CVE-2021-1675 PoC — Microsoft Windows Print Spooler Components 安全漏洞

Source

https://github.com/sailay1996/PrintNightmare-LPE

Associated Vulnerability

Title:Microsoft Windows Print Spooler Components 安全漏洞 (CVE-2021-1675)
Description:Microsoft Windows Print Spooler Components是美国微软（Microsoft）公司的一个打印后台处理程序组件。 Microsoft Windows Print Spooler Components存在安全漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 10 Version 1809 for AR

Description

CVE-2021-1675 (PrintNightmare)

Readme

# CVE-2021-1675(PrintNightmare)
system shell poc for CVE-2021-1675 (Windows Print Spooler Elevation of Privilege)

#### credit: Zhiniang Peng (@edwardzpeng) & Xuefeng Li (@lxf02942370)

#### Ref: https://github.com/afwu/PrintNightmare

#### windows 10

![test1](https://github.com/sailay1996/PrintNightmare-LPE/blob/main/img/win10PN.jpg)

#### windows server 2012

![test2](https://github.com/sailay1996/PrintNightmare-LPE/blob/main/img/win2012PN.jpg)

##### Credit to all researcher who find out this bug.


[@404death](https://twitter.com/404death)

File Snapshot


 [4.0K]  /data/pocs/01ab70f0bc3bbd425ee86d02d80201d6ec6cbbc2
├── [4.0K]  img
│   ├── [201K]  win10PN.jpg
│   └── [186K]  win2012PN.jpg
├── [ 14K]  PrintNightmareLPE.exe
├── [ 552]  README.md
├── [4.0K]  src
│   ├── [4.0K]  PrintNightmareLPE
│   │   ├── [4.0K]  PrintNightmareLPE
│   │   │   ├── [4.0K]  Debug
│   │   │   │   ├── [4.0K]  PrintNig.00552dff.tlog
│   │   │   │   │   ├── [ 836]  CL.command.1.tlog
│   │   │   │   │   ├── [ 18K]  CL.read.1.tlog
│   │   │   │   │   ├── [ 616]  CL.write.1.tlog
│   │   │   │   │   ├── [1.4K]  link.command.1.tlog
│   │   │   │   │   ├── [2.8K]  link.read.1.tlog
│   │   │   │   │   ├── [ 676]  link.write.1.tlog
│   │   │   │   │   └── [ 186]  PrintNightmareLPE.lastbuildstate
│   │   │   │   ├── [ 48K]  PrintNightmareLPE.exe
│   │   │   │   ├── [ 325]  PrintNightmareLPE.exe.recipe
│   │   │   │   ├── [428K]  PrintNightmareLPE.ilk
│   │   │   │   ├── [ 49K]  PrintNightmareLPE.obj
│   │   │   │   ├── [596K]  PrintNightmareLPE.pdb
│   │   │   │   ├── [ 168]  PrintNightmareLPE.vcxproj.FileListAbsolute.txt
│   │   │   │   ├── [155K]  vc142.idb
│   │   │   │   └── [404K]  vc142.pdb
│   │   │   ├── [2.8K]  PrintNightmareLPE.cpp
│   │   │   ├── [7.0K]  PrintNightmareLPE.vcxproj
│   │   │   ├── [ 990]  PrintNightmareLPE.vcxproj.filters
│   │   │   ├── [ 168]  PrintNightmareLPE.vcxproj.user
│   │   │   └── [4.0K]  x64
│   │   │       ├── [4.0K]  Debug
│   │   │       │   ├── [4.0K]  PrintNig.00552dff.tlog
│   │   │       │   │   ├── [ 804]  CL.command.1.tlog
│   │   │       │   │   ├── [ 34K]  CL.read.1.tlog
│   │   │       │   │   ├── [ 640]  CL.write.1.tlog
│   │   │       │   │   ├── [1.3K]  link.command.1.tlog
│   │   │       │   │   ├── [2.8K]  link.read.1.tlog
│   │   │       │   │   ├── [ 600]  link.write.1.tlog
│   │   │       │   │   └── [ 166]  PrintNightmareLPE.lastbuildstate
│   │   │       │   ├── [ 311]  PrintNightmareLPE.exe.recipe
│   │   │       │   ├── [ 63K]  PrintNightmareLPE.obj
│   │   │       │   ├── [427K]  vc142.idb
│   │   │       │   └── [468K]  vc142.pdb
│   │   │       └── [4.0K]  Release
│   │   │           ├── [4.0K]  PrintNig.00552dff.tlog
│   │   │           │   ├── [ 812]  CL.command.1.tlog
│   │   │           │   ├── [ 34K]  CL.read.1.tlog
│   │   │           │   ├── [ 496]  CL.write.1.tlog
│   │   │           │   ├── [1.4K]  link.command.1.tlog
│   │   │           │   ├── [3.5K]  link.read.1.tlog
│   │   │           │   ├── [ 472]  link.write.1.tlog
│   │   │           │   ├── [ 168]  PrintNightmareLPE.lastbuildstate
│   │   │           │   └── [1.3K]  PrintNightmareLPE.write.1u.tlog
│   │   │           ├── [1.8K]  PrintNightmareLPE.Build.CppClean.log
│   │   │           ├── [ 313]  PrintNightmareLPE.exe.recipe
│   │   │           ├── [ 508]  PrintNightmareLPE.log
│   │   │           └── [1.2M]  PrintNightmareLPE.obj
│   │   └── [1.4K]  PrintNightmareLPE.sln
│   ├── [4.0K]  vlibr
│   │   ├── [1.4K]  valendrv.sln
│   │   └── [4.0K]  vlib
│   │       ├── [1.2K]  BindShell.cpp
│   │       ├── [ 114]  BindShell.h
│   │       ├── [4.6K]  vib.cbp
│   │       ├── [ 651]  vlib.cpp
│   │       ├── [  46]  vlib.def
│   │       ├── [1.3K]  vlib.filters
│   │       ├── [ 570]  vlib.layout
│   │       ├── [ 168]  vlib.user
│   │       ├── [7.9K]  vlib.vcxproj
│   │       └── [ 168]  vlib.vcxproj.user
│   └── [4.0K]  xconsole
│       ├── [4.0K]  xconsole
│       │   ├── [4.4K]  TcpClient.cpp
│       │   ├── [ 353]  TcpClient.h
│       │   ├── [1.1K]  xconsole.cpp
│       │   ├── [7.1K]  xconsole.vcxproj
│       │   ├── [1.2K]  xconsole.vcxproj.filters
│       │   └── [ 168]  xconsole.vcxproj.user
│       └── [1.4K]  xconsole.sln
├── [ 90K]  vlib.dll
└── [ 14K]  xconsole.exe

15 directories, 67 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!