Hack Windows Machines with Printer Protocol
Zhipeng Huo and Chuanda Ding uncover critical vulnerabilities in the Windows Print Spooler RPC protocol, achieving local privilege escalation and remote code execution.
Summary
25 Years of the Windows Print Spooler Service
Executing as NT AUTHORITY\SYSTEM, the Windows Print Spooler service processes network requests, dynamic driver loading, and inter-process communication without process sandboxing.
Dissecting Spooler RPC Interfaces and Driver Loading
Zhipeng Huo and Chuanda Ding investigate undocumented RPC methods exposed by `spoolsv.exe`, evaluating how printer drivers are registered and verified.
Chaining Flaws from Local Privilege Escalation to Remote RCE
Exploiting path traversal and file manipulation flaws in driver installation pipelines allows unprivileged users to execute arbitrary code as SYSTEM locally and across the network.
Coordinated Remediation and Security Guidelines
The authors present exploit demonstrations and discuss Microsoft security patches designed to enforce strict signature validation on printer drivers.
Related talks
Main Stage·31 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar audit the Windows Print Spooler service a decade after Stuxnet, uncovering multiple zero-day SYSTEM privilege escalation bugs.
Main Stage·36 min
Ron Ben Yizhak
Introduces RPC Racer, a technique that exploits race conditions in Windows RPC endpoint registration to hijack privileged system service communication.
Main Stage·43 min
Jacob Baines
Jacob Baines demonstrates how unprivileged Windows users can install vulnerable, signed third-party printer drivers (BYOVD) to escalate to SYSTEM on fully patched hosts.