CVE-2021-1675

Proof of Concepts and Initial Reports

First attempts seen at claiming a post patch exploit: https://twitter.com/RedDrip7/status/1409353110187757575

Original PoC pulled

First PoC of exploit, forked from the one pulled above: https://github.com/cube0x0/CVE-2021-1675

More efforts to show the PoC:

• https://twitter.com/gentilkiwi/status/1410066827590447108

• Video archived from twitter thread above

Microsoft may be pulling the more easily usable PoC's from github

• https://twitter.com/blackorbird/status/1409794227731460100

• https://github.com/blackorbird/PrintNightmare

Mitigations

MS Documentation on Print Spooler:

• https://web.archive.org/web/20210630081922/https://docs.microsoft.com/en-us/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server

• https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/5352a7b0-5674-4d33-93c4-c94b5d499d37

Possible GPO based mitigation for non-print server: https://github.com/LaresLLC/CVE-2021-1675

Possible Mitigation for Print Servers: https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/