Home / exploitsPDF  

Microsoft Spooler Local Privilege Elevation

Posted on 18 September 2020

This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor.

 

TOP