PrintNightmare (CVE-2021-34527)

This version of the PrintNightmare exploit is heavily based on the code created by Cube0x0, with the following features:

Ability to target multiple hosts.
Built-in SMB server for payload delivery, removing the need for open file shares.
Exploit includes both MS-RPRN & MS-PAR protocols (define in CMD args).
Implements @gentilkiwi's UNC bypass technique.

Installation

Before running, install the latest version of impacket:

git clone https://github.com/SecureAuthCorp/impacket
cd impacket
python3 setup install

git clone https://github.com/m8sec/CVE-2021-34527
cd CVE-2021-34527
python3 CVE-2021-34527.py -h

Test

Impacket's rpcdump.py can be used to check for MS-PAR and MS-RPRN protocols:

>> rpcdump.py @192.168.1.10 | egrep 'MS-RPRN|MS-PAR'
Protocol: [MS-PAR]: Print System Asynchronous Remote Protocol 
Protocol: [MS-RPRN]: Print System Remote Protocol

Alternatively, byt3bl33d3r's scanner ItWasAllADream can be used to scan targets and validate the PrintNightmare RCE vulnerability.

Example

Remediation

Microsoft has released several patches for PrintNightmare, the latest being on Patch Tuesday of September 2021. This addressed the underlying vulnerability and later workarounds discovered. For more information, visit Microsoft's official guidance:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

Additional strategies for mitigating this vulnerability include:

Disabling the Print Spooler service on non-essential systems.
Disable inbound remote printing through Group Policy

Acknowledgement