Microsoft Print Spooler Service Impersonation Vulnerability

This module exploits the RPC service impersonation vulnerability detailed in Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service to create a file. The working directory at the time is %SystemRoot%\system32. An attacker can specify any file name, including directory traversal or full paths. By sending WritePrinter requests, an attacker can fully control the content of the created file. In order to gain code execution, this module writes to a directory used by Windows Management Instrumentation (WMI) to deploy applications. This directory (Wbem\Mof) is periodically scanned and any new .mof files are processed automatically. This is the same technique employed by the Stuxnet code found in the wild.

Search Other Modules

Exploit Rank

• Excellent

Exploit Authors

• jduck < jduck [at] metasploit.com >
• hdm < hdm [at] metasploit.com >

Vulnerability References

• OSVDB-67988
• CVE-2010-2729
• MSB-MS10-061

Exploit Targets

• 0 - Windows Universal (default)

Exploit Development

• Source Code
• History

Similar Exploit Modules

• exploit/windows/smb/ms03_049_netapi
• exploit/windows/smb/ms04_007_killbill
• exploit/windows/smb/ms04_011_lsass
• exploit/windows/smb/ms04_031_netdde
• exploit/windows/smb/ms05_039_pnp
• exploit/windows/smb/ms06_025_rasmans_reg
• exploit/windows/smb/ms06_025_rras
• exploit/windows/smb/ms06_040_netapi
• exploit/windows/smb/ms06_066_nwapi
• exploit/windows/smb/ms06_066_nwwks

Exploit Usage Information

Exploit Module Options