CVE-2022-30206 PoC — Windows Print Spooler Elevation of Privilege Vulnerability

Source

https://github.com/MagicPwnrin/CVE-2022-30206

Associated Vulnerability

Title:Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2022-30206)
Description:Windows Print Spooler Elevation of Privilege Vulnerability

Description

Exploit for CVE-2022-30206

Readme

# CVE-2022-30206
This is the PoC for CVE-2022-30206.

## Introduction
Perform the following operations to arbitrary file deletion：
1. Run the `addprinter.exe` to create a printer and set the SpoolDirectory in `C:\Users\Public\tmp\1`.
2. Run the `FileLock.exe TargetFile` to redirect .SHD file to TargetFile and set a oplock on TargetFile.
3. Run the `openprinter.exe` to make the printer work, which will trigger the oplock, then release the oplock, the TargetFile will be deleted.

![](display.gif)

## PS
1. This PoC needs to be combined with some other tricks(such as <https://github.com/thezdi/PoC/tree/master/FilesystemEoPs>) to make arbitrary file deletion to achieve EoP
2. If the execution is not successful at one time, you need to modify the .SHD filename of the FileLock's main.cpp. Normally, the file id is incremented by two each time after a print job, please try 00005.SHD、00007.SHD…

File Snapshot


 [4.0K]  /data/pocs/3d95ffba2c877140b61d581aebc3f38bdb1fb09a
├── [4.0K]  addpriner
│   ├── [4.0K]  addpriner
│   │   ├── [6.9K]  addpriner.vcxproj
│   │   ├── [ 945]  addpriner.vcxproj.filters
│   │   ├── [ 165]  addpriner.vcxproj.user
│   │   └── [1.8K]  main.cpp
│   └── [1.4K]  addpriner.sln
├── [268K]  display.gif
├── [4.0K]  FileLock
│   ├── [4.0K]  CommonUtils
│   │   ├── [3.5K]  CommonUtils.cpp
│   │   ├── [1023]  CommonUtils.h
│   │   ├── [5.3K]  CommonUtils.vcxproj
│   │   ├── [2.6K]  CommonUtils.vcxproj.filters
│   │   ├── [ 165]  CommonUtils.vcxproj.user
│   │   ├── [1.9K]  DirectoryObject.cpp
│   │   ├── [4.3K]  FileOpLock.cpp
│   │   ├── [ 753]  FileOpLock.h
│   │   ├── [4.7K]  FileSymlink.cpp
│   │   ├── [ 562]  FileSymlink.h
│   │   ├── [1.6K]  Hardlink.cpp
│   │   ├── [1.9K]  NativeSymlink.cpp
│   │   ├── [2.2K]  ntimports.h
│   │   ├── [5.0K]  RegistrySymlink.cpp
│   │   ├── [ 13K]  ReparsePoint.cpp
│   │   ├── [1.2K]  ReparsePoint.h
│   │   ├── [1.7K]  ScopedHandle.cpp
│   │   ├── [ 473]  ScopedHandle.h
│   │   ├── [ 290]  stdafx.cpp
│   │   ├── [ 260]  stdafx.h
│   │   ├── [ 306]  targetver.h
│   │   └── [1.3K]  typed_buffer.h
│   ├── [4.0K]  FileLock
│   │   ├── [7.5K]  FileLock.vcxproj
│   │   ├── [ 945]  FileLock.vcxproj.filters
│   │   ├── [ 221]  FileLock.vcxproj.user
│   │   └── [2.0K]  main.cpp
│   └── [2.1K]  FileLock.sln
├── [4.0K]  openprinter
│   ├── [4.0K]  openprinter
│   │   ├── [ 748]  main.cpp
│   │   ├── [6.9K]  openprinter.vcxproj
│   │   ├── [ 945]  openprinter.vcxproj.filters
│   │   └── [ 165]  openprinter.vcxproj.user
│   └── [1.4K]  openprinter.sln
└── [ 904]  README.md

7 directories, 39 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!