{"vulnerability": "CVE-2022-21999", "sightings": [{"uuid": "876b16de-19fb-472f-aea5-f39a820318ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "82d81613-5ba2-46ec-a5c5-0651538a03a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "MISP/bd1c3290-9486-4bf9-ae59-fe17c0948133", "content": "", "creation_timestamp": "2023-09-06T13:44:31.000000Z"}, {"uuid": "eb6f7b48-5ba5-419b-ab77-9370d27503a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971452", "content": "", "creation_timestamp": "2024-12-24T20:29:33.212237Z"}, {"uuid": "3b68a024-8be9-4026-af40-2b7de0ffdf42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "45da05b3-98db-4419-8849-d23b3cb9f0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:43.000000Z"}, {"uuid": "308bc1b5-1b49-44bc-b3ef-ca940972d42f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:34.000000Z"}, {"uuid": "7b2a55f0-dfab-4773-b669-b5e988719d66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_21999_spoolfool_privesc.rb", "content": "", "creation_timestamp": "2022-03-16T13:56:13.000000Z"}, {"uuid": "9e1bc99c-dfbf-4178-8843-df9f6c5e940f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=736", "content": "", "creation_timestamp": "2022-02-09T04:00:00.000000Z"}, {"uuid": "a13d1a45-f832-49a5-a4b4-7513aa2158e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-21999", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/54c7f9b1-8660-4360-82f7-8a9d0f201afa", "content": "", "creation_timestamp": "2026-02-02T12:27:58.841823Z"}, {"uuid": "ed4d7019-7d97-4053-90bc-d56b265aa838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/technical_private_cat/204", "content": "Hello, cats.  \ud83d\udc31\nI decided to make this post as a collection of stuff, but don't get upset, there is a lot of useful stuff here. \nFor example various other compilations of material, various vulnerabilities and poc, and of course cool articles!\ud83d\udd11\n\nLink - A good article about exceeding a threshold and how it works \n\nLink - A good article about overriding privileges on the wind.  It deals with topics such as:  Flow control and reverse flow protection; SMEP, preventing execution of trivial kernel code; ASLR, DEP and stuff like that, including limiting kernel leaks; Using memory corruption \n\nLink - A collection of matertials on the githab about privilege overruns there are matertials like: Tools for this; Enumerating users; Enumerating the EoP network - named channels; EoP - Exploiting the kernel. And a lot more, I think someone will definitely find it useful \n\nLink - This script is for listing common Windows configuration problems that can be used to raise privileges locally. It also collects different information which can be useful for exploiting privilege overrides \n\nLink - A collection of windows privilege override vulnerabilities and poc on them.  There are quite a few different \n\nLink - About security, WADComs cheat sheet containing a list of offensive security tools you can use in Windows environments.\n\nLink - About  CVE 2022-29072 - Powershell detection/mitigation\n\nLink - Exploit for CVE-2022-21999 - Windows Print Queue Manager vulnerability related to privilege gaining \n\nLink - Exploit for notorious CVE-2022-21882\n\nLink - Little manulet with exploits for privilege escalation\n#windows #attacks #cve #exploit", "creation_timestamp": "2022-11-19T11:29:33.000000Z"}, {"uuid": "ed441dd2-4e4f-489f-b9bb-5ce541244508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/technical_private_cat/203", "content": "\u041f\u0440\u0438\u0432\u0435\u0442, \u043a\u043e\u0442\u043a\u0438.  \ud83d\udc31\n\u042d\u0442\u043e\u0442 \u043f\u043e\u0441\u0442 \u044f \u0440\u0435\u0448\u0438\u043b\u0430 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043a\u0430\u043a \u0441\u0431\u043e\u0440\u043d\u0438\u043a \u043c\u0430\u0442\u0435\u0440\u044c\u044f\u043b\u0430, \u043d\u043e \u043d\u0435 \u0431\u0435\u0433\u0438\u0442\u0435 \u0440\u0430\u0441\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0442\u0443\u0442 \u043c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0433\u043e. \n\u041a \u043f\u0440\u0438\u043c\u0435\u0440\u0443 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0431\u043e\u0440\u043d\u0438\u043a\u0438 \u043c\u0430\u0442\u0435\u0440\u044c\u044f\u043b\u0430,  \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 poc,  \u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u043a\u0440\u0443\u0442\u044b\u0435 \u0441\u0442\u0430\u0442\u044c\u0438!