From 6fc41c9a2365056124d4b1f09dd0488c6989e9fe Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Tue, 20 Jan 2026 18:03:55 +0100 Subject: [PATCH 1/3] Add PrintNightmare PointAndPrint policy check --- .../winPEASexe/winPEAS/Checks/SystemInfo.cs | 34 +++++++++++++++++++ winPEAS/winPEASps1/winPEAS.ps1 | 25 ++++++++++++++ 2 files changed, 59 insertions(+) diff --git a/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs b/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs index 94853fe..0aaf745 100644 --- a/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs +++ b/winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs @@ -88,6 +88,7 @@ namespace winPEAS.Checks PrintLocalGroupPolicy, PrintPotentialGPOAbuse, AppLockerHelper.PrintAppLockerPolicy, + PrintPrintNightmarePointAndPrint, PrintPrintersWMIInfo, PrintNamedPipes, PrintNamedPipeAbuseCandidates, @@ -836,6 +837,39 @@ namespace winPEAS.Checks } } + private static void PrintPrintNightmarePointAndPrint() + { + Beaprint.MainPrint("PrintNightmare PointAndPrint Policies"); + Beaprint.LinkPrint("https://itm4n.github.io/printnightmare-exploitation/", "Check PointAndPrint policy hardening"); + + try + { + string key = @"Software\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint"; + var restrict = RegistryHelper.GetDwordValue("HKLM", key, "RestrictDriverInstallationToAdministrators"); + var noWarn = RegistryHelper.GetDwordValue("HKLM", key, "NoWarningNoElevationOnInstall"); + var updatePrompt = RegistryHelper.GetDwordValue("HKLM", key, "UpdatePromptSettings"); + + if (restrict == null && noWarn == null && updatePrompt == null) + { + Beaprint.NotFoundPrint(); + return; + } + + Beaprint.NoColorPrint($" RestrictDriverInstallationToAdministrators: {restrict}\n" + + $" NoWarningNoElevationOnInstall: {noWarn}\n" + + $" UpdatePromptSettings: {updatePrompt}"); + + if (restrict == 0 && noWarn == 1 && updatePrompt == 2) + { + Beaprint.BadPrint(" [!] Potentially vulnerable to PrintNightmare misconfiguration"); + } + } + catch (Exception ex) + { + Beaprint.PrintException(ex.Message); + } + } + private static void PrintPrintersWMIInfo() { Beaprint.MainPrint("Enumerating Printers (WMI)"); diff --git a/winPEAS/winPEASps1/winPEAS.ps1 b/winPEAS/winPEASps1/winPEAS.ps1 index efd3268..c0a4c8c 100644 --- a/winPEAS/winPEASps1/winPEAS.ps1 +++ b/winPEAS/winPEASps1/winPEAS.ps1 @@ -821,6 +821,31 @@ $Hotfix = Get-HotFix | Sort-Object -Descending -Property InstalledOn -ErrorActio $Hotfix | Format-Table -AutoSize +# PrintNightmare PointAndPrint policy checks +Write-Host "" +if ($TimeStamp) { TimeElapsed } +Write-Host -ForegroundColor Blue "=========|| PRINTNIGHTMARE POINTANDPRINT POLICY" +$pnKey = "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" +if (Test-Path $pnKey) { + $pn = Get-ItemProperty -Path $pnKey -ErrorAction SilentlyContinue + $restrict = $pn.RestrictDriverInstallationToAdministrators + $noWarn = $pn.NoWarningNoElevationOnInstall + $updatePrompt = $pn.UpdatePromptSettings + + Write-Host "RestrictDriverInstallationToAdministrators: $restrict" + Write-Host "NoWarningNoElevationOnInstall: $noWarn" + Write-Host "UpdatePromptSettings: $updatePrompt" + + if (($restrict -eq 0) -and ($noWarn -eq 1) -and ($updatePrompt -eq 2)) { + Write-Host "Potentially vulnerable to PrintNightmare misconfiguration" -ForegroundColor Red + } else { + Write-Host "PointAndPrint policy is not in the known risky configuration" -ForegroundColor Green + } +} else { + Write-Host "PointAndPrint policy key not found" -ForegroundColor Gray +} + + #Show all unique updates installed Write-Host "" if ($TimeStamp) { TimeElapsed } From a363541d7798190dd6b8e2e3b83402afb8e113a1 Mon Sep 17 00:00:00 2001 From: codex-action Date: Tue, 20 Jan 2026 17:09:07 +0000 Subject: [PATCH 2/3] Fix CI failures for PR #564 --- .../linpeas_parts/1_system_information/16_Protections.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linPEAS/builder/linpeas_parts/1_system_information/16_Protections.sh b/linPEAS/builder/linpeas_parts/1_system_information/16_Protections.sh index 5d18f26..0d4ae1c 100644 --- a/linPEAS/builder/linpeas_parts/1_system_information/16_Protections.sh +++ b/linPEAS/builder/linpeas_parts/1_system_information/16_Protections.sh @@ -30,7 +30,7 @@ # Functions Used: echo_not_found, print_2title, print_list, warn_exec # Global Variables: # Initial Functions: -# Generated Global Variables: $ASLR, $hypervisorflag, $detectedvirt, $unpriv_userns_clone, $perf_event_paranoid, $mmap_min_addr, $ptrace_scope, $dmesg_restrict, $kptr_restrict, $unpriv_bpf_disabled +# Generated Global Variables: $ASLR, $hypervisorflag, $detectedvirt, $unpriv_userns_clone, $perf_event_paranoid, $mmap_min_addr, $ptrace_scope, $dmesg_restrict, $kptr_restrict, $unpriv_bpf_disabled, $protected_symlinks, $protected_hardlinks # Fat linpeas: 0 # Small linpeas: 0 From 1b8706aac6fb4f0c426365ef0dc48b05bd616b17 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Tue, 20 Jan 2026 23:04:35 +0100 Subject: [PATCH 3/3] Handle missing PointAndPrint values in PS1 --- winPEAS/winPEASps1/winPEAS.ps1 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/winPEAS/winPEASps1/winPEAS.ps1 b/winPEAS/winPEASps1/winPEAS.ps1 index c0a4c8c..5aa6f48 100644 --- a/winPEAS/winPEASps1/winPEAS.ps1 +++ b/winPEAS/winPEASps1/winPEAS.ps1 @@ -836,7 +836,10 @@ if (Test-Path $pnKey) { Write-Host "NoWarningNoElevationOnInstall: $noWarn" Write-Host "UpdatePromptSettings: $updatePrompt" - if (($restrict -eq 0) -and ($noWarn -eq 1) -and ($updatePrompt -eq 2)) { + $hasAllValues = ($null -ne $restrict) -and ($null -ne $noWarn) -and ($null -ne $updatePrompt) + if (-not $hasAllValues) { + Write-Host "PointAndPrint policy values are missing or not configured" -ForegroundColor Gray + } elseif (($restrict -eq 0) -and ($noWarn -eq 1) -and ($updatePrompt -eq 2)) { Write-Host "Potentially vulnerable to PrintNightmare misconfiguration" -ForegroundColor Red } else { Write-Host "PointAndPrint policy is not in the known risky configuration" -ForegroundColor Green