{"uuid": "e55f7c9b-c56c-491b-a377-1497e92952ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-19363", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-02T01:02:51.112448Z"}