CVE-2021-1675 PoC — Windows Print Spooler Remote Code Execution Vulnerability

Source

Associated Vulnerability

Description

Temporary mitigation to the CVE-2021-1675. 'Spooler' service-disabled based on time schedule. PowerShell Scripts and Task Scheduler code provided. 

Readme

# CVE-2021-1675-Mitigation-For-Systems-That-Need-Spooler
A temporary mitigation to the CVE-2021-1675. Print Spooler will be disabled during non-business hours. 

The idea is too automatically disabled the 'spooler' service inside of Windows when users will not be onsite or not needing a print server. This is due to no active patch, and customers will still need to print. This method of turning off the service when it is not needed will reduce the threat vector.

This was achived by creating powershell scripts that stop and start the service 'spooler'. 

**Step 1:** Open PowerShell ISE as administrator.
**Step 2:** Create a new script (File > New) 
  On line 1 enter:  Get-Service -DisplayName "Print Spooler" | Stop-Service
  
 ![CVE-2021-1675-mit 006](https://user-images.githubusercontent.com/80491750/124361973-14556080-dbe7-11eb-8b1c-9b7fa74c03e9.png)

Save this file as ['stop-print-spooler'](https://github.com/gohrenberg/CVE-2021-1675-Mitigation-For-Systems-That-Need-Spooler/blob/main/stop-print-spooler-v1.1.ps1) 

**Step 3:** Create another new script (File > New)
  On line 1 enter: Get-Service -DisplayName "Print Spooler" | Start-Service
  
![CVE-2021-1675-mit 0019](https://user-images.githubusercontent.com/80491750/124330608-a48d9a00-db42-11eb-94f8-379d828eebdd.png)

Save this file as ['start-print-spooler'](https://github.com/gohrenberg/CVE-2021-1675-Mitigation-For-Systems-That-Need-Spooler/blob/main/start-print-spooler-v1.1.ps1)

**Step 4:** Open the 'Task Scheduler', Right click on 'Task Scheduler Library' > 'Create Task' 

![CVE-2021-1675-mit 0013](https://user-images.githubusercontent.com/80491750/124330771-f3d3ca80-db42-11eb-884e-c699ebe26c4d.png)

  Name the Task 'Stop Print Spooler -v1', Select 'Run whether used is logged on or not'. Click the checkbox for 'Do not store password. The task will only have access to local computer resources.
  
  ![CVE-2021-1675-mit 001](https://user-images.githubusercontent.com/80491750/124331064-8bd1b400-db43-11eb-99e9-fdb19152fbee.png)
 
Now a trigger has to be added - I choose to do it based off of time. 
 
![CVE-2021-1675-mit 0010](https://user-images.githubusercontent.com/80491750/124332159-ac9b0900-db45-11eb-880f-46097997c43e.png)

Now add an action Click 'New...' 

![CVE-2021-1675-mit 002](https://user-images.githubusercontent.com/80491750/124331407-fda9fd80-db43-11eb-85de-cc1bc125bbda.png)

The action will be 'Start a program'. The program is 'powershell' and then in arguments -File C://location *this is location of the powershell script to turn off the spooler* 

![CVE-2021-1675-mit 003](https://user-images.githubusercontent.com/80491750/124331523-34801380-db44-11eb-8d29-ec53aa124982.png)

This task has been saved as ['Stop Print Spooler Task -v1'](https://github.com/gohrenberg/CVE-2021-1675-Mitigation-For-Systems-That-Need-Spooler/blob/main/Stop%20Print%20Spooler%20Task%20-v1.xml)

Repeat these steps to have the service restart based off of time. The next task is ['Start Print Spooler Task -v1](https://github.com/gohrenberg/CVE-2021-1675-Mitigation-For-Systems-That-Need-Spooler/blob/main/Start%20Print%20Spooler%20Task%20-v1.xml) 

File Snapshot

 [4.0K]  /data/pocs/8204f79ed37b1d7ed1e1d3ed02e5c5a7e8edcb2d
├── [6.9K]  LICENSE
├── [3.1K]  README.md
├── [4.1K]  Start Print Spooler Task -v1.xml
├── [  59]  start-print-spooler-v1.1.ps1
├── [3.9K]  Stop Print Spooler Task -v1.xml
└── [  58]  stop-print-spooler-v1.1.ps1

0 directories, 6 files

Remarks