Skip to main content
picoCTF Solutions
picoCTF 2022Binary ExploitationMedium

CVE-XXXX-XXXX picoCTF 2022 Solution

Identify the CVE for the first Windows Print Spooler remote code execution vulnerability of 2021.

Published: July 20, 2023Updated: August 25, 2026

Description

The prompt only describes the first Windows Print Spooler remote code execution vulnerability disclosed in 2021. Identify the matching CVE and submit it in the picoCTF flag format.

Setup

View CVE-2021-34527

The challenge prompt asks: "Can you reproduce the CVE for the first Windows Print Spooler Remote Code Execution Vulnerability of 2021?"

Search the literal phrasing of the prompt - every result references PrintNightmare.

Open the CVE database entry to verify the identifier CVE-2021-34527.

Wrap that ID in the picoCTF format: picoCTF{CVE-2021-34527} (dashes preserved from the CVE ID).

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1Pivot on the clue
    Observation
    The prompt names a product, Windows Print Spooler, a vulnerability class, remote code execution, and a year. Search those exact terms against a public database like MITRE or cve.org for the canonical entry.
    Search the literal prompt. Every top result names PrintNightmare; cross-check against MITRE/cve.org to confirm CVE-2021-34527.
    What didn't work first

    Tried: Searching for 'Windows Print Spooler vulnerability 2021' and landing on CVE-2021-1675 instead.

    CVE-2021-1675 was an earlier, related Print Spooler patch from June 2021, initially mislabelled as the same bug though it only fixed a local privilege escalation rather than the remote code execution path. The challenge asks for the full remote code execution CVE, which is CVE-2021-34527. MITRE, the Microsoft advisory, and CISA all name that one as PrintNightmare's RCE identifier.

    Tried: Searching broadly for 'Print Spooler CVE' without the year and finding a different year's entry.

    Print Spooler has collected many CVEs over the years. Without anchoring the search to 2021 and to remote code execution specifically, you surface older, unrelated bugs. Adding the year and the PrintNightmare name narrows it to the right entry at once.

    Learn more

    Sample search verification. Querying "Windows Print Spooler RCE 2021" returns Microsoft Security Update Guide, Project Zero, CISA, and most major vendors - all naming the bug PrintNightmare and pointing at CVE-2021-34527. Multiple independent sources naming the same CVE is the signal that you have the right one (not a related but distinct bug like CVE-2021-1675, which was the partial fix that didn't actually fix it).

    CVE (Common Vulnerabilities and Exposures) is the public catalog maintained by MITRE. Each entry has a unique CVE-YEAR-NUMBER ID. PrintNightmare(CVE-2021-34527) hit the Windows Print Spooler service - which runs as SYSTEM and is enabled by default - allowing any authenticated user, including a low-privileged one, to run code as SYSTEM on a remote spooler. It became notorious because a PoC leaked before Microsoft's patch.

    The skill being tested is OSINT: given a description, find the canonical identifier. This is what defenders do daily when correlating threat intel against scanner output.

  2. Step 2Submit the CVE
    Observation
    The flag format wraps an identifier in picoCTF{...}, and a CVE ID carries dashes as part of its canonical form. Keep those dashes exactly as written when you build the flag.
    Wrap the ID in the picoCTF format, keeping the dashes from the CVE ID: picoCTF{CVE-2021-34527}.
    What didn't work first

    Tried: Submitting just the number portion without dashes, like picoCTF{CVE202134527}.

    CVE IDs are always written with their dashes intact as part of the canonical format (CVE-YEAR-NUMBER). Dropping the dashes produces an unrecognized identifier. The flag must preserve the exact formatting: picoCTF{CVE-2021-34527}.

    Tried: Submitting the vulnerability name 'PrintNightmare' as the flag instead of the CVE ID.

    PrintNightmare is the colloquial nickname for this vulnerability, not its official identifier. The challenge asks for the CVE number, which is the standardized catalog ID. The correct answer wraps the CVE ID - not the nickname - in the picoCTF flag format.

    Learn more

    The CVE ID lives directly in the URL path on cve.org: https://www.cve.org/CVERecord?id=CVE-2021-34527. Pull the value of the id query parameter and you have your answer. NVD does the same: https://nvd.nist.gov/vuln/detail/CVE-2021-34527.

    Resources for CVE work: cve.org (the canonical MITRE list), nvd.nist.gov(adds CVSS scores), and vendor advisories (Microsoft's Security Update Guide for this one). CVSS rates severity 0-10; NVD scores PrintNightmare 8.8 (high), since it needs valid credentials to reach the spooler. Defenders patch the 9.x scores first.

    Other high-profile CVEs worth recognizing: Log4Shell (CVE-2021-44228), EternalBlue (CVE-2017-0144), Heartbleed (CVE-2014-0160).

Flag

Reveal flag

picoCTF{CVE-2021-34527}

This is the PrintNightmare vulnerability affecting the Windows Print Spooler service. The CVE ID appears in the cve.org URL path.

Key takeaway

The CVE system gives every publicly disclosed vulnerability a unique identifier, so defenders, vendors, and researchers can name the same bug precisely. Mapping a description back to its CVE is core OSINT: search the product, the vulnerability class, and the year, then cross-reference MITRE, NVD, and the vendor advisory to confirm. PrintNightmare stands out because it hit a default-enabled service running as SYSTEM, and a proof of concept leaked publicly before a complete patch existed.

Useful tools for Binary Exploitation

Where to go next

Try these next