Question

During an internal penetration test, you have valid low-privileged domain user credentials on a fully patched-except-one Windows Server 2019 domain controller. The host exposes the MS-RPRN and MS-PAR interfaces, and the Print Spooler service is running. Your goal is to gain SYSTEM-level code execution on the DC by abusing a known CVE. Which technique should you use?

Accepted Answer

Exploit PrintNightmare (CVE-2021-34527) by using the authenticated RpcAddPrinterDriverEx call to load a malicious driver DLL from a remote share, executing it as SYSTEM

Answer

Perform a Kerberoasting attack against the spooler service account and crack the resulting TGS ticket offline

Answer

Use the PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx) to coerce the DC into authenticating back to your host, then replay the hash

Answer

Abuse an unquoted service path in the Print Spooler binary to drop a payload that runs at service startup