ADPRIV-007: Enumeración de Print Operators
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Print Operators puede gestionar impresoras y cargar controladores de impresora en los controladores de dominio. Los controladores de impresora maliciosos pueden ejecutar código arbitrario como SYSTEM en los controladores de dominio, lo que ofrece una vía hacia el compromiso total del dominio
Por qué importa
Microsoft documents Print Operators as a Tier 0 group because the rights it carries (SeLoadDriverPrivilege on domain controllers, SeShutdownPrivilege, and the right to log on locally to DCs) collectively constitute domain dominance. SeLoadDriverPrivilege allows the holder to call NtLoadDriver and load an arbitrary kernel driver into the running operating system. Once a driver runs in kernel mode the attacker can read or modify LSASS memory, dump the NTDS.dit Active Directory database, register a SSP, or simply execute arbitrary code as SYSTEM on the domain controller. Public proof-of-concept loaders such as Capcom.sys, Dell DBUtil (CVE-2021-21551), Intel NAL (CVE-2021-3437), and many other bring-your-own-vulnerable-driver (BYOVD) primitives turn the privilege into instant kernel code execution. The blast radius is the entire forest. Print Operators is also abused as a stealthy persistence mechanism: defenders frequently audit Domain Admins, Enterprise Admins, and Administrators, but Print Operators is overlooked because it sounds operational rather than privileged. Several incident response engagements have surfaced adversary-added Print Operators members that survived for months. The group should be empty in every modern forest because Microsoft has not recommended hosting print services on domain controllers since Windows Server 2003, and PrintNightmare (CVE-2021-1675, CVE-2021-34527) made running the Print Spooler service on DCs an explicit anti-pattern.
Ruta de ataque
Step 1: Reconnaissance. The attacker, holding any authenticated foothold, queries the Builtin container for Print Operators membership: Get-ADGroupMember -Identity "Print Operators" or BloodHound MATCH p=(g:Group {objectid:"S-1-5-32-550"})<-[:MemberOf*1..]-(n) RETURN p. If they find a controllable principal (a user whose password they have, a service account whose ticket they can forge, or a machine account they control), they proceed. Step 2: Local logon to a DC. Print Operators carries the "Allow log on locally" right on domain controllers via the Default Domain Controllers Policy. The attacker uses RDP, console, or PsExec with the member account to land an interactive session on a DC. Network-only access is sufficient when combined with WMI or remote registry, but local logon makes driver loading trivial. Step 3: Driver load. The attacker selects a vulnerable signed driver (BYOVD), copies it to the DC, and calls NtLoadDriver via a small loader. Because SeLoadDriverPrivilege is held, the call succeeds without UAC or admin elevation. Public tooling includes KDMapper, EDRSandBlast loaders, and Stryker. The driver runs at ring 0. Step 4: SYSTEM execution. From kernel mode the attacker spawns a SYSTEM process, dumps LSASS, or reads the NTDS.dit file directly via raw NTFS access bypassing file locks. Credentials for krbtgt, every domain controller machine account, and every cached privileged account are now in attacker hands. Step 5: Golden ticket and persistence. With the krbtgt hash the attacker mints golden tickets, ensuring durable forest access independent of the Print Operators membership. The original Print Operators add is often removed at this point to reduce forensic signal.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Print Operators group by well-known SID (S-1-5-32-550) to avoid localization issues in non-English forests, then issues an LDAP query (objectClass=group)(objectSid=S-1-5-32-550) against the Builtin container. The member attribute is read with range retrieval to handle groups larger than the MaxValRange limit. For each member DN the check resolves the principal, captures objectClass, sAMAccountName, lastLogonTimestamp, pwdLastSet, and userAccountControl flags (ACCOUNTDISABLE, DONT_EXPIRE_PASSWORD), and recursively expands any nested groups. The check parses the Default Domain Controllers Policy GPO (GptTmpl.inf, Privilege Rights section) for SeLoadDriverPrivilege and SeShutdownPrivilege to confirm Print Operators still carries those rights. The nTSecurityDescriptor of the Print Operators object is parsed for non-default WriteProperty rights on the member attribute, since a delegated WriteMember right is equivalent to membership for attack purposes. Output includes member count, enabled vs. disabled split, last logon recency, and a flag indicating whether the Print Spooler service is also running on any DC (cross-referenced with ADPRIV checks for DC service hygiene).
Valor recomendado
Vacío. Gestione las impresoras mediante servidores de impresión dedicados, no en los controladores de dominio
Remediación
Enumere la pertenencia a Print Operators con Get-ADGroupMember -Identity 'Print Operators'. Elimine todos los miembros. Despliegue los servicios de impresión en servidores miembro dedicados en lugar de en los controladores de dominio. Restrinja la instalación de controladores de impresora mediante directiva de grupo
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), CM-7
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.7
- MITRE ATT&CK
- T1547.012, T1078.002