination hostname in order to terminate the connection. Provide the attacker’s IP address and the hostname. (format: answer,answer)
What is the local domain?
What user account was utilized to exploit the vulnerability?
What was the malicious DLL used in the exploit?
What was the attacker’s IP address?
What was the UNC path where the malicious DLL was hosted?
There are encrypted packets in the results. What was the associated protocol?
Where can you disable the Print Spooler Service in Group Policy? (format: no spaces between the forward slashes)
Provide the command in PowerShell to detect if Print Spooler Service is enabled and running.
