CVE-2020-1048 PoC — Windows Print Spooler Elevation of Privilege Vulnerability

Source

https://github.com/talsim/printDemon2system

Associated Vulnerability

Title: Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2020-1048)
Description:An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

Description

PrintDemon (CVE-2020-1048) Privilege Escalation

Readme

# printDemon2system (CVE-2020-1048)
### PrintDemon privilege escalation to SYSTEM
PrintDemon was a logic vulnerability in the Windows Print Spooler service (**spoolsv.exe**).
The vulnerability was in the way the spooler handled print jobs to files, and when exploited allowed arbitrary writing to the file system as the SYSTEM user.

An example exploit of this vulnerability includes overwriting the *PrintConfig.dll* in the DriverStore directory, which is then loaded by **spoolsv.exe** that is running under the SYSTEM user context, when an XPS Print Job is started (as shown in this repository).

<div align="center">
  <div style="border: 1.5px solid #ccc; display: inline-block; padding: 4px;">
    <img src="/assets/printDemon2system.gif" alt="printDemon2system Exploit" width = 95% style="display: block; border: none;">
  </div>
  <p style="margin-top: 5px;"><em>Exploiting PrintDemon for Privilege Escalation (CVE-2020-1048). Compiled with VS2022 and tested on Windows 10 x64 version 1909 (build 18363.418)</em></p>
</div>

### References
* https://decoder.cloud/2019/11/13/from-arbitrary-file-overwrite-to-system/

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →