AnalysisPublished 3 Dec 2025

From Zero to SYSTEM: Building PrintSpoofer from Scratch

Source Reddit NetSec

Description

This report details the creation of a PrintSpoofer exploit from scratch, demonstrating how the SeImpersonatePrivilege can be abused to escalate privileges from a user with limited rights (such as IIS AppPool identities) to SYSTEM on Windows. The exploit leverages Windows Named Pipes and the Print Spooler's RPC interface, bypassing path validation via a forward slash trick to cause the SYSTEM service to connect to a malicious pipe. This connection allows token impersonation and ultimately spawning a SYSTEM shell. The author documents the technical journey including Windows internals, token manipulation, RPC calls, and evasion techniques.

Impact

Successful exploitation allows an attacker with code execution under an account with SeImpersonatePrivilege (e.g., IIS AppPool identities, SQL Server service accounts) to escalate privileges to NT AUTHORITY\SYSTEM. This can lead to full system compromise, bypassing Windows Defender protections as demonstrated. The vulnerability arises from the Print Spooler's RPC interface and its insufficient path validation, enabling SYSTEM-level token impersonation.

Defensive guidance

Until an official fix is available, restrict accounts with SeImpersonatePrivilege and monitor for suspicious RPC calls to the Print Spooler service. Consider disabling or restricting the Print Spooler service on systems where it is not required. Follow vendor guidance once available.

Summary

The author reverse-engineered the PrintSpoofer technique by building their own implementation to understand how SeImpersonatePrivilege enables privilege escalation. Named Pipes in Windows allow interprocess communication and impersonation of connected clients. The Print Spooler service, running as SYSTEM, connects to a named pipe specified via an RPC call (RpcRemoteFindFirstPrinterChangeNotificationEx) for printer change notifications. Although path validation blocks local pipe connections using backslashes, it can be bypassed using forward slashes, causing the Spooler to connect to a crafted pipe path. This connection allows the attacker to impersonate the SYSTEM token via ImpersonateNamedPipeClient(), duplicate the token, and spawn a SYSTEM-level process. The report includes code snippets and details on RPC interface compilation and usage.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 17 Sep 2026, 23:17 UTC

Technical details

References

Community reviews

Related threats