An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system, aka 'Windows Print Spooler Elevation of Privilege Vulnerability'.
| Product | Version | Update | Edition | Tested |
|---|---|---|---|---|
| Windows 7 | X86/x64 | SP1 | ||
| Windows 8.1 | X86/x64 | |||
| Windows 10 | X86/x64 | |||
| Windows 10 | X86/x64 | 1607 | ||
| Windows 10 | X86/x64/ARM64 | 1709 | ||
| Windows 10 | X86/x64/ARM64 | 1803 | ||
| Windows 10 | X86/x64/ARM64 | 1809 | ||
| Windows 10 | X86/x64/ARM64 | 1903 | ||
| Windows 10 | X86/x64/ARM64 | 1909 | ✔ | |
| Windows 10 | X86/x64/ARM64 | 2004 | ||
| Windows Server 2008 | X86/x64 | SP2 | ||
| Windows Server 2008 | x64 | R2 | SP1 | |
| Windows Server 2012 | ||||
| Windows Server 2012 | R2 | |||
| Windows Server 2016 | ||||
| Windows Server 2019 | ||||
| Windows Server | 1903 | |||
| Windows Server | 1909 | |||
| Windows Server | 2004 |
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337
CompilerEnvironment
- VS2019（V142）X64 Release
- VS2019（V142）X64 Debug
The first way:
You need to use the administrator privilege to put the phoneinfo.dll file in the C:\Windows\System32 directory, then execute the Wertrigger.exe file
The second way:
Sailay1996 wrote a PS1 script, but there is a limit to restart the machine. First, use the PS1 script to execute, and then restart it. PhoneInfo.dll is already in C:\windows\system32 Need to run Wertrigger.exe file
Test Machine Windows 10 1909 x64 as shown
