BeetleChunks/SpoolSploit

GitHubRepository PoC

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2021-1675CVE-2021-34527Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker container based on Ubuntu 20.04 that packages a Python exploit tool (SpoolSploit) targeting Windows Print Spooler vulnerabilities, along with an SMB server and Responder for credential relay. The environment is designed for practical exploitation exercises.

README.md:1-3Dockerfile:1-74

Lab assessment

Vulnerability lab

The README explicitly states the container is a collection of Windows print spooler exploits for practical exploitation, and the Dockerfile builds an environment with exploit scripts, an SMB server, and credential relay tools.

README.md:1-3Dockerfile:1-74
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

SpoolSploit exploit script

exploit toolvulnerability exercise

A Python script (spool_sploit.py) that implements two attacks: 'spoolsample' to coerce Windows machine account authentication, and 'nightmare' to exploit PrintNightmare for remote DLL execution. It uses Impacket for RPC calls.

ssploit/spool_sploit.py:1-474README.md:1-3

SMB server

file serverexploit staging

A Python SMB server (smb_server.py) based on Impacket, configured via smb-v1.conf. It serves a share (./share) intended to host malicious DLLs for the PrintNightmare attack.

smbserver/smb_server.py:1-31smbserver/smb-v1.conf:1-21README.md:56-60

Responder

credential relaynetwork attack tool

Cloned from a GitHub repository into /Responder. Used to capture and relay machine account credentials obtained from the spoolsample attack.

Dockerfile:22README.md:50-52

Impacket (BeetleChunks fork)

RPC libraryexploit dependency

A forked version of Impacket installed from GitHub. Provides the RPC transport and print spooler protocol implementations used by the exploit script.

Dockerfile:18-20ssploit/spool_sploit.py:14-15

Ubuntu 20.04 base

operating systemruntime environment

The base Docker image providing the Linux environment for all tools.

Dockerfile:1
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2021-1675

Supported by supplied evidence

The README explicitly associates the PrintNightmare attack with CVE-2021-1675, and the exploit script implements the PrintNightmare attack path.

README.md:54ssploit/spool_sploit.py:1-474

CVE-2021-34527

Supported by supplied evidence

The README credits the discovery of the PrintNightmare exploit to Zhiniang Peng and Xuefeng Li, and lists CVE-2021-34527 alongside CVE-2021-1675 in the credits section.

README.md:90-92
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:14-16
  • Port 445 on the Docker host should be free or the container run in a bridged VM to allow SMB server and credential relay.README.md:10-12
  • A Windows target with the Print Spooler service enabled and accessible over SMB (port 445 or 139).ssploit/spool_sploit.py:1-474README.md:1-3
  • Valid domain credentials for the target Windows system.ssploit/spool_sploit.py:1-474README.md:40-48
  • For the PrintNightmare attack, a malicious DLL must be placed in the SMB share.README.md:56-60

Evidence-described exercise path

  1. Build the Docker image from the Dockerfile.README.md:16-18
  2. Run the container with port 445 mapped.README.md:19-21
  3. Attach to the container shell.README.md:22-24
  4. Execute spool_sploit.py with the 'spoolsample' attack to coerce target authentication, then use Responder to relay credentials.README.md:50-52ssploit/spool_sploit.py:1-474
  5. Alternatively, execute spool_sploit.py with the 'nightmare' attack, after placing a malicious DLL in the SMB share, to achieve remote code execution on the target.README.md:54-60ssploit/spool_sploit.py:1-474
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at external Windows targets as part of documented vulnerability exercises. The container does not attempt to escape, persist, or compromise the Docker host or external systems beyond the intended lab target. Port mapping and privileged mode are not used; the container runs as a non-root user.

Dockerfile:1-74ssploit/spool_sploit.py:1-474README.md:1-94
Review boundaries

What the analysis did not establish

  • The packet does not include a Docker Compose file or runtime instructions beyond the Dockerfile and README; the exact container invocation and network setup are not fully specified.
  • The behavior of the cloned Responder and Impacket repositories is not inspected; only their intended use is described in the README.
  • The malicious DLLs that would be used in the PrintNightmare attack are not provided, so the full exploit chain cannot be assessed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2