\ud83d\udd11\n\n\u041f\u0430\u043c - \u0425\u043e\u0440\u043e\u0448\u0430\u044f \u0441\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u043e \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0435\u0432\u0435\u043b\u0438\u043a\u0438\u0439 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \n\n\u041f\u0430\u043c -  \u0421\u0442\u0430\u0442\u044c\u044f \u043f\u0440\u043e \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0432\u0438\u043d\u0434\u0435.  \u0412 \u043d\u0435\u0439 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u0442\u0435\u043c\u044b \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a:  \u041a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043f\u043e\u0442\u043e\u043a\u0430 \u0438 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430; SMEP, \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u044f\u0434\u0440\u0430; ASLR, DEP \u0438 \u0432\u0441\u0435 \u0442\u0430\u043a\u043e\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0443\u0442\u0435\u0447\u043a\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u044f\u0434\u0440\u0430; \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \n\n\u041f\u0430\u043c - \u0421\u0431\u043e\u0440\u043d\u0438\u043a \u043c\u0430\u0442\u0435\u0440\u044c\u044f\u043b\u043e\u0432 \u043d\u0430 \u0433\u0438\u0442\u0445\u0430\u0431\u0435 \u043f\u0440\u043e \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0442\u0430\u043c \u0435\u0441\u0442\u044c \u0442\u0430\u043a\u0438\u0435 \u043c\u0430\u0442\u0435\u0440\u044c\u044f\u043b\u044b \u043a\u0430\u043a: \u0418\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e; \u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439; \u041f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 EoP \u2014 \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u0430\u043d\u0430\u043b\u044b; EoP \u2014 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u044f\u0434\u0440\u0430. \u0418 \u043e\u0447\u0435\u043d\u044c \u043c\u043d\u043e\u0433\u043e \u0447\u0435\u0433\u043e \u0435\u0449\u0435,  \u0434\u0443\u043c\u0430\u044e \u043a\u043e\u043c\u0443-\u0442\u043e \u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0438\u0433\u043e\u0434\u0438\u0442\u044c\u0441\u044f \n\n\u041f\u0430\u043c - \u042d\u0442\u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442 \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0435\u0439 Windows, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e , \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u043d\u0430 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \n\n\u041f\u0430\u043c- \u0421\u0431\u043e\u0440\u043d\u0438\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 windows \u0438 poc \u043d\u0430 \u043d\u0438\u0445.  \u0422\u0430\u043c \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \n\n\u041f\u0430\u043c- \u041f\u0440\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c,  WADComs  \u0448\u043f\u0430\u0440\u0433\u0430\u043b\u043a\u0430, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0430\u044f  \u0441\u043f\u0438\u0441\u043e\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438,  \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432 \u0441\u0440\u0435\u0434\u0430\u0445 Windows.\n\n\u041f\u0430\u043c - \u041f\u0440\u043e  CVE 2022-29072 \u2014 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435/\u0441\u043c\u044f\u0433\u0447\u0435\u043d\u0438\u0435 \u0432 Powershell\n\n\u041f\u0430\u043c - \u042d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0434\u043b\u044f CVE-2022-21999 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u0438 \u043f\u0435\u0447\u0430\u0442\u0438 Windows, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \n\n\u041f\u0430\u043c - \u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043d\u0430 \u043d\u0430\u0448\u0443\u043c\u0435\u0432\u0448\u0443\u044e CVE-2022-21882\n\n\u041f\u0430\u043c - \u041d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043c\u0430\u043d\u0443\u043b \u0441 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u0440\u0435\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439\n#windows #attacks #cve #exploit", "creation_timestamp": "2022-09-30T01:59:22.000000Z"}, {"uuid": "8d907f9d-37b5-4a48-9a67-5818af739ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/technical_private_cat/288", "content": "\u0415\u0449\u0435 \u0440\u0430\u0437 \u0434\u043e\u0431\u0440\u044b\u0439 \u0434\u0435\u043d\u044c \u043c\u043e\u0438 \u0447\u0435\u0448\u0438\u0440\u0441\u043a\u0438\u0435 \u043a\u043e\u0442\u0438\u043a\u0438   \ud83d\udc08\ud83c\udfa9\n\n\u0412\u043e\u0442 \u0432\u0430\u043c \u043f\u043e\u0441\u0442-\u0441\u0431\u043e\u0440\u043d\u0438\u043a \u043f\u0440\u043e windows . \ud83c\udfaf\n\u0422\u043e\u0447\u043d\u0435\u0435 \u043f\u0440\u043e \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0435\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 ,\u0438  \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0438 \u0441\u0442\u0430\u0442\u044c\u0438 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u044d\u043d\u043d\u043e\u0439 .