{"uuid": "477b738a-a281-437b-aca1-62e70a332a68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "seen", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.988898Z"}