”CVE-2021-34527” PrintNightmare : From Local Privilege Escalation to Remote Domain Admin#

**Severity**:#

The exploit enables an attacker to execute arbitrary code and escalate privileges to SYSTEM level (which is the highest level on a machine). If the attacker compromises a Domain Controller (DC), they can escalate further to Domain Admin (DA) privileges, which gives them full control over the entire network.

2. Technical Overview of the Vulnerability#

How PrintNightmare Works:#

The Print Spooler vulnerability is related to how the Print Spooler service handles requests from users and how it interacts with printer drivers. Here’s what happens:

1. Malicious Request: The attacker sends a malformed request to the Print Spooler service, triggering the service to load a malicious printer driver. This request is crafted in a way that it overflows memory buffers or improperly handles inputs.
2. Buffer Overflow: The vulnerability allows for buffer overflow or other input validation failures, which results in the attacker’s code execution. The attacker can inject their own malicious payload into the Print Spooler’s memory space.
3. Privilege Escalation: The Print Spooler service runs with SYSTEM privileges. This means that once the attacker is able to exploit the vulnerability, they gain full control over the machine with SYSTEM-level access, which can then be used to escalate to Domain Admin if the attack is against a Domain Controller.

Key Points:#

• The Print Spooler service typically runs with high privileges on Windows machines.
• Exploiting this vulnerability can lead to Remote Code Execution (RCE).
• A low-privileged user can exploit the vulnerability, meaning it doesn’t require admin-level access to begin with.
• The attacker can execute arbitrary code, modify files, install malicious software, and gain remote access to the compromised system.

3. Lab Setup for Exploiting PrintNightmare#

Here’s how you could set up an environment to safely demonstrate PrintNightmare:

Tools and Components:#

• OS: Windows Server 2016/2019 or Windows 10 (unpatched versions).
• Attack Machine: Kali Linux or Windows machine with penetration testing tools installed.
  • Tools like Impacket, Mimikatz, PowerShell scripts, or PrintNightmare PoC exploit code.
• Vulnerable Service: The Print Spooler service must be enabled and unpatched.
• Target Machine: This can be either a workstation or Domain Controller (DC).

Preparation Steps:#

1. Ensure the Print Spooler service is running on the target machine.
   • Check using sc query spooler or Get-Service -Name Spooler on PowerShell.
2. Ensure the target is unpatched (use versions prior to July 2021).
3. Disable Windows Defender (if it interferes) and allow exploitation.
4. For testing, use a non-privileged user account to exploit the vulnerability.

4. Exploit Steps: From Local Privilege Escalation to Remote Domain Admin#

Step 1: Trigger the PrintNightmare Vulnerability#

To exploit CVE-2021-34527, an attacker would typically use a proof-of-concept (PoC) exploit code that targets the vulnerability in the Print Spooler service. These PoC exploits send specially crafted Print Spooler requests to cause the service to load a malicious driver.

Example with Impacket or PrintNightmare PoC exploit:

python3 [PrintNightmarePoC.py](http://printnightmarepoc.py/) <target-ip>

This will inject a malicious print driver into the Print Spooler, gaining the attacker SYSTEM-level privileges.

Step 2: Gain SYSTEM Privileges#

Once the malicious driver is loaded, the attacker gains SYSTEM-level access on the compromised machine. They can now execute arbitrary code or commands with full administrative privileges on the system.

At this point, the attacker can perform tasks such as:

• Installing additional tools for further exploitation.
• Collecting sensitive information such as passwords or configuration files.
• Dumping credentials from the system.

Step 3: Escalate to Domain Admin (DA) Privileges#

If the system is a Domain Controller, the attacker can use Pass-the-Hash or Kerberos ticket manipulation to escalate their privileges further:

1. Dumping credentials using Mimikatz: After gaining SYSTEM privileges, the attacker can run Mimikatz to dump the NTLM hashes and potentially extract clear-text passwords.

mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords"

1. Pass-the-Hash: If hashes are obtained, the attacker can use Pass-the-Hash attacks to authenticate as a higher-privileged user or even a Domain Admin.
2. Kerberos Ticket: With SYSTEM access, the attacker can forge Kerberos tickets (TGT - Ticket Granting Ticket) and impersonate Domain Admin.

5. Detection and Mitigation#

Detection by Blue Team:#

To detect PrintNightmare, look for suspicious events:

1. Event ID 5152 (Windows Firewall): Detect incoming traffic to SMB ports (139, 445), which are typically involved in Print Spooler exploitation.
2. Event ID 7045 (Service Installation): If a new service is installed or a printer driver is loaded unexpectedly, this could be an indicator of compromise.
3. Event ID 4688 (Process Creation): Monitor cmd.exe, powershell.exe, or spoolsv.exe processes spawned by low-privileged users.
4. Unusual Print Spooler Logs: Look for printer drivers being loaded that do not match normal operations.

Mitigation Strategies:#

1. Apply Microsoft Patches:
   • The easiest and most effective mitigation is to install the latest security updates released by Microsoft for CVE-2021-34527.
   • Windows Update (KB5004945 and others) patches the vulnerability by modifying how the Print Spooler handles driver loading.
2. Disable Print Spooler Service (Temporary Mitigation): If immediate patching is not possible, disable the Print Spooler service entirely:

Stop-Service -Name Spooler
Set-Service -Name Spooler -StartupType Disabled

1. Limit User Permissions: Restrict printer driver installation permissions for non-administrative users.
   • Only admin-level users should have the ability to install printer drivers.
2. Use Network Segmentation: If print services are required over the network, segment your network so that the print service is isolated and can’t be accessed by unauthorized users.

6. Patching & Future Mitigation Recommendations#

• Apply Critical Patches: Always ensure that systems are patched regularly and that Print Spooler is updated with the latest security patches from Microsoft.
• Monitor Event Logs: Ensure that systems are actively logging events related to printer drivers and spooler services to catch malicious activity.
• Implement Least Privilege: Ensure that non-administrative users are prevented from interacting with services such as Print Spooler, especially on critical systems like Domain Controllers.

7. Further Reading and References#

1. Microsoft Advisory for CVE-2021-34527:

   Microsoft Security Update Guide - CVE-2021-34527

2. PoC Exploit Code:

   PrintNightmare PoC Exploit GitHub Repository

3. Impacket Project:

   Impacket GitHub Repository

4. Mimikatz for credential dumping:

   Mimikatz GitHub Repository

Final Thoughts on PrintNightmare#

PrintNightmare is one of the most severe vulnerabilities in recent history due to its ability to escalate privileges on local systems and Domain Controllers. Exploiting this vulnerability allows an attacker to gain SYSTEM-level access, and if a Domain Controller is targeted, Domain Admin privileges can be easily achieved. Organizations should patch this vulnerability immediately, disable the Print Spooler service if possible, and monitor for suspicious activity related to printer drivers and spoolsv.exe processes.