Tweet

🥝 Benjamin Delpy

27 Jul, 4 tweets, 2 min read

Little #printnightmare (ep 4.3) upgrade : user-to-system as a service🥝
> Open SYSTEM prompt

connect to \\printnightmare[.]gentilkiwi[.]com (remove [ ]) with
- user: .\gentilguest
- password: password

Open 'Kiwi Legit Printer - x64', enjoy SYSTEM
(just one printer this time🤪)

Of course, video quality: video.twimg.com/tweet_video/E7…

https://twitter.com/gentilkiwi/status/1416429891592011781

And how to protect you (reminder):

https://twitter.com/gentilkiwi/status/1416429891592011781

(cause you know, Microsoft does not make statements and fix for now...)

If this is slow, it's not my fault, "payload" is tiny

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @gentilkiwi

🥝 Benjamin Delpy

@gentilkiwi

20 Jul

@jonasLyk

Q: what can you do when you have #mimikatz🥝 & some Read access on Windows system files like SYSTEM, SAM and SECURITY?

A: Local Privilege Escalation 🥳

Thank you @jonasLyk for this Read access on default Windows😘

Ho, and this is not only SAM, but also SYSTEM & SECURITY.
So you can find "interesting" data, like:
- default windows install password (can be valid, trust me 👍)
- DPAPI computer keys (decrypt all computer private keys, etc.)
- Computer Machine account (silver ticket)
- ...

Affected versions / Not affected versions on my tests today:

Read 5 tweets

🥝 Benjamin Delpy

@gentilkiwi

17 Jul

Want to test #printnightmare (ep 4.x) user-to-system as a service?🥝
(POC only, will write a log file to system32)

connect to \\printnightmare.gentilkiwi.com with
- user: .\gentilguest
- password: password

Open 'Kiwi Legit Printer - x64', then 'Kiwi Legit Printer - x64 (another one)'

You can prevent this behavior by settings some parameters/GPO:

'Package Point and print - Approved servers'
> docs.microsoft.com/troubleshoot/w…
> admx.help/?Category=Wind…

Of course, disable outbound access to CIFS/SMB/RPC...

Very bad impersonation when: docs.microsoft.com/windows-hardwa…

Read 5 tweets

🥝 Benjamin Delpy

@gentilkiwi

30 Jun

This #printnightmare / CVE-2021-1675 is really serious 🤪

Just adapted/simplified original POC then:
*From Remote standard user to SYSTEM*

Here on a domain controller, but valid on all systems with RPC to spooler available, remote or local

➡️ disable service now (no patch yet)

As usual, video quality: video.twimg.com/tweet_video/E5…

@byt3bl33d3r

Yes, DC is 2019 and fully patched
And 'localspl.dll' is 06/06/2021 (10.0.17763.1999)

@byt3bl33d3r @allevon412 @PythonResponder

But to be transparent, I don't have a recent CPU & TPM 2.0
That might be the problem, @msftsecurity, isn't it?