:: Deepquest ::

Canon TR150 print drivers versions 3.71.2.10 and below allow local users to read/write files within the “CanonBJ” directory and its subdirectories. By overwriting the DLL at C:ProgramDataCanonBJIJPrinterCNMWINDOWSCanon TR150 seriesLanguageModules40CCNMurGE.dll with a malicious DLL at the right time whilst running the C:WindowsSystem32Printing_Admin_Scriptsen-USprnmngr.vbs script to install a new printer, a timing issue can be exploited to cause the PrintIsolationHost.exe program, which runs as NT AUTHORITYSYSTEM, to successfully load the malicious DLL. Successful exploitation will grant attackers code execution as the NT AUTHORITYSYSTEM user. This Metasploit module leverages the prnmngr.vbs script to add and delete printers. Multiple runs of this module may be required given successful exploitation is time-sensitive.