{"id":13842767,"url":"https://github.com/math1as/CVE-2020-1337-exploit","last_synced_at":"2025-07-11T15:33:01.914Z","repository":{"id":210506650,"uuid":"281334440","full_name":"math1as/CVE-2020-1337-exploit","owner":"math1as","description":"CVE-2020-1337 Windows Print Spooler Privilege Escalation","archived":false,"fork":false,"pushed_at":"2023-12-15T02:24:29.000Z","size":63,"stargazers_count":153,"open_issues_count":1,"forks_count":27,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-08-05T17:33:11.418Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/math1as.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-07-21T08:01:20.000Z","updated_at":"2024-05-23T10:23:00.000Z","dependencies_parsed_at":"2023-12-15T03:29:33.379Z","dependency_job_id":null,"html_url":"https://github.com/math1as/CVE-2020-1337-exploit","commit_stats":null,"previous_names":["math1as/cve-2020-1337-exploit"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/math1as%2FCVE-2020-1337-exploit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/math1as%2FCVE-2020-1337-exploit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/math1as%2FCVE-2020-1337-exploit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/math1as%2FCVE-2020-1337-exploit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/math1as","download_url":"https://codeload.github.com/math1as/CVE-2020-1337-exploit/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225737109,"owners_count":17516287,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:45.848Z","updated_at":"2024-11-21T13:31:06.644Z","avatar_url":"https://github.com/math1as.png","language":"PowerShell","funding_links":[],"categories":["PowerShell","PowerShell (153)"],"sub_categories":[],"readme":"# CVE-2020-1337 Windows Privilege Escalation\nthis is a WWW(write-what-where) exploit \n\n## credit\n\nJunyu Zhou (@md5_salt), who told me there could be a new bug.\n\nWenxu Wu (@ma7h1as), I find the bug and write this exploit.\n\n## how it works\nin the patch of CVE-2020-1048, Microsoft add the validation code of portname on XcvData function.\n\nwhich could be triggered by call Add-Printer in Powershell.\n\nnow both AddPort and XcvData function would check if current user has access to portname.\n\nbut still, We could use junction to solve this problem, once the check is passed, we reparse it to a system folder. for example, C:\\windows\\system32\n\nafter reboot or service restart, user controlled data would be written into portname.\n\nsee exploit.ps1 for more details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmath1as%2FCVE-2020-1337-exploit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmath1as%2FCVE-2020-1337-exploit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmath1as%2FCVE-2020-1337-exploit/lists"}