支持本站 — 捐款将帮助我们持续运营

目标: 1000 元，已筹: 1000 元

100.0%
立即捐款

POC详情: 231e96dbb3e091d0a6d88014fa0d3e1b16bc47c3

来源
https://github.com/Pwnrin/CVE-2022-30206
关联漏洞
标题:Microsoft Windows Print Spooler Components 权限许可和访问控制问题漏洞 (CVE-2022-30206)
Description:Microsoft Windows Print Spooler Components是美国微软（Microsoft）公司的一个打印后台处理程序组件。 Microsoft Windows Print Spooler Components存在权限许可和访问控制问题。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 10 Version 1809
Description
Exploit for CVE-2022-30206
介绍
# CVE-2022-30206
This is the PoC for CVE-2022-30206.

## Introduction
Perform the following operations to arbitrary file deletion：
1. Run the `addprinter.exe` to create a printer and set the SpoolDirectory in `C:\Users\Public\tmp\1`.
2. Run the `FileLock.exe TargetFile` to redirect .SHD file to TargetFile and set a oplock on TargetFile.
3. Run the `openprinter.exe` to make the printer work, which will trigger the oplock, then release the oplock, the TargetFile will be deleted.

![](display.gif)

## PS
1. This PoC needs to be combined with some other tricks(such as <https://github.com/thezdi/PoC/tree/master/FilesystemEoPs>) to make arbitrary file deletion to achieve EoP
2. If the execution is not successful at one time, you need to modify the .SHD filename of the FileLock's main.cpp. Normally, the file id is incremented by two each time after a print job, please try 00005.SHD、00007.SHD…
文件快照

 [4.0K]  /data/pocs/231e96dbb3e091d0a6d88014fa0d3e1b16bc47c3
├── [4.0K]  addpriner
│   ├── [4.0K]  addpriner
│   │   ├── [6.9K]  addpriner.vcxproj
│   │   ├── [ 945]  addpriner.vcxproj.filters
│   │   ├── [ 165]  addpriner.vcxproj.user
│   │   └── [1.8K]  main.cpp
│   └── [1.4K]  addpriner.sln
├── [268K]  display.gif
├── [4.0K]  FileLock
│   ├── [4.0K]  CommonUtils
│   │   ├── [3.5K]  CommonUtils.cpp
│   │   ├── [1023]  CommonUtils.h
│   │   ├── [5.3K]  CommonUtils.vcxproj
│   │   ├── [2.6K]  CommonUtils.vcxproj.filters
│   │   ├── [ 165]  CommonUtils.vcxproj.user
│   │   ├── [1.9K]  DirectoryObject.cpp
│   │   ├── [4.3K]  FileOpLock.cpp
│   │   ├── [ 753]  FileOpLock.h
│   │   ├── [4.7K]  FileSymlink.cpp
│   │   ├── [ 562]  FileSymlink.h
│   │   ├── [1.6K]  Hardlink.cpp
│   │   ├── [1.9K]  NativeSymlink.cpp
│   │   ├── [2.2K]  ntimports.h
│   │   ├── [5.0K]  RegistrySymlink.cpp
│   │   ├── [ 13K]  ReparsePoint.cpp
│   │   ├── [1.2K]  ReparsePoint.h
│   │   ├── [1.7K]  ScopedHandle.cpp
│   │   ├── [ 473]  ScopedHandle.h
│   │   ├── [ 290]  stdafx.cpp
│   │   ├── [ 260]  stdafx.h
│   │   ├── [ 306]  targetver.h
│   │   └── [1.3K]  typed_buffer.h
│   ├── [4.0K]  FileLock
│   │   ├── [7.5K]  FileLock.vcxproj
│   │   ├── [ 945]  FileLock.vcxproj.filters
│   │   ├── [ 221]  FileLock.vcxproj.user
│   │   └── [2.0K]  main.cpp
│   └── [2.1K]  FileLock.sln
├── [4.0K]  openprinter
│   ├── [4.0K]  openprinter
│   │   ├── [ 748]  main.cpp
│   │   ├── [6.9K]  openprinter.vcxproj
│   │   ├── [ 945]  openprinter.vcxproj.filters
│   │   └── [ 165]  openprinter.vcxproj.user
│   └── [1.4K]  openprinter.sln
└── [ 904]  README.md

7 directories, 39 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。