CVE-2021-1675 PoC — Windows Print Spooler Remote Code Execution Vulnerability

Description

A small powershell script to disable print spooler service using desired state configuration

Readme

# CVE-2021-1675 - PrintNightmare DSC Mitigation (PowerShell)

> Kougyoku Gentou | July 1, 2021

----------------------------------------------------------

[CVE-2021-1675](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675) is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

The mitigation is to disable Print Spooler service. Well, most websites say to do this on Domain Controllers only, but realistically it should be done on bascially any Windows Server that is not a print server. So let's fix it! This is using Powershell and Desired State Configuration to stop and disable the print spooler service from all computers in OUs of your choice. You might need to change up some of the variables in the top of the script to fit your environment, but should be self-explanatory.

File Snapshot

Remarks