CVE-2010-2729

Related Files

Microsoft Print Spooler Service Impersonation Vulnerability

Posted Sep 21, 2010

Authored by H D Moore, jduck | Site metasploit.com

This Metasploit module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is %SystemRoot%\\\\system32. An attacker can specify any file name, including directory traversal or full paths. By sending WritePrinter requests, an attacker can fully control the content of the created file. In order to gain code execution, this module writes an EXE and then (ab)uses the impersonation vulnerability a second time to create a secondary RPC connection to the \\\\PIPE\\\\ATSVC named pipe. We then proceed to create a remote AT job using a blind NetrJobAdd RPC call.

tags | exploit, remote, code execution

advisories | CVE-2010-2729

SHA-256 | 04cbfe670279e81d3e5cc91c21f2c90426a352f556e914a6b712e856fe79bdf1

Download | Favorite | View