\n\u041f\u043e\u0441\u0442 \u0441\u0434\u0435\u043b\u0430\u043d \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0432 \u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0446\u0435\u043b\u044f\u0445 \u0438 \u0434\u043b\u044f \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f \u0432\u0430\u0448\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 . \n\n\u041d\u0430\u0434\u0435\u044e\u0441\u044c \u0432\u0430\u043c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u043e:\nWindows-RCE-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b\nWindows-\u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043d\u0430 \u043c\u043d\u043e\u0433\u0438\u0435 cve \u043e\u0442 2012 \u0434\u043e 2017\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043d\u0430 CVE-2022-21907 \u0435\u0449\u0435 \u0442\u044b\u043a \n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043d\u0430 CVE-2022-21999\n\u042d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b \u043d\u0430 CVE-2022-29072\n\u0421\u0431\u043e\u0440\u043d\u0438\u043a \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432 \u043d\u0430 cve 2022 \u0433\u043e\u0434\u0430\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 Microsoft Security Response Center (MSRC)\nPrivatezilla -\u0438\u043d\u0442\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438\n\n\nGood afternoon again my Cheshire cats \ud83d\udc08\ud83c\udfa9\n\nHere's a post-collection for you about windows . \ud83c\udfaf\nMore precisely about the different exploits for its various vulnerabilities , and tools and articles on security enna .\nThis post is only for introductory purposes and to improve your security. \n\nI hope you will find it useful:\nWindows-RCE-exploits\nWindows exploits for many cve from 2012 to 2017 \nExploits for CVE-2022-21907 more link \nExploits for CVE-2022-21999\nExploits for CVE-2022-29072 \nA collection of various exploits for cve 2022\nSecurity research from Microsoft Security Response Center (MSRC)\nPrivatezilla security tool\n#windows #attacks #cve #exploit #polymorphic #pentest", "creation_timestamp": "2022-10-30T15:50:43.000000Z"}, {"uuid": "1efa2235-23b0-4737-b721-2a95f499d35c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "Telegram/aWPQ6S4atnyDD3dUH3K-x1BU3R5-n4OL9JH-9OFaA4Rgfst8", "content": "", "creation_timestamp": "2025-01-30T02:17:48.000000Z"}, {"uuid": "5a7acc3b-ed14-4d24-bef3-070ac03f9338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/proxy_bar/748", "content": "Windows Privilege Escalation: SpoolFool\n\u041f\u0430\u0442\u0447\u0438\u043b\u0438, \u0444\u0438\u043a\u0441\u0438\u043b\u0438  CVE-2020-1048 \u0438  CVE-2020-1337, \u0430 \u0434\u044b\u0440\u0430 \u043e\u0441\u0442\u0430\u043b\u0430\u0441\u044c.\n\u041e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-21999 (\u00abSpoolFool\u00bb) \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u043f\u0440\u0430\u0432\u0430 NT AUTHORITY\\\\SYSTEM. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u044b 2 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430 \u0430\u0442\u0430\u043a\u0438. \n\u041a\u0430\u043a \u043f\u0440\u043e\u043b\u0435\u0437\u0442\u044c \u0432 \u043c\u0438\u0440 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0431\u0435\u0437 \u0432\u0430\u0437\u0435\u043b\u0438\u043d\u0430, \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u0442 \u0440\u0430\u0441\u043e\u0432\u043e \u0432\u0435\u0440\u043d\u044b\u0439 \u0438\u043d\u0434\u0443\u0441 Harshit Rajpal\n\u0427\u0438\u0442\u0430\u0435\u043c \u0442\u0443\u0442.\n#windows #LPE", "creation_timestamp": "2022-03-25T16:36:11.000000Z"}, {"uuid": "17e62ca1-4412-4c26-8606-d65ff9625ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2096", "content": "SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022-21999) https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81", "creation_timestamp": "2026-08-03T02:09:14.093165Z"}, {"uuid": "a87b0e62-1638-47fb-81c0-f7c33ec97b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/reverse_dungeon/1515", "content": "Windows Privilege Escalation: SpoolFool\n\u041f\u0430\u0442\u0447\u0438\u043b\u0438, \u0444\u0438\u043a\u0441\u0438\u043b\u0438  CVE-2020-1048 \u0438  CVE-2020-1337, \u0430 \u0434\u044b\u0440\u0430 \u043e\u0441\u0442\u0430\u043b\u0430\u0441\u044c.