{"uuid": "3cb22611-35b5-4b98-87bc-60c255d2d1d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-1048", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Yarden Shafir\", \"Alex Ionescu\", \"shubham0d\", \"bwatters-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This exploit leverages a file write vulnerability in the print spooler service\\n          which will restart if stopped.  Because the service cannot be stopped long\\n          enough to remove the dll, there is no way to remove the dll once\\n          it is loaded by the service.  Essentially, on default settings, this module\\n          adds a permanent elevated backdoor.\", \"disclosure_date\": \"2019-11-04\", \"fullname\": \"exploit/windows/local/cve_2020_1048_printerdemon\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:58:46 +0000\", \"name\": \"Microsoft Spooler Local Privilege Elevation Vulnerability\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unreliable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"screen-effects\"], \"Stability\": [\"crash-os-restarts\"]}, \"path\": \"/modules/exploits/windows/local/cve_2020_1048_printerdemon.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/local/cve_2020_1048_printerdemon\", \"references\": [\"CVE-2020-1048\", \"URL-https://windows-internals.com/printdemon-cve-2020-1048/\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:07.977585Z"}