Abstract

This paper will be covering CVE-2020-1048 Windows print spooler elevation of privilege vulnerability. [1] This vulnerability affected the Windows operating system where I provide a comprehensive breakdown of the windows services, windows registry, windows DLLs, as well as provide a walkthrough of the exploit. CVE-2020-1048 is a 2020 Print Spooler bug that Microsoft fixed in May 2020. In 2021, researchers found new Print Spooler bugs, CVE-2021-1675 and CVE-2021-34527, and the second one became known as PrintNightmare. Lastly, security recommendation and best practices will be provided.

Introduction

CVE-2020-1048 was first published on May 21, 2020, with a CVSS Score of 7.8, where the Windows Print Spooler was the affected component or area which could lead an attacker to getting an elevation of privilege on a target computer. The Windows Print Spooler is a Windows service that manages the printing process. It queues print jobs and sends them to a printer when it is ready. This service was exploited where attackers could reach an elevation of privilege (EOP). Elevation of Privilege (EOP) is a type of vulnerability that allows a user or an application with limited privileges to elevate their access rights. Managing to get an EOP can lead to gaining unauthorized higher-level privileges (administrative rights), taking control of a system, executing malicious code, and worse getting a reverse shell. For example, attackers could socially engineer a phishing attack and infect a target computer. The infected machine would add a printer using the windows print service, take advantage of a DLL search order hijacking attack, gain administrative access over the machine, and manage to gain a Meterpreter reverse shell with persistent access. As an IT veteran who has been working in the space for 7 years, I found it important to break down the basics of what are windows services, registries, and DLLs to gain a better and in depth understanding of how the windows operating system works under the hood. I will also give a walkthrough of how the exploit worked and wrap up with the havoc this vulnerability wreaked on the computer industry which was dubbed the “Print Nightmare” in 2021.

Timeline

• May 12, 2020: Microsoft fixes CVE-2020-1048 (local elevation of privilege).
• August 2020: Microsoft fixes CVE-2020-1337, a bypass of the May fix.
• June 8, 2021: Microsoft fixes CVE-2021-1675.
• Late June to July 1, 2021: proof-of-concept code is posted, and CVE-2021-34527 (PrintNightmare) is confirmed.
• July 6, 2021: Microsoft releases emergency update KB5004945, with more fixes after that.

Windows Services

A Windows service is a small program that usually starts when the Windows operating system loads. You won’t normally interact with services like you do with regular programs because they run in the background (you don’t see them) and don’t provide a normal user interface. [2] The Windows operating system uses these services to do OS level tasks. They are programs running in the background. For example, they control network connections, handle print queues, Bluetooth connections, and 3rd party applications can also create services and run them. Recall, CVE-2020-1048 is windows print spooler service that was exploited. Next, I will discuss Windows registry and where in the exploit process the registry records the changes made by the exploit.

Windows Registry

The registry stores much of the information and settings for software programs, hardware devices, user preferences, and operating system configurations. [3] You can think of it as the register for all the settings of applications and computer settings. In many ways, the registry can be thought of as a kind of DNA for the Windows operating system. Another way of looking at the registry is as a rolodex or receipt/record of a computer’s settings. If a computer were infected with the CVE, the registry would record the new printer port location (or in the case of this exploit file path). While the registry was not used to conduct this attack it is important to know it records the exploits changes and it is touched upon in the exploit. Next up, I will discuss what DLLs are and how they were used in the exploit.

Windows DLLs

Windows DLL stands for Dynamic Link Library. A DLL is a file that contains instructions that other programs can call upon to do certain things. [4] DLL files are different from executable files, where .dll files cannot be run directly but instead must be called upon by other code that is already running. That contrasts with executable files that end in .exe which can be clicked on and ran standalone, where these same executable files call upon the .dll files to run the .exe file. DLLs are exploited in the CVE where the exploit takes advantage of a DLL search order hijacking attack. [5] Thus far I have covered the Windows print spooler service, Windows services, the Windows registry, DLLs and how they were used in the exploit. In the next section I will be going over an exploit walkthrough.

Exploit walkthrough (CVE-2020-1048)

An unsuspecting victim clicks on a phishing email and is infected with malicious code. Once the malicious code is running on the victim’s computer as an unprivileged user it proceeds to add a new printer that is associated with a new printer port (file path) pointing to a restricted SYSTEM file. A few things to point out here, a printer port, instead of being an actual port, is instead a path to a file as was used in this exploit. [6] Not your typical networking ports/protocols. Another thing to note is by adding a file under the SYSTEM file, this file hierarchy has full administrative rights over its host operating system. SYSTEM is a default account used by the operating system with full administrative rights.

