PrintNightmare

Prompts and answers

• Where would you enable or disable Print Spooler Service?
  Services
• Provide the CVE of the Windows Print Spooler Remote Code Execution Vulnerability that doesn't require local access to the machine.
  CVE-2021-34527
• What date was the CVE assigned for the vulnerability in the previous question? (mm/dd/yyyy)
  07/02/2021
• What is the flag residing on the Administrator's Desktop?
  THM{SiGBQPMkSvejvmQNEL}
• Provide the first folder path where you would likely find the dropped DLL payload.
  C:\Windows\System32\spool\drivers\x64\3\
• Provide the function that is used to install printer drivers.
  pcAddPrinterDriverEx()
• What tool can the attacker use to scan for vulnerable print servers?
  rpcdump.py
• Provide the name of the dropped DLL, including the error code. (no space after the comma)
  svch0st.dll,0x45A
• Provide the event log name and the event ID that detected the dropped DLL. (no space after the comma)
  Microsoft-Windows-PrintService/Admin,808
• Find the source name and the event ID when the Print Spooler Service stopped unexpectedly and how many times was this event logged? (format: answer,answer,answer)
  Service Control Manager,7031,1
• After some threat hunting steps, you are more confident now that it's a PrintNightmare attack. Hunt for the attacker's shell connection. Provide the log name, event ID, and destination port. (format: answer,answer,answer)
  Microsoft-Windows-Sysmon/Operational,3,4747
• Oh no! You think you've found the attacker's connection. You need to know the attacker's IP address and the destination hostname in order to terminate the connection. Provide the attacker's IP address and the hostname. (format: answer,answer)
  10.10.210.100,ip-10-10-210-100.eu-west-1.compute.internal
• A Sysmon FileCreated event was generated and logged. Provide the full path to the dropped DLL and the earliest creation time in UTC. (format:answer,yyyy-mm-dd hh-mm-ss)
  C:\Windows\System32\spool\drivers\x64\3\New\svch0st.dll,2021-08-13 17:33:37
• What is the host name of the domain controller?
  WIN-1O0UJBNP9G7
• What is the local domain?
  printnightmare.local
• What user account was utilized to exploit the vulnerability?
  lowprivlarry
• What was the malicious DLL used in the exploit?
  letmein.dll
• What was the attacker's IP address?
  10.10.124.236
• What was the UNC path where the malicious DLL was hosted?
  \\10.10.124.236\sharez
• There are encrypted packets in the results. What was the associated protocol?
  SMB3
• Provide two ways to manually disable the Print Spooler Service. (format: answer,answer)
  PowerShell,Group Policy
• Where can you disable the Print Spooler Service in Group Policy? (format: no spaces between the forward slashes)
  Computer Configuration/Administrative Templates/Printers
• Provide the command in PowerShell to detect if Print Spooler Service is enabled and running.
  Get-Service -Name Spooler