Skip to content

Ntprint New LolBin#493

Closed
sansan-monkey wants to merge 3 commits intoLOLBAS-Project:masterfrom
sansan-monkey:ntprint
Closed

Ntprint New LolBin#493
sansan-monkey wants to merge 3 commits intoLOLBAS-Project:masterfrom
sansan-monkey:ntprint

Conversation

@sansan-monkey
Copy link
Copy Markdown

No description provided.

Added details for ntprint.exe including commands, detection methods, and resources.
Added details for ntprint.exe including commands, detection methods, and resources.
@sansan-monkey sansan-monkey requested a review from a team as a code owner March 6, 2026 14:55
@sansan-monkey
Copy link
Copy Markdown
Author

Details:
The idea is take advantage of the ntprint.exe, copy the binary from the C:\Windows\System32\ntprint.exe to C:\User\user\atomic and in the same path add the malicious ntprint.dll of this way when execute the ntprint.exe with the next command line "ntprint.exe PSetupElevatedLegacyPrintDriverInstallW {}" the dll will be executed

image

@wietze
Copy link
Copy Markdown
Member

wietze commented Mar 14, 2026

Hi @sansan-monkey , thanks for this submission. As per our criteria, DLL Hijacking submissions are only considered for this project if they don't require relocation. If I'm understanding you correctly, this is a prerequisite for the finding you're describing, and as such, this project isn't the best fit for your submission.

That said, I noticed you already submitted the same finding to HijackLibs, which has already adopted it. Thanks!

@wietze wietze closed this Mar 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants