MS-RPRN abuse (PrinterBug)
Last updated
Was this helpful?
Last updated
Was this helpful?
Microsoft’s Print Spooler is a service handling the print jobs and other various tasks related to printing. An attacker controling a domain user/computer can, with a specific RPC call, trigger the spooler service of a target running it and make it authenticate to a target of the attacker's choosing. This flaw is a "won't fix" and enabled by default on all Windows environments ().
The coerced authentications are made over SMB. But MS-RPRN abuse can be combined with to elicit incoming authentications made over HTTP which heightens capabilities.
The "specific call" mentioned above is the RpcRemoteFindFirstPrinterChangeNotificationEx notification method, which is part of the MS-RPRN protocol. MS-RPRN is Microsoft’s Print System Remote Protocol. It defines the communication of print job processing and print system management between a print client and a print server.
Remotely checking if the spooler is available can be done with (Powershell) or with (Python).
The spooler service can be triggered with or (C#). There are many alternatives available publicly on the Internet.
Trigger the spooler service
