{"uuid": "98991434-6763-4724-b053-b0eb1fcd1b8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-1675", "type": "seen", "source": "https://t.me/hacking_Attack/14933", "content": "Black Hat Ethical Hacking\nPoC Exploit Circulating for Critical Windows Print Spooler Bug\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg PoC Exploit Circulating for Critical Windows Print Spooler BugPost Views: 49 \nReading Time: 2 Minutes\nA proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tuesday \u2013 and while it was taken back down within a few hours, the code was copied and is still out there circulating on the platform.\nThe \u201cPrintNightmare\u201d bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.\n\nThe bug (CVE-2021-1675) exists in the Windows Print Spooler and has been dubbed \u201cPrintNightmare\u201d by researchers. It was originally addressed in June\u2019s Patch Tuesday updates\u00a0from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week after researchers from Tencent and NSFOCUS TIANJI Lab figured out it could be used for RCE.\n\n\u201cThere are 40 entries in Microsoft\u2019s list of affected products, from Windows 7 to Windows 10 and from Server 2008 to Server 2019,\u201d Dirk Schrader, global vice president of security research at New Net Technologies (NNT), now part of Netwrix, told Threatpost. \u201cGiven this broad surface, it is likely that this vulnerability will become an element in the tool chain of current malware families.\u201d\n\nOn Sunday, the QiAnXin security team tweeted a video\u00a0showing successful RCE \u2013 but it held back any technical or PoC details. Two days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.\nSee Also: Data for 700M LinkedIn Users Posted for Sale in Cyber-Underground Claire Tills, senior security engineer with Tenable, which spotted the PoC posting, noted that \u201cthe GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating and is likely to resurface publicly, if it hasn\u2019t already done so.\u201d\n\nAnd indeed, according to one security practitioner, the code was successfully forked to another page.\nLooks like the original PoC for PrintNightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC\n\n\u2014 Andy Gill (@ZephrFish) June 29, 2021\nSee Also: Offensive Security Tool: Pixload\nOn Wednesday, other researchers tweeted videos\u00a0and more analysis\u00a0that could be used for successful exploitation as word spread of the PoC.\nImpacket implementation of CVE-2021-1675 https://s.w.org/images/core/emoji/13.0.1/72x72/1f525.png https://t.co/UpKOueij4c\n\n\u2014 Cube0x0 (@cube0x0) June 29, 2021 See Also: Hacking Stories: Andrian Lamo \u2013 The \u2018homeless\u2019 Hacker It should be noted that some sources are also saying that the existing Microsoft patch doesn\u2019t remedy the RCE version. Cube0x0\u2019a impacket implementation above for instance works on a fully patched Windows machine, the authors said.\n\n\u201cWe\u2019re still evaluating the efficacy of the patch ourselves, but there are multiple reports indicating the proof-of-concept code works against fully patched systems,\u201d Dustin Childs, of Trend Micro\u2019s Zero Day Initiative, told Threatpost. \u201cThis does indicate the patch released in June does not completely address the root cause of the bug. Either way, enterprises should treat this as an incomplete fix and implement other workarounds, such as disabling the print spooler and blocking TCP ports 135 and 445 at the perimeter.\u201d\n\nHe made note of Microsoft\u2019s CVE nomenclature too: \u201cIt\u2019s curious that the CVE here is -1675 while most of the CVEs Microsoft patched in June are -31000 and higher. This could be an indicato[...]", "creation_timestamp": "2026-09-01T20:02:34.549024Z"}