PrintNightmare
Overview
The PrintNightmare vulnerability has to do with a flaw found in the Windows Print Spooler service. The flaw being that the service allows users to add printers and devices AND runs as system.
This is a Post-Compromised attack and only needs a regular user account
PrintNightmare Attack
Check if the Domain Controller is vulnerable
Desired Output
Generate malicious DLL, host it and start listener
Download and run this script.
Mitigation
Run Stop-Service Spooler
REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start" /t REG_DWORD /d "4" /f
Last updated
Was this helpful?