Typically, when a regular user creates a print job, the print job will be stored by the print spooler service  (spoolsv.exe) to a dedicated folder, System32\SPOOL\Printers, as two files: the file, which contains the content to be printed (SPL), and the shadow job file (SHD), which contains the metadata of the print job, including the path of the printer port that was created. This same behavior is taken advantage of in this attack. [7]

After the new printer has been added to the new printer port (file path). The unprivileged user at this step drops a scripted print job associated with the new printer port to SYSTEM. The Windows print service gets rebooted or restarted and it creates a malicious .dll file in c:\windows\system32\wbem\browcli.dll.

Of note, the malicious code lives in the browcli.dll file. This is the core of this vulnerability, whereby adding printer port that points to a SYSTEM folder and rebooting the spooler service, an attacker gets to run a malicious file. Just by copying the crafted SHD and SPL files and waiting for the system to reboot, the attacker achieved an elevation of privilege.

The elevation of privilege (EOP) allowed code execution using a DLL-search-order-hijacking. Recall, when a service starts it loads several dependencies known as DLLs. When the windows management instrumentation (WMI) service started the browcli.dll library is executed from c:\windows\system32\wbem and a reverse Meterpreter shell is achieved running as SYSTEM with full admin rights over the computer. To make matters even worse persistence for the shell was given every time the WMI service was restarted.

High Level Overview of The Attack Phases

1. Unprivileged user adds a new printer associated with a new printer port (file path) pointing to a restricted SYSTEM file.
2. Unprivileged user drops scripted print job files associated with the new printer port (file path) to SYSTEM.
3. Windows Print Service reboots
4. Print Spooler service creates a malicious browcli.dll c:\windows\system32\wbem\browcli.dll.
5. WMI service loads and executes the browcli.dll file.
6. Privilege Escalation Successful, with a Meterpreter reverse shell as SYSTEM.
7. Persistence achieved when every time the WMI service is restarted it loads the malicious .dll

WMI Service Explained

The Windows Print Spooler service and the Windows Management Instrumentation (WMI) service are interrelated in the context of managing printing operations and system configurations. The reason the CVE referred to as the Windows print spooler elevation of privilege vulnerability and not the Windows Management Instrumentation (WMI) service vulnerability is that the exploit took advantage of the print spooler component. The vulnerability itself is related to the Print Spooler service. It affects how this specific service handles requests and permissions, leading to potential privilege escalation. Naming it after the affected component makes it easier for administrators to identify which part of the system is impacted.

What is Meterpreter?

Meterpreter is a Metasploit attack payload that provides an interactive shell from which an attacker can explore the target machine and execute code. Meterpreter is deployed using in-memory DLL injection. [8]

• Lives in volatile memory leaving no footprint on disc.
• It injects itself and migrates to other running process, making it hard to forensics.

The PrintNightmare of 2021

The Windows Print Nightmare was dubbed by the computer industry in 2021 after Microsoft was left scrambling to patch a new zero-day vulnerability in its Windows Print Spooler service. CVE-2020-1048 was an earlier, separate Print Spooler bug that Microsoft fixed in May 2020. The Print Nightmare was an issue for enterprise environments due to the use of networked printers, where an attacker could exploit the Print Spooler service to take control of multiple systems within an organization. It affected multiple versions of Windows and Servers. They could trick a user to connecting to a malicious printer and spread further into the network. A year later in 2021, two other related CVEs to this vulnerability where classified.

• CVE-2021-1675: Originally classified as a privilege escalation vulnerability, but later it was found to enable Remote Code Execution (RCE) as well. [9]
• CVE-2021-34527: Focused more on remote exploitation. [10]

To make things worse researchers had a miscommunication with Microsoft on when Microsoft would release patch for the zero day. A test proof of concept of the vulnerability was published by the researchers; however, it was quickly deleted, but not before it had already been forked on GitHub. The researchers thought Microsoft had patched the vulnerability before presenting at Black Hat, but the company published patches for a separate Windows Print Spooler flaw. [11] Other notable headlines read, “Microsoft admits “the code that contains the vulnerability is in all versions of Windows,” The Verge. [11] From PC Magazine, “This is the third vulnerability related to Windows Print Spooler… The second was called PrintNightmare, and it affects every version of Windows despite the release of an emergency patch on July 6 that was supposed to address the security flaw at least partially.” [12]

Microsoft Patches the Vulnerability

During the Zero Day before Microsoft published a patch, they recommended the following recommendations: disabling the Windows Print Spooler service and disabling inbound remote printing Via Group Policy. Also, disable the Windows Print Spooler service on Domain Controllers and Servers that did not need to print. On July 6, 2021, a few days after PrintNightmare became public. Microsoft released an emergency update to mitigate the PrintNightmare vulnerability, which affected the Windows Print Spooler service. [13]  This patch addressed certain aspects of the flaw but did not fully resolve the issue in all cases. Microsoft released additional patches later to address bypasses and improve the mitigation provided by the initial fix. These updates included more robust handling of remote and local privilege escalation scenarios.

