Skip to content

Commit 26a6153

Browse files
itm4nitm4n
committed
Moved Point and Print exploit PoC to distinct repository
1 parent f95a472 commit 26a6153

File tree

10 files changed

+9
-644
lines changed

10 files changed

+9
-644
lines changed

‎.github/workflows/build.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -111,11 +111,6 @@ jobs:
111111
run: |
112112
. ./build/Build.ps1
113113
Invoke-Build -Name "PrivescCheck" -NoNewSeed
114-
- name: Build PointAndPrint script
115-
shell: pwsh
116-
run: |
117-
. ./build/Build.ps1
118-
Invoke-Build -Name "PointAndPrint" -NoNewSeed
119114
- name: Create release
120115
env:
121116
GH_TOKEN: ${{ github.token }}

‎README.md‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -128,12 +128,6 @@ Get-Content .\PrivescCheck.ps1 | Out-String | Invoke-Expression
128128

129129
### PowerShell Version 2
130130

131-
If you see this at the beginning of the script, it just means that the **minimum** PowerShell version required for it to run is PSv2.
132-
133-
```powershell
134-
#Requires -Version 2
135-
```
136-
137131
A common way to bypass [Constrained Language Mode](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/) consists in using PSv2 as it does not implement this protection. Therefore, a significant part of the development effort goes into maintaining this retro-compatibility.
138132

139133
> :information_source: Although PowerShell version 2 ~~is still enabled by default on recent versions of Windows~~ ([PowerShell 2.0 removal from Windows](https://support.microsoft.com/en-us/topic/powershell-2-0-removal-from-windows-fe6d1edc-2ed2-4c33-b297-afe82a64200a)), it cannot run without the .Net framework version 2.0, which requires a manual install.

‎build/Build.ps1‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ function Invoke-Build {
33
[CmdletBinding()]
44
param(
55
[Parameter(Mandatory = $true)]
6-
[ValidateSet("PrivescCheck", "PointAndPrint")]
6+
[ValidateSet("PrivescCheck")]
77
[String] $Name,
88

99
[Switch] $NoNewSeed
@@ -24,7 +24,6 @@ function Invoke-Build {
2424
$SanityCheck = $false
2525
}
2626

27-
$ScriptHeader = "#Requires -Version 2`r`n`r`n"
2827
$RootPath = Split-Path -Path (Split-Path -Path $PSCommandPath -Parent) -Parent
2928

3029
$WordList = Get-FileContent -Type "data" -FileName "WordList.txt" | Where-Object { -not [String]::IsNullOrEmpty($_) }
@@ -70,7 +69,7 @@ function Invoke-Build {
7069

7170
$ScriptFilename = "$($BuildProfileObject.Name).ps1"
7271
$ScriptPath = Join-Path -Path $RootPath -ChildPath "release\$($ScriptFilename)"
73-
$ScriptContent = "$($ScriptHeader)"
72+
$ScriptContent = ""
7473
$ErrorCount = 0
7574
$Modules = @()
7675

‎build/BuildProfiles.json‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -220,12 +220,6 @@
220220
"CHECK_CREDENTIALS",
221221
"CHECK_MISC"
222222
]
223-
},
224-
{
225-
"Id": "EXPLOIT_POINT_AND_PRINT",
226-
"Files": [
227-
"EXPLOIT_POINT_AND_PRINT"
228-
]
229223
}
230224
],
231225
"Profiles": [
@@ -237,14 +231,6 @@
237231
"HELPERS",
238232
"CHECKS"
239233
]
240-
},
241-
{
242-
"Id": "POINT_AND_PRINT",
243-
"Name": "PointAndPrint",
244-
"Includes": [
245-
"CORE",
246-
"EXPLOIT_POINT_AND_PRINT"
247-
]
248234
}
249235
]
250236
}

‎build/Seed.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
60903217
1+
1164642816

‎info/CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog
22

3+
## 2025-11-09
4+
5+
### Removed
6+
7+
- Point and Print exploit PoC moved to a dedicated repository.
8+
39
## 2025-11-08
410

511
### Added

‎src/core/WinApi.Enum.ps1‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -430,18 +430,6 @@ $script:WTS_CONNECTSTATE_CLASS = New-Enum $Module WinApiModule.WTS_CONNECTSTATE_
430430
Init = 9
431431
}
432432

