{"vulnerability": "cve-2021-35449", "sightings": [{"uuid": "3cb112e4-dd0c-4f42-b5f7-b6b10838d5dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "961f7bec-c0d5-4649-85ce-8c4f51e4443b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "07774648-f003-4cae-9880-b243bc42e356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/lexmark_driver_privesc.rb", "content": "", "creation_timestamp": "2021-08-11T20:12:50.000000Z"}, {"uuid": "55c14d42-ee50-49f4-9c25-e8c3bd410ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-01T20:02:22.410305Z"}, {"uuid": "424bf0b7-7f82-42cd-948a-821566486ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.411799Z"}, {"uuid": "77cd49b2-c30d-4cb7-bc2a-ec5e7a1d9b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.604976Z"}, {"uuid": "7567b9af-de5c-4c99-9c12-5799169fde23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-02T01:02:51.069576Z"}, {"uuid": "910eaf72-f19c-4cb5-9643-6a507be24117", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T13:00:04.997564Z"}, {"uuid": "febbe174-be99-4066-982e-b1bf87b25548", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-07T15:00:06.730687Z"}, {"uuid": "6e6512c7-5d70-400d-addf-228705162f6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:44.615084Z"}, {"uuid": "4389ff2c-e866-4dae-b42c-c4eac55dbe8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-08T00:00:42.291029Z"}, {"uuid": "0d3b01c0-cb57-4a6a-b4ce-8de4f3b98961", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/lexmark_driver_privesc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Jacob Baines\", \"Shelby Pace\", \"Grant Willcox\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"Various Lexmark Universal Printer drivers as listed at advisory TE953\\n          allow low-privileged authenicated users to elevate their privileges to\\n          SYSTEM on affected Windows systems by modifying the XML file at\\n          C:\\\\ProgramData\\\\\\\\Universal Color Laser.gdl\\n          to replace the DLL path to unires.dll with a malicious DLL path.\\n\\n          When C:\\\\Windows\\\\System32\\\\Printing_Admin_Scripts\\\\en-US\\\\prnmngr.vbs is\\n          then used to add the printer to the affected system, PrintIsolationHost.exe,\\n          a Windows process running as NT AUTHORITY\\\\SYSTEM, will inspect the\\n          C:\\\\ProgramData\\\\\\\\Universal Color Laser.gdl file and will\\n          load the malicious DLL from the path specified in the file. This which will\\n          result in the malicious DLL executing as NT AUTHORITY\\\\SYSTEM.\\n\\n          Once this module is finished, it will use the prnmngr.vbs script\\n          to remove the printer it added.\", \"disclosure_date\": \"2021-07-15\", \"fullname\": \"exploit/windows/local/lexmark_driver_privesc\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Lexmark Driver Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"service-resource-loss\"]}, \"path\": \"/modules/exploits/windows/local/lexmark_driver_privesc.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/local/lexmark_driver_privesc\", \"references\": [\"CVE-2021-35449\", \"URL-http://support.lexmark.com/index?page=content&id=TE953\", \"URL-https://github.com/jacob-baines/concealed_position\", \"URL-https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20presentations/Jacob%20Baines%20-%20Bring%20Your%20Own%20Print%20Driver%20Vulnerability.pdf\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": [\"Windows\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:10.105278Z"}]}