PrintSpoofer

PrintSpoofer abuses SeImpersonatePrivilege held by service accounts (IIS AppPool, MSSQL, etc.) to escalate to SYSTEM. It coerces the local Print Spooler service to authenticate to an attacker-controlled named pipe (\\pipe\\spoolss) via MS-RPRN, captures the SYSTEM token with ImpersonateNamedPipeClient, and uses CreateProcessAsUser/WithTokenW to spawn a process. Use it when you land as a low-privileged service account whose token shows SeImpersonatePrivilege enabled; it works on Windows 10 / Server 2016-2019 where JuicyPotato's DCOM path was patched. Requires the Print Spooler service running and the SeImpersonate (or SeAssignPrimaryToken) privilege. Command Reference: Privilege required: SeImpersonatePrivilege

# Spawn an interactive SYSTEM shell in the current console
PrintSpoofer64.exe -i -c cmd

# Or run a single payload as SYSTEM (non-interactive)
PrintSpoofer64.exe -c "C:\Windows\System32\cmd.exe /c whoami > C:\output.txt"

Evidence

Upstream reference

Environment

Active Directory

Native

PrivEsc, Exploitation

Requires

Shell

Services

RPC

Refs

github.com/itm4n/PrintSpoofer

itm4n.github.io/printspoofer-abusing-impersonation-privileges/

book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer