{"id":13845172,"url":"https://github.com/m8sec/CVE-2021-34527","last_synced_at":"2025-07-12T01:31:52.242Z","repository":{"id":57942546,"uuid":"528150029","full_name":"m8sec/CVE-2021-34527","owner":"m8sec","description":"PrintNightmare (CVE-2021-34527) PoC Exploit","archived":false,"fork":false,"pushed_at":"2022-12-17T16:10:46.000Z","size":11,"stargazers_count":108,"open_issues_count":0,"forks_count":19,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-08T01:11:11.522Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/m8sec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-08-23T20:20:45.000Z","updated_at":"2025-04-01T22:45:58.000Z","dependencies_parsed_at":"2023-01-29T17:31:11.864Z","dependency_job_id":null,"html_url":"https://github.com/m8sec/CVE-2021-34527","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/m8sec/CVE-2021-34527","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m8sec%2FCVE-2021-34527","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m8sec%2FCVE-2021-34527/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m8sec%2FCVE-2021-34527/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m8sec%2FCVE-2021-34527/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/m8sec","download_url":"https://codeload.github.com/m8sec/CVE-2021-34527/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/m8sec%2FCVE-2021-34527/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264923078,"owners_count":23683716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:03:15.062Z","updated_at":"2025-07-12T01:31:51.866Z","avatar_url":"https://github.com/m8sec.png","language":"Python","funding_links":[],"categories":["Python"],"sub_categories":[],"readme":"# PrintNightmare (CVE-2021-34527)\n\nThis version of the PrintNightmare exploit is based on the code created by [Cube0x0](https://github.com/cube0x0/CVE-2021-1675), with the following features:\n\n* Ability to target multiple hosts.\n* Built-in SMB server for payload delivery, removing the need for open file shares.\n* Exploit includes both `MS-RPRN` \u0026 `MS-PAR` protocols (*define in CMD args*).\n* Implements [@gentilkiwi's](https://twitter.com/gentilkiwi) [UNC bypass](https://twitter.com/gentilkiwi/status/1412771368534528001) technique.\n\n\n## Installation\nBefore running, install the latest version of [impacket](https://github.com/SecureAuthCorp/impacket):\n```commandline\ngit clone https://github.com/SecureAuthCorp/impacket\ncd impacket\npython3 setup install\n\ngit clone https://github.com/m8sec/CVE-2021-34527\ncd CVE-2021-34527\npython3 CVE-2021-34527.py -h\n```\n\n## Test\nImpacket's `rpcdump.py` can be used to check for `MS-PAR` and `MS-RPRN` protocols:\n```\n\u003e\u003e rpcdump.py @192.168.1.10 | egrep 'MS-RPRN|MS-PAR'\nProtocol: [MS-PAR]: Print System Asynchronous Remote Protocol \nProtocol: [MS-RPRN]: Print System Remote Protocol\n```\n\nAlternatively, [byt3bl33d3r's](https://twitter.com/byt3bl33d3r) scanner [ItWasAllADream](https://github.com/byt3bl33d3r/ItWasAllADream) can be used to scan targets and validate the PrintNightmare RCE vulnerability.\n\n\n## Screenshots\n![pnm](https://user-images.githubusercontent.com/13889819/186430046-44143e63-9f29-4109-a4f1-4b005b78a17b.png)\n\n\n## Usage\n```text\n  -v VERBOSE            Enable verbose logging from SMB server\n  -t TIMEOUT            Connection timeout\n\nAuthentication:\n  -u USERNAME           Set username\n  -H HASH, -hashes      Use NTLM Hash for authentication\n  -p PASSWORD           Set password\n  -d DOMAIN             Set domain\n  --local-auth          Authenticate to target host, no domain\n\nDLL Execution:\n  -dll DLL                  Path to local DLL file to execute \"beacon.dll\"\n  --remote-dll REMOTE_DLL   Remote dll \"\\\\192.168.1.25\\Share\\beacon.dll\"\n  -share SHARE              Set local SMB share name\n  --local-ip LOCAL_IP       Set local IP (defaults to primary interface)\n\nTarget(s):\n  -pDriverPath PDRIVERPATH  Define Driver path. Example 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_83aa9aebf5dffc96\\Amd64\\UNIDRV.DLL'\n  -port [destination port]  Destination port to connect to SMB Server\n  -proto {MS-RPRN,MS-PAR}   Target protocol (Default=MS-RPRN)\n  target                    192.168.2.2, target.txt, 10.0.0.0/24 (positional)\n```\n\n\n## Remediation\nMicrosoft has released several patches for PrintNightmare, the latest being on Patch Tuesday of September 2021. This addressed the underlying vulnerability and later workarounds discovered. For more information, visit Microsoft's official guidance:\n\n[https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527)\n\nAdditional [strategies](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527#workarounds) for mitigating this vulnerability include:\n* Disabling the Print Spooler service on non-essential systems.\n* Disable inbound remote printing through Group Policy\n\n\n## Acknowledgement\n* [@cube0x0](https://twitter.com/cube0x0) - for the Python [exploit](https://github.com/cube0x0/CVE-2021-1675) code and his contributions to the [impacket](https://github.com/SecureAuthCorp/impacket) project. \n* [@edwardzpeng](https://twitter.com/edwardzpeng) \u0026 [@lxf02942370](https://twitter.com/lxf02942370)- for the initial discovery and exploit of PrintNightmare.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fm8sec%2FCVE-2021-34527","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fm8sec%2FCVE-2021-34527","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fm8sec%2FCVE-2021-34527/lists"}