Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these techniques against systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal in virtually every jurisdiction and can carry severe penalties.
Introduction
The Windows Print Spooler service (spoolsv.exe) has been one of the richest privilege-escalation surfaces in the OS for the last decade, precisely because of a design choice that has never fundamentally changed: it runs as NT AUTHORITY\SYSTEM, it is enabled by default on almost every Windows workstation and server (including domain controllers), and its RPC interface (MS-RPRN, and the printer-asynchronous-notification companion MS-PAR) exposes printer-driver installation to authenticated, low-privileged callers. PrintNightmare is the umbrella name for a pair of 2021 vulnerabilities in that driver-installation path — CVE-2021-1675, originally triaged as a low-severity local privilege escalation, and CVE-2021-34527, the related remote-code-execution variant discovered shortly after — both rooted in insufficient access control around the RpcAddPrinterDriverEx RPC call.
The impact is severe and disproportionate to how the bug looks on paper: any authenticated user who can reach the spooler’s local or remote RPC endpoint can get the spooler process to load and execute an arbitrary DLL as SYSTEM. Locally this is instant privilege escalation from a standard user to SYSTEM with no dependency on a kernel exploit or a memory-corruption primitive — just an RPC call. Remotely, the same primitive lets a low-privileged domain user compromise any machine (including domain controllers) with the spooler running and reachable over SMB/RPC. Because the spooler ships enabled by default and many organizations were reluctant to disable it (print servers, terminal servers), PrintNightmare remained a live, actively exploited issue for months after patches shipped.
Attack Prerequisites
PrintNightmare’s local variant has a very low bar — this is what makes it dangerous:
- A standard, authenticated local session — no local administrator rights are required to call the driver-installation RPC methods.
- The Print Spooler service running (
Spooler,spoolsv.exe) — the default state on client and server SKUs alike. - An unpatched build, or a patched build with
RestrictDriverInstallationToAdministratorsleft at its pre-mitigation value /NoWarningNoElevationOnInstallstill enabled under the Point-and-Print policy. - A driver package the exploit can stage — the payload is delivered as a “printer driver” (an attacker DLL plus a matching INF), either from a local path or a UNC share the attacker controls.
How It Works
The spooler exposes printer driver management over RPC through RpcAddPrinterDriverEx (and the older RpcAddPrinterDriver). Legitimate use is: an administrator points the API at an INF-described driver package so the spooler can copy the driver DLL into %SystemRoot%\System32\spool\drivers\<arch>\<version> and load it into its own SYSTEM process for print processing. The core bug is that the spooler’s authorization check for who is allowed to *install* a new driver was insufficient — a caller with no special privileges could invoke the same RPC method with the APD_INSTALL_WARNED_DRIVER flag set, which instructs the spooler to proceed even though the driver isn’t WHQL-signed and to suppress the elevation prompt a GUI install would normally show. The result: the spooler, as SYSTEM, copies the attacker’s DLL into its driver store and loads it — arbitrary code execution in a SYSTEM process, no interactive consent involved.
The Point-and-Print policy family compounds the exposure. Point-and-Print was designed so that ordinary users could connect to a shared printer and have Windows silently fetch and install the correct driver without an admin prompt — convenient for print servers, catastrophic for security, because it deliberately relaxes the same driver-installation trust boundary that PrintNightmare abuses. Registry policy values under PointAndPrint (NoWarningNoElevationOnInstall, UpdatePromptSettings) control whether users get warned or elevated before a new/updated driver installs; when they’re set to skip the prompt (a common configuration on managed fleets to reduce helpdesk tickets) the RPC-level bug and the policy-level convenience feature line up perfectly to let SYSTEM code execution happen silently.
Locally, no network hop is even needed — a logged-on user talks to the spooler’s local RPC endpoint (over the \pipe\spoolss named pipe or local RPC transport) and stages the malicious driver from a local path, so the whole chain from standard user to SYSTEM completes in a single process launch.
Vulnerable Code / Configuration
The policy that determines whether unsigned/unelevated driver installs are silently permitted lives here — this is the single value defenders should check first on any fleet:
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
NoWarningNoElevationOnInstall = 1 ; REG_DWORD, vulnerable value
UpdatePromptSettings = 0 ; REG_DWORD, vulnerable value
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators = 0 ; post-patch mitigation, disabled
With NoWarningNoElevationOnInstall set to 1, any user is allowed to install a printer driver without a warning dialog or admin credential prompt — this is exactly the client-side trust decision that RpcAddPrinterDriverEx abuses server-side. After Microsoft’s July 2021 out-of-band patch, RestrictDriverInstallationToAdministrators defaults to enabled and blocks non-admins from calling the driver-install RPCs outright, regardless of Point-and-Print settings — confirming a target is vulnerable means confirming this key is absent, set to 0, or that the patch level predates it.
