Flash Alert: Windows Print Spooler Remote Code Execution Vulnerability (PrintNightmare)

A zero-day flaw was detected in Microsoft Windows Print Spooler service, which allows a remote authenticated attacker to execute arbitrary code with SYSTEM privileges on a vulnerable system. The Print Spooler is used to manage the printing process in Windows, including loading the appropriate printer drivers and scheduling the print job for printing. Despite the initial findings on the vulnerability, security researchers discovered that PrintNightmare is different from CVE-2021-1675. On 21 June 2021, Microsoft upgraded the severity of CVE-2021-1675 to Critical and changed the vulnerability type from EoP (elevation of privilege) to RCE (remote code execution). Although Microsoft has released a fix for CVE-2021-1675 in the June 2021 Patch Tuesday release, currently no patch is available for PrintNightmare. There are several versions of Proof-of-Concept code available which work against fully patched systems.

Standing Intelligence Requirements

Vulnerability

Malware

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

MITRE ATT&CK

ATT&CK Framework

Details

Print Spooler (spoolsv.exe) is a Windows service that acts as an interface between the Windows operating system (OS), applications, and local or networked printers that manages the printing process. The management mainly includes retrieving the location of the correct printer driver, loading that driver, spooling high-level function calls into a print job, and scheduling the print job for printing. A bug detected in Microsoft Windows Print Spooler service fails to restrict access to the RpcAddPrinterDriverEx() function, which can allow a remote authenticated attacker to gain full domain access and execute arbitrary code with SYSTEM privileges on a vulnerable system. The exploitation requires a user to be authenticated as a domain user. The vulnerability affects all Windows OS versions and may affect deprecated Windows versions such as XP and Vista.

Impact

Despite the need for authentication, the severity of the issue is critical as threat actors can use it to take over a Windows domain server to easily deploy malware across a company’s network.

Remediation

As a workaround, administrators are strongly advised to stop and disable the spooler service, especially on domain controller systems.

Threat Actor Chatter

Multiple posts on popular underground cybercrime forums were created on 30 June 2021, the same day that the information security community was sharing details and proof of concept (PoC) exploits. On Exploit, one of the moderators created a post detailing the vulnerability and linking the public PoCs on Github that were some of the same PoCs being shared on social media.

Exploit

Figure 1: A moderator on Exploit discusses PrintNightmare

English translation:

"PrintNightmare CVE-2021-1675 By pixe1, 18 hours ago in Security and Hacking

Quite an interesting and serious vulnerability in the Windows Spooler Service (the RpcAddPrinterDriver abuse) that definitely needs to be paid attention to.

details, PoCs, exploits, fixes are discussed below

original write-up https://github.com/afwu/PrintNightmare

Result.png

dr.tom Posted 10 hours ago

it's like RCE, but relevant for domain networks. since there must be a valid account for operation (any domain user will do as I understand it) and you can break through the same DC"

On XSS, an actor shared python exploit code directly in the post.

XSS

Figure 2: An actor on XSS discusses PrintNightmare

Much like the security research community, the cybercrime community relies on news and PoC code for vulnerabilities as a way to bolster their operations. As documented in the ZeroFOX ZeroLogon vulnerability report (https://cloud.zerofox.com/alpha_team/vulnerabilities/427496) , a PoC for ZeroLogon was published and 13 days later Microsoft confirmed in-the-wild exploitation of the vulnerability.

ZeroLogon Timeline

Figure 3: ZeroLogon timeline of events. PrintNightmare was announced this week and there was already PoC code released, unlike ZeroLogon

Assessment

ZeroFOX Threat Research assesses that threat actors will most likely use knowledge from the security research community to embed PrintNightmare into their toolsets. Much like ZeroLogon, PrintNightmare is a useful lateral movement and remote exploitation vulnerability that can give Administrative access to critical infrastructure on Windows, such as Domain Controllers. Much like with ZeroLogon, this exploit can be used to infect a Domain Controller and spread additional malware throughout the Active Directory environment. Since there is no patch, and there are PoCs available, it is likely this will be a more attractive option for Threat Actors as they will race against Microsoft to exploit PrintNightmare in the wild.

Sources

Tags: MAL Pivoting, VULN Exploitation, VULN Community, VULN Publication, all industries, global, vulnerability/exploit