{"id":7530,"date":"2021-07-02T20:16:46","date_gmt":"2021-07-03T03:16:46","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7530"},"modified":"2023-04-05T12:39:55","modified_gmt":"2023-04-05T19:39:55","slug":"how-to-detect-cve-2021-34527","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/how-to-detect-cve-2021-34527\/","title":{"rendered":"How to Detect CVE-2021-34527?"},"content":{"rendered":"
{Update: September 20,2021}\u00a0<\/strong>A security update from Microsoft has been released to address the remaining zero-day security vulnerability (CVE-2021-36958<\/a>) in PrintNightmare that allowed Windows devices to obtain administrator access rapidly. In addition to fixing the issue, Microsoft has disabled the CopyFiles functionality by default and introduced an undocumented group policy that allows administrators to re-enable it.<\/p>\n We again urge organizations to identify if these vulnerabilities are present in their assets using the detection script<\/a> and keep themselves up-to-date about the latest patches and security upgrades.<\/strong><\/p>\n {Update: August 16, 2021}<\/strong>\u00a0Vice Society and Magniber ransomware operators have begun to infiltrate PrintNightmare vulnerabilities impacting the Windows Print Spooler service, Windows Print drivers, and the Windows Point and Print feature. This class of vulnerabilities is likely to increase the number of cyber threats seeking to exploit unpatched networks. CVE-2021-1675 and CVE-2021-34527<\/a> are the two vulnerabilities that triggered the full chain of events in mid-June, leading to ten different issues, today.<\/p>\n <\/p>\n {Update:\u00a0August 11, 2021}<\/strong>\u00a0Yet another RCE zero-day exploit was added to the PrintNightmare class, tracked as CVE-2021-36958, that leverages Windows print spooler, print driver, and Windows Point and Print configuration settings. Microsoft had given a CVSS v3 score and released a hotfix<\/a> for the same in August Patch Tuesday<\/a>.<\/p>\n We urge organizations to address these vulnerabilities using the detection script<\/a>\u00a0and keep themselves up-to-date about the latest patches and security upgrades.<\/strong><\/p>\n A proof-of-concept was released on Github for the PrintNightmare bug – that botches the June Microsoft patch. Use CSW\u2019s script to detect this vulnerability.<\/b><\/p>\n<\/blockquote>\n On 21 June 2021, Microsoft had proclaimed<\/a> CVE-2021-1675 as an RCE capable bug that exists in their Windows Print Spooler service – a component that runs print client and print servers. However, it was only partially addressed as part of the June Microsoft Patch Tuesday<\/a>, fixing a low-impact Privilege Escalation component under the same CVE identifier.\u00a0<\/strong><\/p>\n <\/p>\n A zero-day RCE exploit for CVE-2021-1675, dubbed as PrintNightmare, was found earlier this week. Following this, a PoC exploit was released in the public domain and was rapidly cloned. The RCE vector is actively under attack, which makes the vulnerability highly sought after by cybercriminals.<\/p>\n Microsoft has now assigned a new CVE (CVE-2021-34527<\/a>) to the RCE component of this PrintNightmare vulnerability and\u00a0research<\/a> shows that the newly released official patch can be bypassed in some scenarios. Thus, it is important for organizations to know whether they are susceptible to this weakness.<\/p>\n Get the detection script here<\/a><\/p>\n <\/p>\n CSW Pentester\u2019s have released<\/a> a script to detect the Windows Print Spooler Remote Code Execution Vulnerability. Running the script can help organizations detect connected devices that could be vulnerable to exploits.<\/p>\n usage: detectprintnightmare.py [-h] [-t TARGET] [-T TARGETS] [-c CIDR]<\/p>\n optional arguments:<\/p>\n \u00a0\u00a0-h, –help\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 show this help message and exit<\/p>\n \u00a0\u00a0-t TARGET, –target TARGET<\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Single IP<\/p>\n \u00a0\u00a0-T TARGETS, –targets TARGETS<\/p>\n \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0List of IP in text file<\/p>\n \u00a0\u00a0-c CIDR, –cidr CIDR\u00a0 CIDR range<\/p>\n Run the script for single IP<\/p>\n python3 detectprintnightmare.py -t 192.168.0.1<\/p>\n <\/p>\n Run the script for Multiple ips by providing text file with ips<\/p>\n python3 detectprintnightmare.py -T ips.txt<\/p>\n <\/p>\n Run the script for CIDR<\/p>\n python3 detectprintnightmare.py -c 192.168.0.1\/24<\/p>\n PrintNightmare<\/a><\/p>\n<\/div>\n CVE-2021-1675 is a high-risk vulnerability that allows a hacker to execute system commands as a domain user to perform local Privilege Escalation and Remote Code Execution within Windows environments, through the Print Spooler. This vulnerability has a CVSS v3 score of 7.8 (high) and is classified under CWE-269<\/a> that leads to Improper Privilege Management.<\/p>\n Subsequent to the CISA warning<\/a> – On 2 July 2021, Microsoft had assigned<\/a> a new CVE tracked as CVE-2021-34527 for the same PrintNightmare bug in RpcAddPrinterDriverEx(). This vulnerability with the RCE attack vector has accredited a CVSS v3 score of 8.8.<\/p>\n <\/p>\n According to Microsoft, this remote code execution bug (CVE-2021-34527<\/a>), affects all versions of Windows, though the company is still investigating whether the vulnerability is exploitable on all of them. Compounding the risk to organizations further, there is currently no new or updated fix available for this issue.<\/p>\n <\/p>\n On 6 July 2021, Microsoft had issued an out-of-band patch<\/a> to fix the different versions of Windows, including the RCE vector of the PrintNightmare bug (CVE-2021-34527<\/a>). It has been discovered that the patch for the remote code execution vulnerability fails in some scenarios, thereby bypassing security safeguards and allowing attackers to run arbitrary code on affected devices.\u00a0<\/strong><\/p>\n On 15 July 2021, CVE-2021-34481<\/a>, a high severity Privilege Escalation vulnerability with a CVSS v3 score of 7.8<\/strong> was spotted on Windows Print Spooler. The vulnerability is likely to be exploited and can allow an attacker to execute unauthorized system actions. This vulnerability still remains unpatched. As a result, we recommend users to Stop<\/strong> and Disable<\/strong> the Print Spooler service in order to prevent an attack.<\/p>\n\n
Detection<\/h2>\n
Prerequisites<\/h2>\n
\n
Usage<\/h2>\n
python3 detectprintnightmare.py –help<\/h2>\n
Example: 1<\/h2>\n
Example: 2<\/h2>\n
Example: 3<\/h2>\n
Reference<\/h2>\n
Vulnerability Analysis<\/h2>\n
Tagged with a New CVE<\/h2>\n