byt3bl33d3r/ItWasAllADream

It Was All A Dream

A CVE-2021-34527 (a.k.a PrintNightmare) Python Scanner. Allows you to scan entire subnets for the PrintNightmare RCE (not the LPE) and generates a CSV report with the results. Tests exploitability over MS-PAR and MS-RPRN.

This tool has "de-fanged" versions of the Python exploits, it does not actually exploit the hosts however it does use the same vulnerable RPC calls used during exploitation to determine if hosts are vulnerable.

Update July 7th 2021: This also checks if host(s) are vulnerable using the UNC bypass discovered by @gentilkiwi

Why?

POV, trying to determine if something is vulnerable to PrintNightmare:

At the time of writing, the amount of variables that determine if a machine is vulnerable is crazy and confusing.

Alternatives

• Pingcastle (C#)

Installation

This tool currently needs cube0x0's Impacket fork containing the MS-PAR implementation necessary for one of the checks. This change has been submitted to Impacket in this pull request.

You need to install Impacket from git as it has the MS-PAR implementation necessary for one of the checks. (Both of the installation methods below do this automatically for you)

Docker:

git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && docker build -t itwasalladream .
docker run -it itwasalladream -u user -p password -d domain 192.168.1.0/24

Dev install requires Poetry:

git clone https://github.com/byt3bl33d3r/ItWasAllADream
cd ItWasAllADream && poetry install && poetry shell
itwasalladream -u user -p password -d domain 192.168.1.0/24

Usage

usage: itwasalladream [-h] -u USERNAME [-p PASSWORD] -d DOMAIN [--timeout TIMEOUT] [--threads THREADS] [-v] [--csv-column CSV_COLUMN] target

PrintNightmare (CVE-2021-34527) scanner

positional arguments:
  target                Target subnet in CIDR notation, CSV file or newline-delimited text file

optional arguments:
  -h, --help            show this help message and exit
  -u USERNAME, --username USERNAME
                        username to authenticate as (default: None)
  -p PASSWORD, --password PASSWORD
                        password to authenticate as. If not specified will prompt. (default: None)
  -d DOMAIN, --domain DOMAIN
                        domain to authenticate as (default: None)
  --timeout TIMEOUT     Connection timeout in secods (default: 30)
  --threads THREADS     Max concurrent threads (default: 100)
  -v, --verbose         Enable verbose output (default: False)
  --csv-column CSV_COLUMN
                        If target argument is a CSV file, this argument specifies which column to parse (default: DNSHostName)

I used to read Word Up magazine!

As the exploit requires you to be authenticated to Active Directory, you need to supply credentials. If the password isn't supplied it will prompt you to enter it.

By default it will use 100 threads, you can increase/decrease these using the -t argument.

After its done you'll see a report_<timestamp>.csv file in your current directory with the results.

Credits

• cube0x0 for implementing the MS-PAR & MS-RPRN protocols in Impacket and creating the PrintNightmare Python Exploits
• Zhiniang Peng & Xuefeng Li for the discovery of the PrintNightmare exploit.