Windows Print Spooler Arbitrary File Write Elevation of Privilege

This repository is an operational exploit for CVE-2020-1048 (PrintDemon), a privilege escalation vulnerability in the Windows Print Spooler service. The exploit consists of three main components: 1. **printDemon2system/exploit.cpp**: The main exploit orchestrator. It installs a printer driver, sets up a file port pointing to the PrintConfig.dll in the DriverStore, adds a printer, and writes a malicious DLL payload (from printConfig) to the PrintConfig.dll location. It then restarts the system to trigger the Print Spooler to load the malicious DLL as SYSTEM. 2. **printConfig/main.cpp**: The payload DLL source. When loaded by spoolsv.exe, it duplicates the SYSTEM token, adjusts the session ID to the active user, and spawns an interactive SYSTEM-level cmd.exe shell. 3. **startXpsJob/main.cpp**: A helper tool to trigger the loading of the malicious PrintConfig.dll by starting an XPS print job, which causes spoolsv.exe to load the DLL and execute the payload. The exploit is designed for local privilege escalation on Windows 10 x64 (version 1909, build 18363.418) and requires the ability to install printer drivers and restart the system. The main fingerprintable endpoints are the PrintConfig.dll file in the DriverStore and the use of cmd.exe. The exploit is not part of a framework and is a standalone operational exploit with a hardcoded payload.

This repository is a proof-of-concept (POC) exploit for CVE-2020-1048, also known as PrintDemon, which is a privilege escalation vulnerability in the Windows Print Spooler service. The exploit is implemented in C and consists of a single main code file (Source.c) and associated Visual Studio project files. The exploit works by creating a new printer port and printer, then sending a malicious DLL (such as getshell.dll) to the print spooler. The attacker must restart the spooler service or the system to trigger the loading of the DLL, which can result in SYSTEM-level code execution. The README provides usage instructions and references. The exploit is not weaponized but demonstrates the vulnerability and the attack chain. The main fingerprintable endpoints are the file path used for the port (C:\Windows\System32\ualapi.dll by default) and the DLL payload (getshell.dll).