CVE-2021-1675

Windows Print Spooler Remote Code Execution Vulnerability

Recent assessments:

kevthehermit at June 30, 2021 1:53pm UTC reported:

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

• <https://github.com/afwu/PrintNightmare&gt; – A windows binary exploit

• <https://github.com/cube0x0/CVE-2021-1675&gt; – Python3 using a modified version of impacket

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: <https://github.com/SigmaHQ/sigma/pull/1592&gt;

andretorresbr at July 02, 2021 2:37am UTC reported:

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

• <https://github.com/afwu/PrintNightmare&gt; – A windows binary exploit

• <https://github.com/cube0x0/CVE-2021-1675&gt; – Python3 using a modified version of impacket

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: <https://github.com/SigmaHQ/sigma/pull/1592&gt;

architect00 at July 01, 2021 1:46pm UTC reported:

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

• <https://github.com/afwu/PrintNightmare&gt; – A windows binary exploit

• <https://github.com/cube0x0/CVE-2021-1675&gt; – Python3 using a modified version of impacket

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: <https://github.com/SigmaHQ/sigma/pull/1592&gt;

NinjaOperator at June 29, 2021 5:55pm UTC reported:

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

• <https://github.com/afwu/PrintNightmare&gt; – A windows binary exploit

• <https://github.com/cube0x0/CVE-2021-1675&gt; – Python3 using a modified version of impacket

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: <https://github.com/SigmaHQ/sigma/pull/1592&gt;

ccondon-r7 at July 01, 2021 1:43pm UTC reported:

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

• <https://github.com/afwu/PrintNightmare&gt; – A windows binary exploit

• <https://github.com/cube0x0/CVE-2021-1675&gt; – Python3 using a modified version of impacket

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: <https://github.com/SigmaHQ/sigma/pull/1592&gt;

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 5