Exploit with no backup folder bruteforce

[citronneur]

Hello,
Thanks for your work. I'm always interesting to understand exploit to better detect it.

I found a way to exploit it without the backup bruteforce, and disable detection on it.
First call using RpcAddPrinterDriverEx for upload the malicious dll with APD_COPY_ALL_FILES flag and a second stage always using RpcAddPrinterDriverEx using APD_COPY_NEW_FILES flag but with a different name, and keep the evil dll path under C:\Windows\System32\spool\drivers\x64\3\.

On my test lab i was unabel to exploit because backup folder are always cleanup properly, so here a solution.

Have a nice day,