{"id":8693,"date":"2021-06-26T03:50:00","date_gmt":"2021-06-26T01:50:00","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8693"},"modified":"2021-07-09T16:50:55","modified_gmt":"2021-07-09T14:50:55","slug":"printnightmare-cve-2021-34527-exploit-mitigation-to-keep-your-print-servers-running-while-microsoft-patch-doesnt-really-work-effectively","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/cisco-and-networking\/printnightmare-cve-2021-34527-exploit-mitigation-to-keep-your-print-servers-running-while-microsoft-patch-doesnt-really-work-effectively\/","title":{"rendered":"PrintNightmare CVE-2021-34527 exploit Mitigation to keep your Print Servers running while Microsoft Patch Doesn&#8217;t Really work Effectively"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A regular domain user can easily take over the entire Active Directory domain.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While we still recommend that the print spooler service should be disabled on any system that does not need it, we also want to provide a temporary workaround to make the exploit ineffective, while allowing you to keep your print servers running, until a patch is available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exploit works by dropping a DLL in a sub-directory under C:\\Windows\\System32\\spool\\drivers<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By restricting the ACLs on this directory (and sub-directories) we can prevent malicious DLLs to be introduced by the print spooler service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the moment, we are not aware of any way to force the DLL to be dropped in a different location.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow-905x1024.png\" alt=\"\" class=\"wp-image-8699\" width=\"548\" height=\"620\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow-905x1024.png 905w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow-265x300.png 265w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow-768x869.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow-1358x1536.png 1358w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/CVE-2021-34527-flow.png 1505w\" sizes=\"auto, (max-width: 548px) 100vw, 548px\" \/><figcaption>Making Sense of PrintNightmare (CVE-2021-34527)<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Restricting the ACLs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The following PowerShell script will do the trick.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$DPath = \"C:\\Windows\\System32\\spool\\drivers\"\n$AccessList = (Get-Item $DPath).GetAccessControl('Access')\n$SObj = New-Object  System.Security.AccessControl.FileSystemAccessRule(\"System\", \"Modify\", \"ContainerInherit, ObjectInherit\", \"None\", \"Deny\")\n$AccessList.AddAccessRule($SObj)\nSet-Acl $DPath $AccessList<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This will add a Deny rule for the drivers directory and all subdirectories, preventing the SYSTEM account to modify its contents.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-1024x609.png\" alt=\"\" class=\"wp-image-8694\" width=\"677\" height=\"402\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-1024x609.png 1024w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-300x178.png 300w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-768x456.png 768w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-1536x913.png 1536w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/Deny-SystemAccount-2048x1217.png 2048w\" sizes=\"auto, (max-width: 677px) 100vw, 677px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Deny rule on the drivers directory and subdirectories<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If administrators need to perform configuration changes that require the service to write in these directories, this rule can temporarily be removed, and re-added after the change.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To remove the ACL we just added<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$DPath = \"C:\\Windows\\System32\\spool\\drivers\"\n$AccessList = (Get-Item $DPath).GetAccessControl('Access')\n$SObj = New-Object  System.Security.AccessControl.FileSystemAccessRule(\"System\", \"Modify\", \"ContainerInherit, ObjectInherit\", \"None\", \"Deny\")\n$AccessList.RemoveAccessRule($SObj)\nSet-Acl $DPath $AccessList<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is not a perfect solution, but until a patch is available, it is a way to keep the print server running in cases where it is strictly necessary.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We have verified that the ACL prevents the successful execution of the following exploit implementations:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/cube0x0\/CVE-2021-1675\" target=\"_blank\">https:\/\/github.com\/cube0x0\/CVE-2021-1675<\/a> (both C# and Python implementations)<\/li><li><a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/afwu\/PrintNightmare\" target=\"_blank\">https:\/\/github.com\/afwu\/PrintNightmare<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"> why system account is enough, because Spoolersv.exe running uneder System account privileges, so by deny access to this account spoolersv.exe can not modify this folder, while the vulnerability need spoolersv.exe upload a DLL into this folder.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"623\" height=\"562\" src=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/canon-bidirectional-support.jpg\" alt=\"\" class=\"wp-image-8695\" srcset=\"https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/canon-bidirectional-support.jpg 623w, https:\/\/tajdini.net\/blog\/wp-content\/uploads\/2021\/07\/canon-bidirectional-support-300x271.jpg 300w\" sizes=\"auto, (max-width: 623px) 100vw, 623px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Make Sure &#8220;Enabled bidirectional support&#8221; unchecked, means it&#8217;s Disable.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The setting, found on the Ports tab when looking at the Printer Properties menu in Windows, controls whether a print driver will communicate with the physical printer to determine the printer\u2019s state and find out details like whether a finishing unit is attached. The exact function will vary depending on the make and model of printer.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A regular domain user can easily take over the entire Active Directory domain. While we still recommend that the print spooler service should be disabled on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":8696,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[221,222,226,230],"tags":[125,241,230,262,169,190,274,278,90],"class_list":["post-8693","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cisco-and-networking","category-cloud-and-devsecops","category-identity-and-active-directory","category-penetration-testing","tag-active-directory","tag-cloud-security","tag-penetration-testing","tag-pki","tag-powershell","tag-tls-ssl","tag-vulnerability-management","tag-cisco"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8693"}],"version-history":[{"count":3,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8693\/revisions"}],"predecessor-version":[{"id":8701,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8693\/revisions\/8701"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8696"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}