7.8
CVSSv3

CVE-2020-1337

Published: 17/08/2020 Updated: 19/01/2024
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 644
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2008 r2

microsoft windows server 2012 r2

microsoft windows 10 1607

microsoft windows 8.1 -

microsoft windows server 2016 -

microsoft windows server 2008 -

microsoft windows rt 8.1 -

microsoft windows server 2012 -

microsoft windows 10 -

microsoft windows 10 1709

microsoft windows 10 1803

microsoft windows server 2019 -

microsoft windows 10 1809

microsoft windows 7 sp1

microsoft windows server 2016 1903

microsoft windows 10 1903

microsoft windows server 2016 1909

microsoft windows 10 1909

microsoft windows 10 2004

microsoft windows server 2016 2004

Exploits

Microsoft Windows suffers from a local spooler bypass vulnerability ...
This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service Essentially, on default settings, this module adds a permanent elevated backdoor ...

Github Repositories

RedTeam参考,修改自Ridter的https://github.com/Ridter/Intranet_Penetration_Tips

Intranet Penetration CheetSheets Modified by: z3r0yu Blog: zeroyuxyz Table of Contents 信息搜集 开源情报信息收集(OSINT) github whois查询/注册人反查/邮箱反查/相关资产 google hacking 创建企业密码字典 字典列表 密码生成 邮箱列表获取 泄露密码查询 对企业外部相关信息进行搜集 子域名获取

RedTeam参考,修改自Ridter的https://github.com/Ridter/Intranet_Penetration_Tips

Intranet Penetration CheetSheets Modified by: z3r0yu Blog: zeroyuxyz Table of Contents 信息搜集 开源情报信息收集(OSINT) github whois查询/注册人反查/邮箱反查/相关资产 google hacking 创建企业密码字典 字典列表 密码生成 邮箱列表获取 泄露密码查询 对企业外部相关信息进行搜集 子域名获取

CVE-2020-1337 a bypass of (PrintDemon) CVE-2020-1048’s patch

CVE-2020-1337 CVE-2020-1337 is a bypass of (PrintDemon) CVE-2020-1048’s patch via a Junction Directory, made to remediate an Elevation of Privileges (EoP)\Local Privilege Escalation (LPE) vulnerability affecting the Windows’ Print Spooler Service The vulnerability does require low privilege access and for the spooler service to restart The patch appeared in Micros

cve-2020-1337-poc poc for CVE-2020-1337 (Windows Print Spooler Elevation of Privilege) Credit to all researcher who find out this bug Ref: voidseccom/cve-2020-1337-printdemon-is-dead-long-live-printdemon/ code browsed from: githubcom/sailay1996/WerTrigger githubcom/BC-SECURITY/Invoke-PrintDemon @404death

Print Spooler Research Tools The repository contains the tools we developed during our Print Spooler research which we presented in Black Hat USA 2020 and DEF CON 28 Safe Mode ("A Decade After Stuxnet's Printer Vulnerability: Printing is still the Stairway to Heaven") Each tool/project contains it's own READMEmd file: SHDWriter: CVE-2020-1048 - Exploit Po

poc for CVE-2020-1337 (Windows Print Spooler Elevation of Privilege)

cve-2020-1337-poc poc for CVE-2020-1337 (Windows Print Spooler Elevation of Privilege) Credit to all researcher who find out this bug Ref: voidseccom/cve-2020-1337-printdemon-is-dead-long-live-printdemon/ code browsed from: githubcom/sailay1996/WerTrigger githubcom/BC-SECURITY/Invoke-PrintDemon @404death

CVE-2020-1337 Windows Print Spooler Privilege Escalation

CVE-2020-1337 Windows Privilege Escalation this is a WWW(write-what-where) exploit credit Junyu Zhou (@md5_salt), who told me there could be a new bug Wenxu Wu (@ma7h1as), I find the bug and write this exploit how it works in the patch of CVE-2020-1048, Microsoft add the validation code of portname on XcvData function which could be triggered by call Add-Printer in Powershel

PowerShell and C++ PoCs for critical / high impact Windows Spooler vulnerabilities found in 2020-22

Ethical Hacking project PowerShell and C++ PoCs for critical / high impact Windows Spooler vulnerabilities found in 2020-22: CVE-2020-1337 CVE-2020-1048, aka PrintDemon CVE-2020-1030 CVE-2022-21999, aka SpoolFool The videos of the demonstration of the PoCs are provided inside the Video folder, while more information about each specific vulnerability can be found in the CVEs h

CVE-2020-1048 bypass: binary planting PoC

CVE-2020-1337 - Binary Planting (CVE-2020-1048 bypass) Peleg Hadar (@peleghd) and Tomer Bar at SafeBreach (@safebreach) were acknowledged by Microsoft by the CVE-2020-1048, a Windows Spooler Vulnerability that allows an elevation of privilege on Windows 7 and later Some details were disclosed by Alex Ionescu (@aionescu) and Yarden Shafir (@yarden_shafir) on his cool blog post

Sibyl-GPT Alert Parsing Script This script connects to the ElasticSearch Detection Engine API, retrieves alerts, allows users to choose one for investigation, and sends the chosen alert to OpenAI to get suggested investigation and remediation Acknowledgments The main inspiration for this work is from Mika's excellent article Requirements An OpenAI API key Python 36 or hi

Leveraging CVEs as North Stars in vulnerability discovery and comprehension.

CVE North Stars Leveraging CVEs as North Stars in vulnerability discovery and comprehension About CVE North Stars Tutorial: cve-north-starsgithubio Blog Post: clearbluejargithubio/posts/cve-north-stars/ CVE North Stars introduces a method to kickstart vulnerability research by taking advantage of the CVE information freely available (ie public blo