\n\u041e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2022-21999 (\u00abSpoolFool\u00bb) \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c \u043f\u0440\u0430\u0432\u0430 NT AUTHORITY\\\\SYSTEM. \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043d\u044b 2 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u0430 \u0430\u0442\u0430\u043a\u0438. \n\u041a\u0430\u043a \u043f\u0440\u043e\u043b\u0435\u0437\u0442\u044c \u0432 \u043c\u0438\u0440 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0431\u0435\u0437 \u0432\u0430\u0437\u0435\u043b\u0438\u043d\u0430, \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u0442 \u0440\u0430\u0441\u043e\u0432\u043e \u0432\u0435\u0440\u043d\u044b\u0439 \u0438\u043d\u0434\u0443\u0441 Harshit Rajpal\n\u0427\u0438\u0442\u0430\u0435\u043c \u0442\u0443\u0442.\n#windows #LPE", "creation_timestamp": "2022-03-25T16:16:29.000000Z"}, {"uuid": "b5d25e7a-f021-42d7-abf8-58d9808fbe5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5380", "content": "#exploit\n1. CVE-2022-21241:\nCSV+ 0.8.0 - 2-Click Arbitrary Code Execution\nhttps://github.com/satoki/csv-plus_vulnerability\n\n2. CVE-2022-21999, CVE-2022-22718:\nSpoolFool - Windows Print Spooler Privilege Escalation\nhttps://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81\n]-> The functional exploit and DLL:\nhttps://github.com/ly4k/SpoolFool", "creation_timestamp": "2024-10-11T22:00:31.000000Z"}, {"uuid": "299ccac6-6128-4724-a275-f9f27745a603", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "Telegram/clcEmNxhZcHi4To_RQ1A8YVZFlVzgq1IWTEDSznqQFJxcxU", "content": "", "creation_timestamp": "2022-10-07T02:04:31.000000Z"}, {"uuid": "53948de9-96a3-4dc2-aa82-6a1e9af59a99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2096", "content": "SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022-21999) https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81", "creation_timestamp": "2026-08-04T00:00:53.212220Z"}, {"uuid": "03fb2885-6fc9-4efd-bc0e-4a9fe2bd01d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/onelab1337/2121", "content": "#exploit\n1. CVE-2022-21241:\nCSV+ 0.8.0 - 2-Click Arbitrary Code Execution Vulnerability (PoC)\n\ud83d\udd17 See on Github\n\n2. SpoolFool:\nWindows Print Spooler Privilege Escalation (CVE-2022-21999 / CVE-2022\u201322718)\n\ud83d\udd17 See on Research\n\n[+] The functional exploit and DLL:\n\ud83d\udd17 See on Github\n\nShare and support us \u2764\ufe0f\n@zero0lab", "creation_timestamp": "2026-08-09T04:33:49.325214Z"}, {"uuid": "935f0cd5-b337-48d2-b2d0-5af7af34dd6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/2121", "content": "#exploit\n1. CVE-2022-21241:\nCSV+ 0.8.0 - 2-Click Arbitrary Code Execution Vulnerability (PoC)\n\ud83d\udd17 See on Github\n\n2. SpoolFool:\nWindows Print Spooler Privilege Escalation (CVE-2022-21999 / CVE-2022\u201322718)\n\ud83d\udd17 See on Research\n\n[+] The functional exploit and DLL:\n\ud83d\udd17 See on Github\n\nShare and support us \u2764\ufe0f\n@zero0lab", "creation_timestamp": "2026-08-10T00:00:26.718453Z"}, {"uuid": "1794ed89-c366-4d9c-9ed6-e7337bd6e9a6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/855c61af-a022-44b3-a21f-d37012422388", "content": "", "creation_timestamp": "2026-06-19T12:47:25.629864Z"}, {"uuid": "8b2b7793-431b-4175-ae64-79c541e42538", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2ba59c12-309e-417d-a13a-0e7facc5e3bf", "content": "", "creation_timestamp": "2026-06-23T14:05:13.561439Z"}, {"uuid": "d17b4c3c-13ea-4d9e-9361-ba67bcf8cac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/Positive_Technologies/1269", "content": "\ud83d\udd04 \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MaxPatrol\u00a0SIEM \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a. \n\n\ud83d\udc40 \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u044f\u0432\u0438\u0442\u044c: \n\n\ud83d\udd38 \u0410\u0442\u0430\u043a\u0438 \u043d\u0430 Microsoft Active Directory, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0421 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0434\u0435\u043d\u044c, \u0438\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kerberos Relay \u0432 Microsoft Active Directory. \n\n\ud83d\udd38 \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0430\u0442\u0430\u043a\u0443 Silver Ticket \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Kerberos.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Potato Vulnerabilities.\n\n\ud83d\udd38 \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (CVE-2022-21999 \u0438 CVE-2022-30206), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\ud83d\udd38 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043f\u0440\u0430\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u2014 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u0430\u043d\u0430\u043b\u044b.