433-
$script:APD_FILE_COPY_FLAGS = New-Enum $Module WinApiModule.APD_FILE_COPY_FLAGS UInt32 @{
434-
APD_STRICT_UPGRADE = 0x00000001
435-
APD_STRICT_DOWNGRADE = 0x00000002
436-
APD_COPY_ALL_FILES = 0x00000004
437-
APD_COPY_NEW_FILES = 0x00000008
438-
APD_COPY_FROM_DIRECTORY = 0x00000010
439-
APD_DONT_COPY_FILES_TO_CLUSTER = 0x00001000
440-
APD_COPY_TO_ALL_SPOOLERS = 0x00002000
441-
APD_INSTALL_WARNED_DRIVER = 0x00008000
442-
APD_RETURN_BLOCKING_STATUS_CODE = 0x00010000
443-
} -BitField
444-
445433
$script:ASSOCF = New-Enum $Module WinApiModule.ASSOCF UInt32 @{
446434
ASSOCF_NONE = 0x00000000
447435
ASSOCF_INIT_NOREMAPCLSID = 0x00000001

‎src/core/WinApi.Struct.ps1‎

Lines changed: 0 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -487,82 +487,6 @@ $script:WTS_SESSION_INFO_1W = New-Structure $Module WinApiModule.WTS_SESSION_INF
487487
FarmName = New-StructureField 7 String -MarshalAs @('LPWStr')
488488
}
489489

490-
$script:DRIVER_INFO_1 = New-Structure $Module WinApiModule.DRIVER_INFO_1 @{
491-
Name = New-StructureField 0 String -MarshalAs @('LPTStr')
492-
} -Charset Auto
493-
494-
$script:DRIVER_INFO_2 = New-Structure $Module WinApiModule.DRIVER_INFO_2 @{
495-
Version = New-StructureField 0 UInt32
496-
Name = New-StructureField 1 String -MarshalAs @('LPTStr')
497-
Environment = New-StructureField 2 String -MarshalAs @('LPTStr')
498-
DriverPath = New-StructureField 3 String -MarshalAs @('LPTStr')
499-
DataFile = New-StructureField 4 String -MarshalAs @('LPTStr')
500-
ConfigFile = New-StructureField 5 String -MarshalAs @('LPTStr')
501-
} -Charset Auto
502-
503-
$script:DRIVER_INFO_3 = New-Structure $Module WinApiModule.DRIVER_INFO_3 @{
504-
Version = New-StructureField 0 UInt32
505-
Name = New-StructureField 1 String -MarshalAs @('LPTStr')
506-
Environment = New-StructureField 2 String -MarshalAs @('LPTStr')
507-
DriverPath = New-StructureField 3 String -MarshalAs @('LPTStr')
508-
DataFile = New-StructureField 4 String -MarshalAs @('LPTStr')
509-
ConfigFile = New-StructureField 5 String -MarshalAs @('LPTStr')
510-
HelpFile = New-StructureField 6 String -MarshalAs @('LPTStr')
511-
DependentFiles = New-StructureField 7 String -MarshalAs @('LPTStr')
512-
MonitorName = New-StructureField 8 String -MarshalAs @('LPTStr')
513-
DefaultDataType = New-StructureField 9 String -MarshalAs @('LPTStr')
514-
} -Charset Auto
515-
516-
$script:DRIVER_INFO_4 = New-Structure $Module WinApiModule.DRIVER_INFO_4 @{
517-
Version = New-StructureField 0 UInt32
518-
Name = New-StructureField 1 String -MarshalAs @('LPTStr')
519-
Environment = New-StructureField 2 String -MarshalAs @('LPTStr')
520-
DriverPath = New-StructureField 3 String -MarshalAs @('LPTStr')
521-
DataFile = New-StructureField 4 String -MarshalAs @('LPTStr')
522-
ConfigFile = New-StructureField 5 String -MarshalAs @('LPTStr')
523-
HelpFile = New-StructureField 6 String -MarshalAs @('LPTStr')
524-
DependentFiles = New-StructureField 7 String -MarshalAs @('LPTStr')
525-
MonitorName = New-StructureField 8 String -MarshalAs @('LPTStr')
526-
DefaultDataType = New-StructureField 9 String -MarshalAs @('LPTStr')
527-
PreviousNames = New-StructureField 10 String -MarshalAs @('LPTStr')
528-
} -Charset Auto
529-
530-
$script:DRIVER_INFO_5 = New-Structure $Module WinApiModule.DRIVER_INFO_5 @{
531-
Version = New-StructureField 0 UInt32
532-
Name = New-StructureField 1 String -MarshalAs @('LPTStr')
533-
Environment = New-StructureField 2 String -MarshalAs @('LPTStr')
534-
DriverPath = New-StructureField 3 String -MarshalAs @('LPTStr')
535-
DataFile = New-StructureField 4 String -MarshalAs @('LPTStr')
536-
ConfigFile = New-StructureField 5 String -MarshalAs @('LPTStr')
537-
DriverAttributes = New-StructureField 6 UInt32
538-
ConfigVersion = New-StructureField 7 UInt32
539-
DriverVersion = New-StructureField 8 UInt32
540-
} -Charset Auto
541-
542-
$script:PRINTER_INFO_2 = New-Structure $Module WinApiModule.PRINTER_INFO_2 @{
543-
ServerName = New-StructureField 0 String -MarshalAs @('LPTStr')
544-
PrinterName = New-StructureField 1 String -MarshalAs @('LPTStr')
545-
ShareName = New-StructureField 2 String -MarshalAs @('LPTStr')
546-
PortName = New-StructureField 3 String -MarshalAs @('LPTStr')
547-
DriverName = New-StructureField 4 String -MarshalAs @('LPTStr')
548-
Comment = New-StructureField 5 String -MarshalAs @('LPTStr')
549-
Location = New-StructureField 6 String -MarshalAs @('LPTStr')
550-
DevMode = New-StructureField 7 IntPtr # Should be a pointer to a DEVMODE structure
551-
SepFile = New-StructureField 8 String -MarshalAs @('LPTStr')
552-
PrintProcessor = New-StructureField 9 String -MarshalAs @('LPTStr')
553-
DataType = New-StructureField 10 String -MarshalAs @('LPTStr')
554-
Parameters = New-StructureField 11 String -MarshalAs @('LPTStr')
555-
SecurityDescriptor = New-StructureField 12 IntPtr # Should be a pointer to a SECURITY_DESCRIPTOR structure
556-
Attributes = New-StructureField 13 UInt32
557-
Priority = New-StructureField 14 UInt32
558-
DefaultPriority = New-StructureField 15 UInt32
559-
StartTime = New-StructureField 16 UInt32
560-
UntilTime = New-StructureField 17 UInt32
561-
Status = New-StructureField 18 UInt32
562-
Jobs = New-StructureField 19 UInt32
563-
AveragePPM = New-StructureField 20 UInt32
564-
} -Charset Auto
565-
566490
$script:TPM_DEVICE_INFORMATION = New-Structure $Module WinApiModule.TPM_DEVICE_INFORMATION @{
567491
TpmVersion = New-StructureField 0 UInt32
568492
ManufacturerId = New-StructureField 1 String -MarshalAs @('ByValTStr', 5)

