PE-PRI
PrintSpoofer
Exploits SeImpersonatePrivilege via the Print Spooler bug to escalate a service account to SYSTEM.
OVERVIEW
PrintSpoofer abuses the Print Spooler "Printer Bug" combined with any account that holds SeImpersonatePrivilege — very common for service accounts (IIS app pools, SQL Server, etc.) — to coerce the Spooler service into connecting back to a named pipe it controls, then impersonates the resulting SYSTEM token.
It's part of the "potato" family of local privilege-escalation tools and was one of the more reliable options on Windows 10 and Server 2016/2019 after earlier potato techniques were patched, though it depends on the Print Spooler service actually running on the target.
USE CASES
Practical use cases
- 01
Escalating from a service account (IIS, SQL Server, etc.) with SeImpersonatePrivilege to NT AUTHORITY\SYSTEM.
- 02
Spawning a SYSTEM process on an interactive RDP or VDI session for a logged-on user.
- 03
Validating whether a service account's excessive impersonation privilege is practically exploitable for the report.
- 04
Confirming whether the target's Print Spooler exposure translates into a real privilege-escalation path.
QUICK START
On a Windows host where the current account holds SeImpersonatePrivilege (typical of service accounts), to escalate directly to SYSTEM.
- Confirm the current account holds SeImpersonatePrivilege (whoami /priv).
- Verify local privilege-escalation testing is authorized on this host.
- Run PrintSpoofer with a command to execute as SYSTEM (e.g. a reverse shell or cmd.exe).
- Confirm the resulting shell is running as NT AUTHORITY\SYSTEM before continuing.
PrintSpoofer.exe -i -c cmdBEFORE YOU RUN IT
What to check before running it
The repository is archived and ships with no LICENSE file, so redistribution terms default to standard copyright — check with the client before including the binary in a deliverable.
It only works while the Print Spooler service is running on the target; many hardened environments have since disabled or restricted it.
Named-pipe impersonation for privilege escalation is a well-documented technique that modern EDR increasingly flags — confirm detection expectations with the client.