Security researcher in Google Project Zero. Author of Attacking Network Protocols. Tweets are my own etc. Mastodon: @tiraniddo@infosec.exchange
Jul 1, 2021 • 6 tweets • 2 min read
The patched version of spoolsv for #PrinterNightmare is interesting. The call to YIsElevated seems to be an admin check is disguise, basically only admins can open the process token for TOKEN_QUERY, which if fails will return FALSE even if the process token is elevated.
It'll then check if elevation is required from the NoWarningNoElevationOnInstall is enabled. If YIsElevated returns FALSE and YIsElevationRequired returns TRUE then it's based on the result of RunningAsLUA.
