Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's worth reading the full technical analysis https://windows-internals.com/printdemon-cve-2020-1048/

It's well written and easy to follow even for someone that doesn't know much about Windows security.

And if you didn't read it the bug comes from the fact that the Powershell command Add-PrinterPort can be used to add a printer port as a file that you don't have access to. After restarting the spooler service you can then use this port to write to that file.



This was very interesting, thanks for posting it! I will say that this is a bit misleading though:

> the bug comes from the fact that the Powershell command Add-PrinterPort can be used ...

The bug is in the print spooler service and the Windows API to access to it. It just happens that PowerShell offers an easy way to access the Windows API, which makes it easy to illustrate the exploit.


Interesting - can you write back to RDP clients that are connected? As a call-back to infect a connected computer?

If so, seems like you could use it to break out of VMs/RDP servers.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: