🧠 PrintNightmare (CVE-2021-1675)

What is it?

• Concept: The Windows Print Spooler service (spoolsv.exe) runs as NT AUTHORITY\SYSTEM and exposes an RPC interface — RpcAddPrinterDriverEx — meant to let administrators install signed printer driver packages. A validation bug in that interface fails to properly enforce the caller’s privilege and lets an attacker register a driver package that isn’t actually theirs to install; since the Spooler loads and runs that driver’s DLL inside its own SYSTEM-level process, registering a malicious “driver” is straightforward code execution as SYSTEM.
• Impact: Any low-privileged local user (or, for the closely-related remote variant, any authenticated network user) on a host with the Print Spooler service enabled and unpatched gets NT AUTHORITY\SYSTEM — no other misconfiguration required, and the Spooler is enabled by default on nearly every Windows install.

How it works

1. RpcAddPrinterDriverEx is part of the Print System Remote Protocol and is meant to let administrators register a new printer driver, referencing a DLL the Spooler service will load to service future print jobs.
2. The vulnerable code path doesn’t properly enforce that the calling principal actually holds administrative rights when registering that driver, and separately mishandles the case where the “new” driver path is one the caller already controls — the combination lets a normal local (or authenticated remote) principal register their own DLL as a legitimate driver package.
3. When the Spooler subsequently loads that “driver,” it executes the attacker’s DLL directly inside spoolsv.exe’s own SYSTEM-level process — the entire exploit chain is that one RPC call plus triggering the driver load.
4. Public PoCs bundle a pre-built DLL that just creates a new local administrator account (the path of least effort for a generic exploit), but the underlying primitive supports loading any DLL — arbitrary SYSTEM code execution, not just account creation.

Exploitation

Prerequisites

• Local code execution (any privilege level) on a Windows host with the Print Spooler service running and unpatched (pre-July 2021 cumulative update, or later if a subsequent bypass applies)

Attack Vectors

# 1. Load the exploit function into the current session
Import-Module .\CVE-2021-1675.ps1

# 2. Register a new, arbitrarily-named printer driver via the vulnerable RPC call —
# the bundled default DLL creates a local admin with the given credentials
Invoke-Nightmare -NewUser '<new_user>' -NewPassword '<new_password>' -DriverName '<arbitrary_driver_name>'

# 3. Confirm the new account landed in the local Administrators group
net localgroup administrators

From there, authenticate as the new local administrator through any remote-management channel already available (WinRM, PsExec) for a SYSTEM-equivalent session.

Notes

• -DriverName is just an attacker-chosen label for the new driver package being registered — it doesn’t need to match any driver actually installed on the target. This is different from Metasploit’s ricoh_driver_privesc module, which specifically abuses an already-installed vulnerable driver rather than registering a fresh one, so it only applies when that exact driver happens to be present.
• The default bundled DLL only creates a local administrator account; -DLL <path> swaps in any custom-compiled payload when a direct SYSTEM shell (rather than a new admin account) is the goal.
• Frequently discussed alongside PrintNightmare’s original remote/authenticated RCE variant (CVE-2021-34527) — same root cause and RPC call, different vantage point (remote authenticated vs. local).

Mitigation

• Fix: Apply the July 2021+ cumulative updates that enforce administrator validation on RpcAddPrinterDriverEx, and disable the Print Spooler service entirely on hosts that don’t functionally need to print — especially domain controllers and servers.

Related Usage

File	Created
HTB - Driver	July 24, 2026

---

References:

• CVE-2021-1675 - calebstewart/CVE-2021-1675 (GitHub)
• Microsoft MSRC - CVE-2021-1675