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 MaxPatrol SIEM \u0431\u044b\u043b\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043e 31 \u043d\u043e\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b", "creation_timestamp": "2026-07-26T07:01:45.012122Z"}, {"uuid": "176eded3-5354-4fd9-9144-29d53a63045f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/Positive_Technologies/1269", "content": "\ud83d\udd04 \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MaxPatrol\u00a0SIEM \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a. \n\n\ud83d\udc40 \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u044f\u0432\u0438\u0442\u044c: \n\n\ud83d\udd38 \u0410\u0442\u0430\u043a\u0438 \u043d\u0430 Microsoft Active Directory, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0421 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0434\u0435\u043d\u044c, \u0438\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kerberos Relay \u0432 Microsoft Active Directory. \n\n\ud83d\udd38 \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0430\u0442\u0430\u043a\u0443 Silver Ticket \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Kerberos.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Potato Vulnerabilities.\n\n\ud83d\udd38 \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (CVE-2022-21999 \u0438 CVE-2022-30206), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\ud83d\udd38 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043f\u0440\u0430\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u2014 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u0430\u043d\u0430\u043b\u044b.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 MaxPatrol SIEM \u0431\u044b\u043b\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043e 31 \u043d\u043e\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b", "creation_timestamp": "2026-07-27T00:01:29.831381Z"}, {"uuid": "d10ab70f-9968-4200-b80f-9841dce038f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/Positive_Technologies/1269", "content": "\ud83d\udd04 \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MaxPatrol\u00a0SIEM \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a. \n\n\ud83d\udc40 \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u044f\u0432\u0438\u0442\u044c: \n\n\ud83d\udd38 \u0410\u0442\u0430\u043a\u0438 \u043d\u0430 Microsoft Active Directory, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0421 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0434\u0435\u043d\u044c, \u0438\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kerberos Relay \u0432 Microsoft Active Directory. \n\n\ud83d\udd38 \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0430\u0442\u0430\u043a\u0443 Silver Ticket \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Kerberos.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Potato Vulnerabilities.\n\n\ud83d\udd38 \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (CVE-2022-21999 \u0438 CVE-2022-30206), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\ud83d\udd38 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043f\u0440\u0430\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u2014 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u0430\u043d\u0430\u043b\u044b.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 MaxPatrol SIEM \u0431\u044b\u043b\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043e 31 \u043d\u043e\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b", "creation_timestamp": "2026-07-28T20:00:08.978395Z"}, {"uuid": "05063bcf-4be7-4780-ae91-7829317ef5d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/Positive_Technologies/1269", "content": "\ud83d\udd04 \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 MaxPatrol\u00a0SIEM \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u043e\u0432\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a. \n\n\ud83d\udc40 \u041e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u044f\u0432\u0438\u0442\u044c: \n\n\ud83d\udd38 \u0410\u0442\u0430\u043a\u0438 \u043d\u0430 Microsoft Active Directory, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u0432 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435. \u0421 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u0430\u043c\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u0436\u0434\u044b\u0439 \u0434\u0435\u043d\u044c, \u0438\u0445 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Kerberos Relay \u0432 Microsoft Active Directory. \n\n\ud83d\udd38 \u041a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0430\u0442\u0430\u043a\u0443 Silver Ticket \u043d\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b Kerberos.