{"uuid": "4b36ada8-213e-43e2-8958-b89e96c0e8a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34481", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24072", "content": "But which exploit should I use?!\n  Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.  \nHow does it work?\n  Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:  Step 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n  It is important to note that SLASHINGDAMAGE doesn't actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I'd leave the exploit in my evil server... as confusing as that may be.  \nIs this a Windows vulnerability?\n  Arguably, yes. The driver store is a \"trusted collection of ... third-party driver packages\" (https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-store) that requires administrator access to modify. Using GetPrinterDriver a low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.  Microsoft seemed to agree when they issued CVE-2021-34481 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481).  Although... it's arguable that this is simply a feature of the system and not a vulnerability (https://www.kitploit.com/search/label/Vulnerability) at all. It really doesn't matter all that much. An attacker can escalate to SYSTEM on standard Windows installs.  \nWhich verions of Windows are affected by CVE-2021-34481?\n  At least Windows 8.1 and above.  \nHow do I use these tools?\n  Simple! So simple there will be many paragraphs to describe it!  \nCP Server\n  First, let's look at cp_server's command line options:  cp_server.exe   _______  _______  __    _  _______  _______  _______  ___      _______  ______  |       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |  |       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |  |       ||  | |  ||       ||       ||   |___ |       ||   |    |   |___ | | |   |  |      _||  |_|  ||  _    ||      _||    ___||       ||   |___ |    ___|| |_|   |  |     |_ |       || | |   ||     |_ |   |___ |   _   ||       ||   |___ |       |  |_______||_______||_|  |__||_______||_______||__| |__||_______||_______||______|   _______  _______  _______  ___   _______  ___   _______  __    _  |       ||       ||       ||   | |       ||   | |       ||  |  | |  |    _  ||   _   ||  _____||   | |_     _||   | |   _   ||   |_| |  |   |_| ||  | |  || |_____ |   |   |   |  |   | |  | |  ||       |  |    ___||  |_|  ||_____  ||   |   |   |  |   | |  |_|  ||  _    |  |   |    |       | _____| ||   |   |   |  |   | |       || | |   |  |___|    |_______||_______||___|   |___|  |___| |_______||_|  |__|    server!    CLI options:    -h, --help                     Display the help message    -e, --exploit arg              The exploit to use    -c, --cabs arg (=.\\cab_files)  The location of the cabinet files    Exploits available:          ACIDDAMAGE          POISONDAMAGE          RADIANTDAMAGE          SLASHINGDAMAGE    C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>  \">C:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n _______  _______  __    _  _______  _______  _______  ___      _______  ______\n|       ||       ||  |  | ||       ||       ||   _   ||   |    |       ||      |\n|       ||   _   ||   |_| ||       ||    ___||  |_|  ||   |    |    ___||  _    |", "creation_timestamp": "2026-09-07T14:00:04.438115Z"}