{"uuid": "18a93e1a-932e-4b9b-89a1-09a8256eef21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1337", "type": "seen", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "creation_timestamp": "2026-09-02T01:02:14.935689Z"}