Because I’m going to be playing with unpatched machines in the HackTheBox lab, the various POCs I’m showing will work without much issue. The story continues to change daily…There was a patch released on July 6, and I’ll discuss that a but in the Mitigrations section at the end of the post. huIghjwTFq- Will Dormann July 7, 2021įor a larger version of that image, click here. NoWarningNoElevationOnUpdate, but I think it doesn't matter much as I just have both for now. There's a small disagreement between me and MSRC at the moment about UpdatePromptSettings vs. This is my current understanding of the #PrintNightmare exploitability flowchart. At the time of this post, they best flowchart to determine if the exploit will work is from this tweet: On July 6, Microsoft issued an out-of-band update (not on Patch Tuesday), but it’s unclear based on the discussions on Twitter as to if this patch fully remediates the issue. Microsoft later updated the patch for CVE-2021-1675 (and updated the class from a privilege escalation to remote code execution) on July 2. The researchers later took down their exploit, but once something had hit the internet, the damage had been done. Seeing this patch, researchers in China were working on a proof of concept for a very similar bug in the print spooler, and on seeing the patch, they published their exploit on GitHub.

Microsoft released a patch for a Windows Print Spooler Remote Code Execution Vulnerability on June 8, 2021, known as CVE-2021-1675. The history on this bug is kind of interesting. I’ll also look at disabling the Print Spooler and how it breaks the exploits, and discuss the July 6 patch.

There are a few proof of concept exploits out there, and I wanted to give them a spin an old HackTheBox machine. This is especially bad because it is not uncommon for Domain Controllers to have an exposed print spooler, and thus, this exploit can take an attacker from low-priv user to domain admin. CVE-2021-34527, or PrintNightmare, is a vulnerability in the Windows Print Spooler that allows for a low priv user to escalate to administrator on a local box or on a remote server.

Lansweeper printnightmare