Sploitus

Exploit for CVE-2021-1675 CVE-2021-1675 CVE-2021-34527

githubexploit · 2021-07-01

Exploit Code

README44 lines
## https://sploitus.com/exploit?id=AAD37CB5-B2C3-5908-B0D3-052CF47F6D25
# Local Privilege Escalation Edition of CVE-2021-1675/CVE-2021-34527

Local Privilege Escalation implementation of the CVE-2021-1675/CVE-2021-34527 (a.k.a PrintNightmare). The exploit is edited from published by Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370).

Open the project on MSVC and compile with x64 Release mode. Exploit automatically finds UNIDRV.DLL, no changes are required in the code. 

## Usage

When executing the exploit, you need to DLL path as the first argument to the exploit. That's it and go!

```
CVE-2021-1675-LPE.exe PAYLOAD_DLL_PATH
```

Exploit has been tested on the fully updated Windows Server 2019 Standard.



## Cobalt Strike

For Reflective DLL version only, you have to change the DLL path at line 111 in main.cpp file and then compile the project. Load lpe_cve_2021_1675.cna and use lpe_cve_2021_1675 command for execution of Reflective DLL.




## Mitigation

Disable Spooler service

```powershell
Stop-Service Spooler
REG ADD  "HKLM\SYSTEM\CurrentControlSet\Services\Spooler"  /v "Start " /t REG_DWORD /d "4" /f
```

Or Uninstall Print-Services

```powershell
Uninstall-WindowsFeature Print-Services
```
## References
* https://github.com/afwu/PrintNightmare
* https://twitter.com/hackerfantastic/status/1410069557398679552
* https://twitter.com/0gtweet/status/1410150462842544130