Intercepting Windows Printing by Modifying GDI Subsystem

Intercepting Windows Printing by Modifying GDI Subsystem by Artyom Shishkin, Positive Technologies

What for?
Basically it’s a data source for
Monitoring systems
DLP solutions

What do we have ?
FindNextPrinterChangeNotification( ):
Printer name
Timestamp
Job status
Pages count
Print providOr is the source of this info, so I wouldn’t rely on it too much.

API levels Spooler Driver components

Driver components
Print providers send jobs to a local or a remote machine
A print processor converts the spooled data into a format suitable for a print monitor
The print monitor passes the data to a port monitor
A port monitor is an interface between the usermode and the kernelmode parts of the printing system
What a mess!

Using XSS
Implementation stages :
upload your JS file by means of XSS;
add the SCRIPT tag into the HEAD to upload the file dynamically;
the commands are passed over according to the reverse shell principle;
Use a standard AJAX to address the scripts on the localhost;
Use JSONP to address the script backconnect;
Hide it in the IFRAME tag of the site.

Spooler API
A set of Spooler service functions, which serve as wrappers for driver components
At this level, we can only get the spooled data
This is a level of raw printing
Try to parse this data

GDI API
The same set of functions used for Windows graphics
A printer is a device context suitable for GDI drawing functions
hPrinter = CreateDC(‘SuperLaserJet’, params);
StartDoc(hPrinter);
TextOut(hPrinter, ‘Text’);
…
Graphical data is Windows graphical data – NT EMF format

Inside GDI
Found with the help of PEB
Thanks to Feng Yuan

The trick

Profit
Swap GDI cells to send documents to a fake printer
It is not always necessary to create your own virtual printer, you can use something like Microsoft XPS Writer
The intercepted image can be easily forwarded to the original printer

GDI Printing
Load the device context with CreateDC()
Allows one to store devmode settings
Start printing with StartDoc()
Now we know when to perform magic
Draw everything you want onto this device
Let the application do the dirty work for us
EndDoc() to finish printing
DeleteDC() to clear the device context
Clean everything up and wipe out the trails

The concept

Sample implementation

Thank you for your attention ! [email_address]

http://ptresearch.blogspot.com	1273
http://feeds.feedburner.com	22
http://ptresearch.blogspot.in	14
http://ptresearch.blogspot.ca	14
http://ptresearch.blogspot.fr	9
http://ptresearch.blogspot.de	8
http://ptresearch.blogspot.co.uk	6
http://ptresearch.blogspot.com.es	5
http://google.com	4
http://ptresearch.blogspot.se	4
http://ptresearch.blogspot.jp	2
http://ptresearch.blogspot.com.br	2
http://ptresearch.blogspot.com.au	2
http://translate.googleusercontent.com	1
http://ptresearch.blogspot.it	1
http://ptresearch.blogspot.com.ar	1

Intercepting Windows Printing by Modifying GDI Subsystem

by Positive Hack Days on Dec 29, 2011

Accessibility

Categories

Upload Details

Usage Rights

16 Embeds 1,368

Statistics

Intercepting Windows Printing by Modifying GDI Subsystem — Presentation Transcript