On an unpatched host, the spooler’s own service state is the second thing to confirm — a stopped/disabled spooler removes the attack surface entirely regardless of registry policy:
Get-Service Spooler | Select-Object Status, StartType
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
Walkthrough / Exploitation
The community proof-of-concept most engagements use for the local variant is cube0x0’s PowerShell implementation, commonly distributed as Invoke-Nightmare, which builds a minimal malicious driver DLL on the fly and drives the vulnerable RPC calls directly — no SMB share or second host required for the local case:
# Confirm spooler is up and the local-priv-esc primitive is reachable
Get-Service Spooler
# Load the PoC and create a new local administrator via the exploit
Import-Module .\Invoke-Nightmare.ps1
Invoke-Nightmare -NewUser "pnight" -NewPassword "P@ssw0rd123!"
# Verify escalation
net localgroup administrators
Under the hood the script drops a payload DLL (its DllRegisterServer / install routine adds the local user and group membership), writes a matching INF, and calls the vulnerable driver-installation RPC against the local spooler endpoint with the flag that suppresses signature and elevation checks. The spooler process loads the DLL as SYSTEM, the export runs, and pnight lands in Administrators — full SYSTEM-equivalent access follows immediately (PsExec64.exe -s cmd.exe, a scheduled task as SYSTEM, or simply logging on as the new admin).
Where the PowerShell PoC is blocked (AMSI/Defender signatures), the same primitive is available as a compiled C# tool, SharpPrintNightmare, or via the original CVE-2021-1675.ps1 / printnightmare.py variants — all target the identical RpcAddPrinterDriverEx weakness, differing only in payload delivery and language:
# Compiled alternative when PowerShell script execution is constrained
SharpPrintNightmare.exe C:\payload\evil.dll
Note: The remote variant (CVE-2021-34527) is functionally the same RPC abuse but stages the driver package from an attacker-controlled SMB share (
\\attacker\share) reachable by the target, which is why it was weaponized so quickly against domain controllers — a single low-priv domain account with network line-of-sight to the DC’s spooler was sufficient. Confirm which CVE applies to a given target build before reporting; Microsoft shipped several rounds of partial and then complete fixes through mid-to-late 2021, so patch level matters more than the CVE label.
Opsec: The spooler writes explicit driver-install telemetry — this exploit is not quiet. Expect entries in the
Microsoft-Windows-PrintService/Adminand/Operationallogs and, on instrumented hosts, a Sysmon image-load event forspoolsv.exepulling in a freshly written, unsigned DLL from the driver store. Favor the local variant over the remote share variant on monitored environments — it avoids the SMB connection and share-access telemetry that the remote path generates.
Detection and Defense
PrintNightmare is a patchable bug with a config-level fallback — prioritize both:
- Patch fully — apply Microsoft’s cumulative updates covering CVE-2021-1675 and CVE-2021-34527; partial patches from the initial response window left variants exploitable, so confirm current patch level rather than “a” patch being installed.
- Set
RestrictDriverInstallationToAdministrators = 1under thePointAndPrintpolicy key so only admins can install drivers even on an otherwise-vulnerable build. - Disable the spooler where it isn’t needed —
Stop-Service Spooler; Set-Service Spooler -StartupType Disabled— especially on domain controllers, which almost never need to print. - Monitor
Microsoft-Windows-PrintService/Operationaland/Adminfor driver-installation events, and Sysmon Event ID 7 for unsigned DLLs image-loaded byspoolsv.exefrom the driver store paths. - Flag anomalous child processes of
spoolsv.exe— the spooler spawningcmd.exe,powershell.exe, or unexpected binaries is a strong indicator of exploitation regardless of which variant.
Real-World Impact
PrintNightmare was disclosed and weaponized in June/July 2021 after proof-of-concept code was briefly published and pulled, triggering an out-of-band Microsoft patch. It was rapidly adopted by red teams and, per public incident reporting at the time, by ransomware-affiliated actors as a fast path from an initial low-privilege foothold to domain controller compromise, because so many enterprise DCs still had the spooler running by default. It remains one of the highest-value checks in an internal Windows assessment years later, since “disable the spooler on DCs” is advice organizations frequently still haven’t fully adopted.
Conclusion
PrintNightmare persists as a case study in why a SYSTEM-context service with a broad, authenticated RPC surface is inherently high-risk: a single insufficient authorization check in driver installation turned into SYSTEM code execution for any logged-on user. Patching closes the specific RPC hole, but the durable fix is architectural — keep the spooler off wherever it isn’t needed and lock driver installation to administrators everywhere else.
You Might Also Like
If you found this useful, these related deep-dives cover adjacent techniques and their defenses:
Comments