Windows Print Spooler Remote Code Execution and Privilege Escalation Vulnerability (PrintNightmare - CVE-2021-1675)

1. Vulnerability Overview & Root Cause

This vulnerability, widely known as 'PrintNightmare', is a critical remote code execution (RCE) and local privilege escalation (LPE) flaw in the Windows Print Spooler service. The root cause lies in the design of the RpcAddPrinterDriverEx() API function, which fails to properly restrict access and validate file paths when installing new printer drivers. This allows an authenticated user to bypass privilege checks and force the service to load malicious driver files.

2. Exploitation Mechanics & Attack Scenario

An attacker establishes an RPC connection to the target's Print Spooler service. By invoking the RpcAddPrinterDriverEx() function, the attacker passes a UNC path pointing to a malicious DLL hosted on an attacker-controlled SMB share (e.g., \\attacker_ip\share\malicious.dll). Because the Print Spooler service runs under the highly privileged NT AUTHORITY\SYSTEM context, it copies the remote DLL into the local driver directory (C:\Windows\System32\spool\drivers\...) and executes it, granting the attacker immediate SYSTEM-level code execution.

3. Infrastructure & Business Impact

This vulnerability poses an extreme risk to Active Directory (AD) environments. Since Domain Controllers (DCs) often run the Print Spooler service by default, any domain user account compromised by an attacker can be leveraged to gain SYSTEM privileges on the DC. This leads to complete domain compromise, enabling widespread ransomware deployment, credential harvesting, and permanent infrastructure takeover.