module
MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability
| Disclosed | Created |
|---|---|
| 09/14/2010 | 05/30/2018 |
Disclosed
09/14/2010
Created
05/30/2018
Description
This module exploits the RPC service impersonation vulnerability detailed in
Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the
StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service
to create a file. The working directory at the time is %SystemRoot%\system32.
An attacker can specify any file name, including directory traversal or full paths.
By sending WritePrinter requests, an attacker can fully control the content of
the created file.
In order to gain code execution, this module writes to a directory used by Windows
Management Instrumentation (WMI) to deploy applications. This directory (Wbem\Mof)
is periodically scanned and any new .mof files are processed automatically. This is
the same technique employed by the Stuxnet code found in the wild.
Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the
StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service
to create a file. The working directory at the time is %SystemRoot%\system32.
An attacker can specify any file name, including directory traversal or full paths.
By sending WritePrinter requests, an attacker can fully control the content of
the created file.
In order to gain code execution, this module writes to a directory used by Windows
Management Instrumentation (WMI) to deploy applications. This directory (Wbem\Mof)
is periodically scanned and any new .mof files are processed automatically. This is
the same technique employed by the Stuxnet code found in the wild.
Authors
jduck hdm
Platform
Windows
References
Module Options
To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:
msf > use exploit/windows/smb/ms10_061_spoolss
msf /(s) > show actions
...actions...
msf /(s) > set ACTION < action-name >
msf /(s) > show options
...show and set options...
msf /(s) > run
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.