Exploit Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Spoolss.exe' DLL Insertion

[Exploiter]

EDB-ID

19594

Проверка EDB

1. Пройдено

Автор

MARC OF EEYE

Тип уязвимости

LOCAL

Платформа

WINDOWS

CVE

cve-1999-0899

Дата публикации

1999-11-04

Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Spoolss.exe' DLL Insertion

source: https://www.securityfocus.com/bid/769/info

The spooler service (spoolss.exe) allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the way up to Administrator level. The problem is in the function AddPrintProvider(). 

This exploit will crash the spooler service and copy a custom dll into c:\winnt\system32. When the spooler service is restarted, the custom dll is loaded and run at SYTEM level. The 'whoami' binary is run and the results logged in a text file for verification. If the target machine's NT directory is not the default c:\winnt, the program will have to be modified. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19594.zip