https://github.com/BC-SECURITY/Invoke-PrintDemon

This is a PowerShell Empire launcher PoC using PrintDemon and Faxhell.
https://github.com/BC-SECURITY/Invoke-PrintDemon

Last synced: 22 days ago
JSON representation

This is a PowerShell Empire launcher PoC using PrintDemon and Faxhell.

• Host: GitHub
• URL: https://github.com/BC-SECURITY/Invoke-PrintDemon
• Owner: BC-SECURITY
• Created: 2020-05-15T05:14:49.000Z (over 4 years ago)
• Default Branch: master
• Last Pushed: 2020-10-17T17:04:24.000Z (about 4 years ago)
• Last Synced: 2024-11-08T01:57:54.115Z (about 1 month ago)
• Language: PowerShell
• Homepage: https://www.bc-security.org/post/event/dll-hijacking-with-invoke-printdemon/
• Size: 24.4 KB
• Stars: 198
• Watchers: 12
• Forks: 38
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Funding: .github/FUNDING.yml

Awesome Lists containing this project

• awesome-hacking-lists - BC-SECURITY/Invoke-PrintDemon - This is a PowerShell Empire launcher PoC using PrintDemon and Faxhell. (PowerShell)

README

        
# PrintDemon

This is an [PowerShell Empire](https://github.com/BC-SECURITY/Empire) launcher PoC using [PrintDemon](https://github.com/ionescu007/PrintDemon) and [Faxhell](https://github.com/ionescu007/faxhell). The module has the Faxhell DLL already embedded which leverages [CVE-2020-1048](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1048) for privilege escalation. The vulnerability allows an unprivileged user to gain system-level privileges and is based on @ionescu007 PoC.

![Invoke-Demon_Demo](https://user-images.githubusercontent.com/20302208/82018233-b6a83280-9639-11ea-8db0-28a82a5eb5d7.gif)

__Note__: This is a proof of concept. We have encountered some issues with printing to C:\Windows\System32\Ualapi.dll on some machines. We have not yet isolated what is causing this. You can drop the dll directly into System32 to test the launcher if you encounter issues.

## Code Borrowed from

https://github.com/ionescu007/PrintDemon

https://github.com/ionescu007/faxhell

https://stackoverflow.com/questions/4442122/send-raw-zpl-to-zebra-printer-via-usb

https://stackoverflow.com/questions/29759854/how-to-connect-to-tcp-socket-with-powershell-to-send-and-receive-data