How to Mitigate Microsoft Print Spooler Vulnerability – PrintNightmare

This week, PrintNightmare – Microsoft’s Print Spooler
vulnerability (CVE-2021-34527) was upgraded from a ‘Low’
criticality to a ‘Critical’ criticality.

This is due to a Proof of Concept published on GitHub, which
attackers could potentially leverage for gaining access to Domain
Controllers.

As we reported earlier^[1], Microsoft already
released a patch in June 2021, but it wasn’t enough to stop
exploits. Attackers can still use Print Spooler when connecting
remotely. You can find all you need to know about this
vulnerability in this article and how you can mitigate it (and you
can).

Print Spooler in a nutshell: Print Spooler is
Microsoft’s service for managing and monitoring files printing.
This service is among Microsoft’s oldest and has had minimal
maintenance updates since it was released.

Every Microsoft machine (servers and endpoints) has this feature
enabled by default.

PrintNightmare vulnerability: As soon as an
attacker gains limited user access to a network, he will be able to
connect (directly or remotely) to the Print Spooler. Since the
Print Spooler has direct access to the kernel, the attacker can use
it to gain access to the operating system, run remote code with
system privileges, and ultimately attack the Domain Controller.

Your best option when it comes to mitigating the PrintNightmare
vulnerability is to disable the Print Spooler on every server
and/or sensitive workstation (such as administrators’ workstations,
direct internet-facing workstations, and non-printing
workstations).

This is what Dvir Goren’s, hardening expert and CTO at CalCom Software Solutions^[2], suggests as your first
move towards mitigation.

Follow these steps to disable the Print Spooler service on
Windows 10:

1. Open Start.
2. Search for PowerShell, right-click on it and select the Run as
   administrator.
3. Type the command and press Enter: Stop-Service -Name
   Spooler -Force
4. Use this command to prevent the service from starting back up
   again during restart: Set-Service -Name Spooler -StartupType
   Disabled

According to Dvir’s experience, 90% of servers do not require
Print Spooler. It is the default configuration for most of them, so
it is usually enabled. As a result, disabling it can solve 90% of
your problem and have little impact on production.

In large and complex infrastructures, it can be challenging to
locate where Print Spooler is used.

Here are a few examples where Print Spooler is required:

1. When using Citrix services,
2. Fax servers,
3. Any application requiring virtual or physical printing of PDFs,
   XPSs, etc. Billing services and wage applications, for
   example.

Here are a few examples when Print Spooler is not needed but
enabled by default:

1. Domain Controller and Active Directory – the main risk in this
   vulnerability can be neutralized by practicing basic cyber hygiene.
   It makes no sense to have Print Spooler enabled in DCs and AD
   servers.
2. Member servers such as SQL, File System, and Exchange
   servers.
3. Machines that do not require printing.

A few other hardening steps suggested by Dvir for machines
dependent on Print Spooler include:

1. Replace the vulnerable Print Spooler protocol with a
   non-Microsoft service.
2. By changing ‘Allow Print Spooler to accept client connections’,
   you can restrict users’ and drivers’ access to the Print Spooler to
   groups that must use it.
3. Disable Print Spooler caller in Pre-Windows 2000 compatibility
   group.
4. Make sure that Point and Print is not configured to No Warning
   – check registry key SOFTWARE/Policies/Microsoft/Windows
   NT/Printers/PointAndPrint/NoElevationOnInstall for DWORD value
   1.
5. Turn off EnableLUA – check registry key
   SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/System/EnableLUA
   for DWORD value 0.

Here’s what you need to do next to ensure your organization is
secure:

1. Identify where Print Spooler is being used on your
   network.
2. Map your network to find the machines that must use Print
   Spooler.
3. Disable Print Spooler on machines that do not use it.
4. For machines that require Print Spooler – configure them in a
   way to minimize its attack surface.

Beside this, to find potential evidence of exploitation, you
should also monitor Microsoft-Windows-PrintService/Admin log
entries. There might be entries with error messages that indicate
Print Spooler can’t load plug-in module DLLs, although this can
also happen if an attacker packaged a legitimate DLL that Print
Spooler demands.

The final recommendation from Dvir is to implement these
recommendations through hardening automation tools^[3]. Without automation, you
will spend countless hours attempting to harden manually and may
end up vulnerable or causing systems to go down

After choosing your course of action, a Hardening automation tool^[4] will discover where
Print Spooler is enabled, where they are actually used, and disable
or reconfigure them automatically.