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0435\u0439 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Potato Vulnerabilities.\n\n\ud83d\udd38 \u041c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\ud83d\udd38 \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u043f\u0435\u0447\u0430\u0442\u0438 Windows (CVE-2022-21999 \u0438 CVE-2022-30206), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.\n\n\ud83d\udd38 \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0434\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u043f\u0440\u0430\u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u2014 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043a\u0430\u043d\u0430\u043b\u044b.\n\n\u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0432 MaxPatrol SIEM \u0431\u044b\u043b\u043e \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043e 31 \u043d\u043e\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043d\u0430\u0448\u0435\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435.\n\n#Positive\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b", "creation_timestamp": "2026-07-29T00:00:27.643676Z"}, {"uuid": "e9ed2f0d-2914-497a-a1b4-44fb7ca6a04c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/reverseame/2096", "content": "SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022-21999) https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81", "creation_timestamp": "2026-07-29T12:02:45.997394Z"}, {"uuid": "f8838b70-47e4-4581-b818-8bb076953810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/reverseame/2096", "content": "SpoolFool: Windows Print Spooler Privilege Escalation (CVE-2022-21999) https://research.ifcr.dk/spoolfool-windows-print-spooler-privilege-escalation-cve-2022-22718-bf7752b68d81", "creation_timestamp": "2026-07-30T00:02:39.497055Z"}, {"uuid": "1c8beb38-445b-42a1-9926-dfc35886e6fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "creation_timestamp": "2026-09-01T20:01:54.774476Z"}, {"uuid": "31b1c2a1-6ddd-4aae-8540-714a1b36396a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "creation_timestamp": "2026-09-01T20:01:54.447186Z"}, {"uuid": "f870cbad-e794-4499-96cd-ffb75b04d18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/hacking_Attack/43066", "content": "Hacking Articles\nWindows Privilege Escalation: SpoolFool\n\nIntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 \n\nApplication: The print application creates a print job by calling Graphics Device Interface (GDI).\n\nGDI: GDI includes both user-mode and kernel-mode components for graphics support.\n\nwinspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.\n\nspoolsv.exe is the spooler\u2019s API server. This module implements message routing to print provider with the help of router (spoolss.dll)\n\nspoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.\n\nWorkflow of the CVE 2020-1030\n\nI would highly recommend reading Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.\n\n* By default, users can add printers without administrator authentication needed.\n* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \n\n* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.\n* An unprivileged user will not have these rights and hence, can\u2019t add a new printer with PRINTER_ALL_ACCESS right.\n* However, the \u201cINTERACTIVE\u201d group has the manage server permissions enabled which correspond to\n\nhttps://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]", "creation_timestamp": "2026-09-02T01:02:14.891356Z"}, {"uuid": "07984e84-6e77-4784-8bcc-f4498eb8c658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-21999", "type": "seen", "source": "https://t.me/hacking_Attack/43056", "content": "Hacking Articles|Raj Chandel's Blog\nWindows Privilege Escalation: SpoolFool\n\nWindows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as \u201cSpoolFool.\u201d In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\\SYSTEM.<o:p\n\nRelated advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p\n\nRelated CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\\Windows\\System32\\spool\\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p\n\n<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata\u2019s post here before trying to demonstrate the vulnerability yourself. But for people who don\u2019t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p\n\n\u00b7 By default, users can add printers without administrator authentication needed.<o:p\n\n\u00b7 Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 \u00b7 However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p\n\n\u00b7 An unprivileged user will [...]", "creation_timestamp": "2026-09-02T01:02:15.125200Z"}]}