Workaround for Windows Print Spooler Remote Code Execution Vulnerability(CVE-2021-34527). See: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527# disable-RegisterSpoolerRemoteRpcEndPoint
Workaround for Windows Print Spooler Remote Code Execution Vulnerability(CVE-2021-34527). See:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
## Update 2021-07-08: Microsoft released a patch
Microsoft already released a patch for this vulnerability, so keeping your system up to date should be enough.
However, you can still turn off this functionality if you want (maybe because you don't use it or maybe because you still don't feel safe).
## How to use it
Download an execute with admin privileges.
## What this script does
It creates a new register entry (or overrides the existing one) to disable remote connections to the print spooler.
To be more specific, it does the same as this policy change:
https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.Printing.2::RegisterSpoolerRemoteRpcEndPoint
If you prefer to do it manually, you can follow the 2nd option of the "Workaround" from:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
If you need a step by step guide, here's one:
1. Open the "Run" window by pressing Win + R (Win = Windows Key)
2. Type: gpedit.msc
3. Press enter to load the Group Policy Editor
4. Go to "Computer Configuration" -> "Administrative Templates" -> "Printers"
5. Double click on "Allow Print Spooler to accept client connections" to open this directive
6. Set the policy to "Disabled".
7. Select OK to apply the changes.
8. Restart the computer for the "Spool" service to see and take into account the changes
## Caveats
The print server will no longer accept remote connections (it can be undone).
登录后查看神龙缓存的 POC 文件快照
登录查看