‎src/core/WinApi.ps1‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -79,14 +79,6 @@ $FunctionDefinitions = @(
7979
(New-Function vaultcli VaultFree ([UInt32]) @([IntPtr]) -EntryPoint VaultFree),
8080
(New-Function vaultcli VaultCloseVault ([UInt32]) @([IntPtr].MakeByRefType()) -EntryPoint VaultCloseVault),
8181

82-
(New-Function winspool.drv AddPrinterDriverEx ([Bool]) @([String], [UInt32], [IntPtr], [UInt32]) -Charset Auto -SetLastError -EntryPoint AddPrinterDriverEx),
83-
(New-Function winspool.drv EnumPrinterDrivers ([Bool]) @([String], [String], [UInt32], [IntPtr], [UInt32], [UInt32].MakeByRefType(), [UInt32].MakeByRefType()) -Charset Auto -SetLastError -EntryPoint EnumPrinterDrivers),
84-
(New-Function winspool.drv DeletePrinterDriver ([Bool]) @([String], [String], [String]) -Charset Auto -SetLastError -EntryPoint DeletePrinterDriver),
85-
(New-Function winspool.drv DeletePrinterDriverEx ([Bool]) @([String], [String], [String], [UInt32], [UInt32]) -Charset Auto -SetLastError -EntryPoint DeletePrinterDriverEx),
86-
(New-Function winspool.drv AddPrinter ([IntPtr]) @([String], [UInt32], [IntPtr]) -Charset Auto -SetLastError -EntryPoint AddPrinter),
87-
(New-Function winspool.drv DeletePrinter ([Bool]) @([IntPtr]) -SetLastError -EntryPoint DeletePrinter),
88-
(New-Function winspool.drv ClosePrinter ([Bool]) @([IntPtr]) -SetLastError -EntryPoint ClosePrinter),
89-
9082
(New-Function wlanapi WlanOpenHandle ([UInt32]) @([UInt32], [IntPtr], [UInt32].MakeByRefType(), [IntPtr].MakeByRefType()) -EntryPoint WlanOpenHandle),
9183
(New-Function wlanapi WlanCloseHandle ([UInt32]) @([IntPtr], [IntPtr]) -EntryPoint WlanCloseHandle),
9284
(New-Function wlanapi WlanEnumInterfaces ([UInt32]) @([IntPtr], [IntPtr], [IntPtr].MakeByRefType()) -EntryPoint WlanEnumInterfaces),

0 commit comments

Comments
 (0)