Microsoft later updated the patch for CVE-2021-1675 (and updated the class from a privilege escalation to remote code execution) on July 2. The researchers later took down their exploit, but once something had hit the internet, the damage had been done.

Seeing this patch, researchers in China were working on a proof of concept for a very similar bug in the print spooler, and on seeing the patch, they published their exploit on GitHub. Microsoft released a patch for a Windows Print Spooler Remote Code Execution Vulnerability on June 8, 2021, known as CVE-2021-1675. The history on this bug is kind of interesting. I’ll also look at disabling the Print Spooler and how it breaks the exploits, and discuss the July 6 patch. There are a few proof of concept exploits out there, and I wanted to give them a spin an old HackTheBox machine.

This is especially bad because it is not uncommon for Domain Controllers to have an exposed print spooler, and thus, this exploit can take an attacker from low-priv user to domain admin. CVE-2021-34527, or PrintNightmare, is a vulnerability in the Windows Print Spooler that allows for a low priv user to escalate to administrator on a local box or on a remote server.

Print nightmare registry fix