Recommended Security Measures

It depends on your attack surface for what you are protecting, and this varies by industry and type of business. My recommendations are to utilize a NextGen firewall with IPS/IDS, a good EDR Antivirus, and set up SIEM rules to detect activity targeting the Print Spooler Service. Make sure to tun off Print Spooler services on older Windows Servers, and Domain Controllers if the systems have not been patched. For those industries that still need to run end of life EOL operating systems, it is good practice to segment those networks, and take them offline. You also want to make sure your systems are patched and updated on a regular basis.

Conclusion

In conclusion, the windows print spooler elevation of privilege vulnerability was indeed a nightmare. CVE-2020-1048 was fixed in May 2020, but the Print Spooler kept producing new bugs. PrintNightmare (CVE-2021-34527) in 2021 showed that one Windows service can cause repeated problems, which is why turning off the Print Spooler on servers that do not print is still good advice. [13] Microsoft did recommend turning off the print spool service while they pushed out a fix, but this is why it’s important to have a proper security team or resources at a company who can stay up to date and check for and enforce this type of one off zero-days that are not easily implementable by IT organizations. I asked myself how many organizations did not even know about this vulnerability and continued to exist until Microsoft released the emergency fix KB5004945 on July 6, 2021, just days after the proof-of-concept code became public. Having a proper security team with threat researchers and senior cybersecurity professionals is crucial for any organization going into the future.

Works Cited

[1]	NIST National Vulnerability Database, “CVE-2020-1048,” NIST, 01 05 2020. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2020-1048. [Accessed 23 11 2024].
[2]	Lifewire, “What Is a Windows Service?,” 8 August 2022. [Online]. Available: https://www.lifewire.com/what-is-a-service-4107276. [Accessed 23 November 2024].
[3]	Lifewire, “What Is the Windows Registry,” 13 June 2023. [Online]. Available: https://www.lifewire.com/windows-registry-2625992. [Accessed 23 November 2024].
[4]	Lifewire, “What Is a DLL File?,” 24 October 2021. [Online]. Available: https://www.lifewire.com/what-is-a-dll-file-2625852. [Accessed 23 November 2024].
[5]	MITRE ATT&CK, “Hijack Execution Flow: DLL Search Order Hijacking,” MITRE.org, [Online]. Available: https://attack.mitre.org/techniques/T1574/001/. [Accessed 23 November 2024].
[6]	Microsoft Defender for Endpoint Blog, “Investigating the Print Spooler EoP exploitation,” Microsoft, 08 March 2021. [Online]. Available: https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/investigating-the-print-spooler-eop-exploitation/2166463#:~:text=The%20catch%20is%20that%20the%20printer%20port%2C%20instead%20of%20being%20an%20actual%20port%2C%20could%20instead%20be%20a%. [Accessed 23 November 2024].
[7]	Techcommunity Microsoft, “Microsoft,” 2024. [Online]. Available: https://techcommunity.microsoft.com/blog/microsoftdefenderatpblog/investigating-the-print-spooler-eop-exploitation/2166463#:~:text=Print%20content%20to%20a%20restricted%20file.
[8]	S. D. Octopus, “Meterpreter,” [Online]. Available: https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/. [Accessed 24 November 2024].
[9]	NIST, “CVE-2021-1675,” 21 11 2021. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2021-1675. [Accessed 24 November 2024].
[10]	NIST, “CVE-2021-34527,” 02 July 2021. [Online]. Available: https://nvd.nist.gov/vuln/detail/CVE-2021-34527. [Accessed 24 November 2024].
[11]	TheVerge, “Microsoft warns of Windows ‘PrintNightmare’ vulnerability that’s being actively exploited / The Windows Print Spooler strikes again,” 2 July 2021. [Online]. Available: https://www.theverge.com/2021/7/2/22560435/microsoft-printnightmare-windows-print-spooler-service-vulnerability-exploit-0-day. [Accessed 2024 November 2024].
[12]	N. Mott, “Microsoft Confirms ‘PrintNightmare’ Vulnerability Affects All Windows Versions,” PC Mag, 2 July 2021. [Online]. Available: https://www.pcmag.com/news/microsoft-confirms-printnightmare-vulnerability-affects-all-windows-versions. [Accessed 24 November 2024].
[13]	Microsoft, “July 6, 2021—KB5004945 (OS Builds 19041.1083, 19042.1083, and 19043.1083) Out-of-band,” 6 July 2021. [Online]. Available: https://support.microsoft.com/en-us/topic/july-6-2021-kb5004945-os-builds-19041-1083-19042-1083-and-19043-1083-out-of-band-44b34928-0a71-4473-aa22-ecf3b83eed0e#:~:text=Windows%20Print%20Spooler. [Accessed 24 November 2024].