{"uuid": "322939b4-809c-4907-9cab-285a0362fce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1337", "type": "seen", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction&lt;o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.&lt;o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999&lt;o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048&lt;o:p Summary of the Vulnerability&lt;o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.&lt;o:p Print Spooler Basics&lt;o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:&lt;o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).&lt;o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.&lt;o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.&lt;o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)&lt;o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.&lt;o:p Spool Directory&lt;o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.&lt;o:p\n\n&lt;o:p Workflow of the CVE 2020-1030&lt;o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.&lt;o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.&lt;o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. &lt;o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.&lt;o:p\n\n\u00b7 An unprivileged user will [...]", "creation_timestamp": "2026-09-02T01:02:15.223348Z"}