reply on: Bitwarden Hack - How to Break Into Password Vaults Without Using Passwords 👀 \ stacker news ~security

843 sats \ 3 replies \ @ek 4 Jan \ on: Bitwarden Hack - How to Break Into Password Vaults Without Using Passwords 👀 security

Ahh, Windows hacks, my favorite hacks! Always fun to see how Windows works under the hood and how their weird design gets exploited. But to be fair, most of their codes is probably that weird for historic reasons.

This post gave me the idea that I should post a write-up about a challenge in a pentesting lab. We had to get root on a Windows machine by pretending we're a printer spooler (program that queues documents for printing). Fun times :)

What is a print spooler? The print spooler is a dedicated program/software that essentially manages the order of the documents to proceed to the print queue. When you select print, your program talks to the print spooler service to work out how to render (or draw) your print job so the printer will understand it and put the colors in the right spots on the page. There are all different types of spoolers in computing (once upon a time there were literal tape spools running inside computers), so the print spooler, you guessed it, takes care of just your print documents.

-- papercut.com

What Is The Print Nightmare? Print Nightmare is actually a Remote Code Execution(RCE) vulnerability identified as CVE-2021-34527 in Microsoft’s Windows Print Spooler service. This Print Nightmare vulnerability grants access to the “RpcAddPrinterDriverEx()” a feature that installs new printer drivers in the system. Consequently, through this printing nightmare, hackers can gain complete access to the vulnerable system.

Windows Print Spooler is software that maintains a connection between the Windows operating system and a printer. It acts as a print server performing certain print activities like operating printer drivers and executing printing jobs.

-- https://www.uniprint.net/en/print-nightmare-exploit-a-detailed-analysis/

0 sats \ 2 replies \ @Eobard OP 4 Jan

deleted by author

231 sats \ 1 reply \ @ek 4 Jan

They do but they aren't as funny. Linux is FOSS, Windows is proprietary.

So reading about Windows hacks is sometimes more interesting since you usually don't have the chance to learn about Windows internals and there is definitely some schadenfreude involved.

For example, did you know what we're still using JPEG and JPG as a file extension even though they are referring to the same image format? That's only because Windows used to not support more than three letters for file extensions:

JPG and JPEG are file extensions that both refer to the same image format. The two names exist because some early Windows computers only supported three-character extensions, but modern devices recognize both JPGs and JPEGs and handle them the same.

-- https://www.howtogeek.com/796389/jpg-vs.-jpeg-are-they-the-same-thing/

0 sats \ 0 replies \ @Eobard OP 4 Jan

deleted by author