Introduction

Per Microsoft, “A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights“.

To better understand the PrintNightmare vulnerability (or any vulnerability), you should get into the habit of researching the vulnerabilities by reading Microsoft articles on any Windows-specific CVE or browsing through the Internet for community and vendor blogposts.

There has been some confusion if the CVE-2021-1675 and CVE-2021-34527 are related to each other. They go under the same name: Windows Print Spooler Remote Code Execution Vulnerability and are both related to the Print Spooler.

As Microsoft states in the FAQ, the PrintNightmare (CVE-2021-34527) vulnerability “is similar but distinct from the vulnerability that is assigned CVE-2021-1675. The attack vector is different as well.”

What did Microsoft mean by the attack vector? To answer this question, let’s look into the differences between the two vulnerabilities and append the timeline of events.

Per Microsoft’s definition, PrintNightmare vulnerability is “a remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”.

Running arbitrary code involves executing any commands of the attacker’s choice and preference on a victim’s machine.
Suppose you had a chance to look at both CVE’s on Microsoft. You would notice that the attack vectors for both are different.

To exploit the CVE-2021-1675 vulnerability, the attacker would need to have direct or local access to the machine to use a malicious DLL file to escalate privileges. To exploit the CVE-2021-34527 vulnerability successfully, the attacker can remotely inject the malicious DLL file.

Get OSCP Certificate Notes

Challenge Answers

Where would you enable or disable Print Spooler Service?
Provide the CVE of the Windows Print Spooler Remote Code Execution Vulnerability that doesn’t require local access to the machine.

What date was the CVE assigned for the vulnerability in the previous question? (mm/dd/yyyy)

What is the flag residing on the Administrator’s Desktop?
Provide the first folder path where you would likely find the dropped DLL payload.

Provide the function that is used to install printer drivers.

What tool can the attacker use to scan for vulnerable print servers?

Provide the name of the dropped DLL, including the error code. (no space after the comma)
svch0st.dll,0x45A
Provide the event log name and the event ID that detected the dropped DLL. (no space after the comma)
Microsoft-Windows-PrintService/Admin,808

Find the source name and the event ID when the Print Spooler Service stopped unexpectedly and how many times was this event logged? (format: answer,answer,answer)

Service Control Manager,7031,1
After some threat hunting steps, you are more confident now that it’s a PrintNightmare attack. Hunt for the attacker’s shell connection. Provide the log name, event ID, and destination port. (format: answer,answer,answer)
Microsoft-Windows-Sysmon/Operational,3,4747

Oh no! You think you’ve found the attacker’s connection. You need to know the attacker’s IP address and the destination hostname in order to terminate the connection.  Provide the attacker’s IP address and the hostname. (format: answer,answer)

10.10.210.100,ip-10-10-210-100.eu-west-1.compute.internal

A Sysmon FileCreated event was generated and logged. Provide the full path to the dropped DLL and the earliest creation time in UTC.  (format:answer,yyyy-mm-dd hh-mm-ss)

C:\Windows\System32\spool\drivers\x64\3\New\svch0st.dll,2021-08-13 17:33:40
What is the host name of the domain controller?
win-1O0UJBNP9G7

What is the local domain?

printnightmare.local

What user account was utilized to exploit the vulnerability?

lowprivlarry

What was the malicious DLL used in the exploit?

letmein.dll

What was the attacker’s IP address?

10.10.124.236

What was the UNC path where the malicious DLL was hosted?

\10.10.124.236\sharez

There are encrypted packets in the results. What was the associated protocol?

SMB3
Provide two ways to manually disable the Print Spooler Service. (format: answer,answer)
powershell, group policy

Where can you disable the Print Spooler Service in Group Policy? (format: no spaces between the forward slashes)

Computer Configuration/Administrative Templates/Printers

Provide the command in PowerShell to detect if Print Spooler Service is enabled and running.

Get-Service -Name Spooler

Video Walk-Through

Get Cyber Security Field Notes By Joining My YouTube Channel Membership

About the Author

Mastermind Study Notes is a group of talented authors and writers who are experienced and well-versed across different fields. The group is led by, Motasem Hamdan, who is a Cybersecurity content creator and YouTuber.

View Articles