admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update printnightmare_cve_2021_1675.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-07-01 15:14:22 -06:00
parent 2029cf855f
commit 63bdd403b0
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/printnightmare_cve_2021_1675.yml
+9 -3
View File
@@ -5,11 +5,17 @@ date: '2021-07-01'
author: Splunk Threat Research Team
type: batch
description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine.
narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \
narrative: 'This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \
Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLLs to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \
The prerequisites for successful exploitation consist of: \
In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.'
1. Print Spooler service enabled on the target system \
1. Network connectivity to the target system (initial access has been obtained) \
1. Hash or password for a low privileged user ( or computer ) account. \
In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below.'
references:
- https://github.com/cube0x0/CVE-2021-1675/
- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/