PrintNightmare Enables Remote Code Execution and Privilege Escalation on Windows
Summary
Huntress reported that PrintNightmare (CVE-2021-34527) could enable remote code execution and privilege escalation through Windows Print Spooler. The article details affected systems, patch limitations, temporary mitigations, and detection options.
Key points
- The flaw affects the Windows Print Spooler service and can enable local privilege escalation or remote code execution.
- Huntress said a low-privilege user could potentially gain administrator or SYSTEM access, with risks including lateral movement to domain controllers.
- Huntress validated public Python and C++ proof-of-concept exploits against Windows Server 2016 and Server 2019.
- The article reported that Microsoft's June 8 update did not fix CVE-2021-34527. Huntress said the July 6 emergency update appeared to block remote code execution but did not prevent privilege escalation on Windows Servers.
- Temporary mitigations included disabling Print Spooler or restricting access controls on its driver directory; the latter could affect printer-driver changes and some Citrix printing.
- For monitoring, the article recommended PrintService event logs and monitoring ImageLoad events involving spoolsv.exe; it reported that enabling the Operational log and watching event ID 316 worked in lab testing.
Article Details
- Vulnerability Types
- Remote code execution
- Local privilege escalation
- Severity
- Critical
- Affected Versions
- Windows 7
- Windows 8
- Windows 8.1
- Windows 10
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Disable the Print Spooler service.
- Restrict access controls on C:\Windows\System32\spool\drivers to prevent rogue DLLs from being placed there; this can prevent printer-driver changes and may cause printing issues for some Citrix users.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe vulnerability can provide local privilege escalation from a low-privilege account to administrator or SYSTEM privileges.T1105 · Ingress Tool TransferThe exploit fetches a malicious DLL from an attacker SMB share.T1210 · Exploitation of Remote ServicesThe article describes using the vulnerability for remote code execution between computers, including access to high-value systems such as domain controllers.
CVE
CVE-2021-1675On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.”CVE-2021-34527On June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.”
People
Benjamin DelpyMimikatz author who observed vulnerability behavior, according to the article.Jake WilliamsResearcher who recommended a PowerShell snippet to enable PrintService operational logging.Olaf HartungThe article references his Defender for Endpoints KQL in discussing directory-traversing payload paths.
Vendors
HuntressOn June 29, Huntress was made aware of CVE-2021-1675 (now termed CVE-2021-34527), a critical remote code execution and local privilege escalation vulnerability dubbed “PrintNightmare.”MicrosoftMicrosoft released a patch on June 8 considering this vulnerability low in severity. On June 21, PrintNightmare was updated to critical severity as the potential for remote code execution was uncovered. The June 8
Products
Tools
Mimikatzon the machine we had tested the patch on. On a Windows 10 21H1 Enterprise VM, it had stopped the Mimikatz implementation of local privilege escalation.ProcmonFor those technical folks who want to follow along, our team is diving into the exploit's behaviors to help us determine if any Huntress partners have been compromised. Here's a filtered view of spoolsv.exe in ProcMon.