ADDOM-019: Print Spooler on Domain Controllers
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates every domain controller via the domainControllers attribute on the Domain object, then queries the Service Control Manager on each DC for the Spooler service. It reads two values: the Start type (2 = Automatic, 3 = Manual, 4 = Disabled) and the current Status (Running, Stopped). The check also reads HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Start as a fallback if the SCM call is blocked. A DC fails the check when Start is not 4 (Disabled), or when Status is Running, or when the policy registry value HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators is missing or set to 0.
Por qué importa
The Print Spooler service on a domain controller is the single highest-value coercion target in Active Directory, for two independent reasons. First, the MS-RPRN protocol exposes RpcRemoteFindFirstPrinterChangeNotificationEx, which any authenticated domain user can call against a remote print server to register for printer change notifications. The server then connects back to a UNC path supplied by the caller and authenticates as the server computer account. When that server is a domain controller, the inbound authentication is the DC$ machine account, which is a member of Domain Controllers and holds replication rights. An attacker who relays that authentication to ADCS web enrollment (ESC8), to LDAP with sign-and-seal disabled, or to another DC over SMB without signing, can mint a certificate for DC$ or trigger DCSync, both of which yield full domain compromise. Second, the PrintNightmare family (CVE-2021-1675 local privilege escalation and CVE-2021-34527 remote code execution) allows any authenticated user to call RpcAddPrinterDriver or AddPrinterDriverEx and load an arbitrary DLL as SYSTEM on the target. On a domain controller, SYSTEM on the DC is equivalent to Domain Admin. Microsoft shipped multiple patches in July and August 2021, but the recommended mitigation in MSRC guidance and CISA Emergency Directive 21-04 is to disable the Spooler service entirely on DCs, because the protocol surface remains attackable through related primitives (CVE-2021-36958, CVE-2022-21999 SpoolFool, and others published since). The blast radius is forest-wide: any DC with Spooler running can be coerced from any authenticated session anywhere in the forest, and the resulting credential is a DC machine account.
Ruta de ataque
1. Attacker obtains any authenticated foothold in the domain (a low-privilege user account, a kiosk session, a compromised workstation). 2. Attacker enumerates DCs via LDAP (objectCategory=computer, primaryGroupID=516) and identifies which have Spooler reachable (TCP 445 with the MS-RPRN named pipe \\pipe\spoolss exposed). 3. Attacker stands up an attacker-controlled SMB listener (impacket ntlmrelayx, Responder) or an HTTP listener targeting an ADCS Web Enrollment endpoint that lacks EPA and channel binding. 4. Attacker runs SpoolSample.exe (Lee Christensen) or dementor.py / printerbug.py (dirkjanm) against the DC, supplying the listener UNC path as the notification target: SpoolSample.exe DC01.contoso.local attacker.contoso.local. 5. The DC Spooler connects back as DC01$ and authenticates via NTLM. ntlmrelayx relays the inbound NTLM session to LDAP on a second DC or to ADCS HTTP enrollment. 6. Relayed to LDAP: attacker writes msDS-AllowedToActOnBehalfOfOtherIdentity on DC01 to enable RBCD takeover, then S4U2Self/S4U2Proxy as DC01$ yields a TGS as Domain Admin. 7. Relayed to ADCS HTTP (ESC8): attacker requests a certificate for DC01$ using the DomainController or KerberosAuthentication template, then uses the cert to authenticate as DC01$ and perform DCSync. 8. Either path yields full DA / replication rights in minutes. For PrintNightmare specifically: any authenticated user runs Invoke-Nightmare or CVE-2021-1675.py against the DC, supplying a malicious driver DLL on an SMB share. The Spooler loads the DLL as SYSTEM. Game over.
Cómo lo evalúa Guerrilla
Guerrilla performs three independent reads per domain controller to handle environments where SCM RPC is firewalled. Primary: WMI / CIM query Win32_Service WHERE Name = 'Spooler' against each DC, returning StartMode and State. A DC passes only when StartMode is 'Disabled' and State is 'Stopped'. Fallback 1: Get-Service Spooler via PowerShell remoting (port 5985) on each DC. Fallback 2: Direct registry read of HKLM\SYSTEM\CurrentControlSet\Services\Spooler\Start (value 4 = Disabled) and HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators (value 1 = restricted) via Remote Registry. The check also enumerates the Domain Controllers OU GPO inheritance and parses any GPO that defines System Services > Print Spooler, so the operator can see whether the disabled state is enforced by policy (sticky) or set manually (will drift). The cmdlet reports the OS version of each DC so the operator knows which CVE coverage applies (PrintNightmare patches require KB5005010 / KB5005033 baseline plus the registry RestrictDriverInstallationToAdministrators = 1).
Valor recomendado
Print Spooler service disabled on all domain controllers
Remediación
Disable the Print Spooler service on all domain controllers via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Print Spooler > Startup Mode = Disabled. Apply to the Domain Controllers OU. Verify no print functionality depends on DCs
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-7, CM-7(1)
- CIS Benchmark
- 5.2
- ANSSI
- R9
- CIS AD Benchmark
- 1.2.3
- MITRE ATT&CK
- T1187, T1210