CVE-2021-1675 PoC — Microsoft Windows Print Spooler Components 安全漏洞

Source

Associated Vulnerability

Description

A small powershell script to disable print spooler service using desired state configuration

Readme

# CVE-2021-1675 - PrintNightmare DSC Mitigation (PowerShell)

> Kougyoku Gentou | July 1, 2021

----------------------------------------------------------

[CVE-2021-1675](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675) is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

The mitigation is to disable Print Spooler service. Well, most websites say to do this on Domain Controllers only, but realistically it should be done on bascially any Windows Server that is not a print server. So let's fix it! This is using Powershell and Desired State Configuration to stop and disable the print spooler service from all computers in OUs of your choice. You might need to change up some of the variables in the top of the script to fit your environment, but should be self-explanatory.

File Snapshot

 [4.0K]  /data/pocs/1bfb318727bcdda46134a2170f1643193c01c4d9
├── [1.4K]  Disable-PrintSpooler.ps1
└── [ 859]  README.md

0 directories, 2 files

Remarks