A hot potato: Microsoft rushed to release a fix for the recently discovered 'PrintNightmare' vulnerability, pushing it as a mandatory security update for several Windows versions. Although the patch bolstered protection with the added requirement of admin credentials during installation of unsigned printer drivers on print servers, a security researcher and developer reverse engineered a Windows DLL to bypass Microsoft’s check for remote libraries and was able to exploit a fully patched server.

PrintNightmare allows a remote attacker to take advantage of a flaw in the Windows Printer Spooler service and execute arbitrary commands with escalated privileges. Microsoft quickly addressed the critical vulnerability - found on all Windows versions - with an out-of-band security update.

However, it now looks like the exploit could be turning into an actual nightmare for Microsoft and IT admins following a demonstration of how the fix could be bypassed to leave a fully patched server vulnerable to PrintNightmare.

Dealing with strings & filenames is hard😉
New function in #mimikatz 🥝to normalize filenames (bypassing checks by using UNC instead of \\server\share format)

So a RCE (and LPE) with #printnightmare on a fully patched server, with Point & Print enabled

> https://t.co/Wzb5GAfWfd pic.twitter.com/HTDf004N7r

— 🥝 Benjamin Delpy (@gentilkiwi) July 7, 2021

Benjamin Delpy, a security researcher and developer of the Mimikatz security tool, notes that Microsoft employs a "\\" check in the filename format to determine if a library is remote or not. However, it can be bypassed by using UNC , which allowed Delpy to run an exploit on a fully patched Windows Server 2019 with Point and Print service enabled.

Microsoft also notes in its advisory that using the 'Point and Print' technology "weakens the local security posture in such a way that exploitation will be possible." The combination of UNC bypass and the PoC (removed from GitHub but circulating on the web) potentially leaves room for attackers to cause widespread harm.

A flowchart to check if your network/device is vulnerable to PrintNightmare. Image Credit: Benjamin Delpy

Speaking to The Register , Delpy described the issue as "weird from Microsoft," noting that he believed the company did not test the fix for real. It remains to be seen when (and if) Microsoft can permanently patch 'PrintNightmare,' which has already begun disrupting workflows for organizations globally.

Many universities, for example, have started disabling campus-wide printing, while other internet-connected institutions and businesses that don't use remote printing still need to ensure that appropriate group policy settings are in place since 'PrintNightmare' is under active exploitation.