A CVE-2021-34527 (a.k.a PrintNightmare) Python Scanner. Allows you to scan entire subnets for the PrintNightmare RCE (not the LPE) and generates a CSV report with the results. Tests exploitability over MS-PAR and MS-RPRN.
This tool has "de-fanged" versions of the Python exploits, it does not actually exploit the hosts however it does use the same vulnerable RPC calls used during exploitation to determine if hosts are vulnerable.
POV, trying to determine if something is vulnerable to PrintNightmare:
At the time of writing, the amount of variables that determine if a machine is vulnerable is crazy and confusing.
- Pingcastle (C#)
This tool currently needs cube0x0's Impacket fork containing the MS-PAR implementation necessary for one of the checks. This change has been submitted to Impacket in this pull request.
You need to install Impacket from git as it has the MS-PAR implementation necessary for one of the checks. (Both of the installation methods below do this automatically for you)
Docker:
git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && docker build -t itwasalladream .
docker run -it itwasalladream -u user -p password -d domain 192.168.1.0/24
Dev install requires Poetry:
git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && poetry install && poetry shell
itwasalladream -u user -p password -d domain 192.168.1.0/24
usage: itwasalladream [-h] -u USERNAME [-p PASSWORD] -d DOMAIN [--timeout TIMEOUT] [--threads THREADS] [-v] [--csv-column CSV_COLUMN] target
PrintNightmare (CVE-2021-34527) scanner
positional arguments:
target Target subnet in CIDR notation, CSV file or newline-delimited text file
optional arguments:
-h, --help show this help message and exit
-u USERNAME, --username USERNAME
username to authenticate as (default: None)
-p PASSWORD, --password PASSWORD
password to authenticate as. If not specified will prompt. (default: None)
-d DOMAIN, --domain DOMAIN
domain to authenticate as (default: None)
--timeout TIMEOUT Connection timeout in secods (default: 30)
--threads THREADS Max concurrent threads (default: 100)
-v, --verbose Enable verbose output (default: False)
--csv-column CSV_COLUMN
If target argument is a CSV file, this argument specifies which column to parse (default: DNSHostName)
I used to read Word Up magazine!
As the exploit requires you to be authenticated to Active Directory, you need to supply credentials. If the password isn't supplied it will prompt you to enter it.
By default it will use 100 threads, you can increase/decrease these using the -t argument.
After its done you'll see a report_<timestamp>.csv file in your current directory with the results.
- cube0x0 for implementing the MS-PAR & MS-RPRN protocols in Impacket and creating the PrintNightmare Python Exploits
- Zhiniang Peng & Xuefeng Li for the discovery of the PrintNightmare exploit.