Microsoft Spooler Local Privilege Elevation
Posted by deepcore on January 19, 2021 – 7:16 am
This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor.
Post a reply
You must be logged in to post a comment.