Bring Your Own Print Driver Vulnerability
Abusing Windows print driver installation as a path from low privilege toward SYSTEM.
Summary
Security researcher Jake from SafeBreach presents "Bring Your Own Print Driver Vulnerability" on the DEF CON 29 Main Stage, introducing a novel local privilege escalation (LPE) technique that weaponizes legitimately signed, third-party printer drivers to elevate privileges to NT AUTHORITY\SYSTEM on modern Windows installations.
[09:59] Jake explores the security model of the Windows Print Spooler service (spoolsv.exe), which operates under the high-privilege SYSTEM context. He explains that while recent zero-days like PrintNightmare highlighted native spooler vulnerabilities, administrative policies and Microsoft patches often restrict remote point-and-print features. However, low-privileged local users frequently retain the right to add printers and load driver packages.
[21:07] The presentation details the "Bring Your Own Driver" attack concept. Rather than attacking the Windows OS itself, an attacker supplies an older, legitimate printer driver from vendors like Canon, HP, or Lexmark that contains known vulnerabilities. Jake walks through analyzing vendor driver packages [32:07], demonstrating how flawed driver installer routines, arbitrary directory writes in ProgramData/AppData, and unquoted registry keys allow an unprivileged attacker to trigger DLL hijacking inside the Print Spooler service, executing arbitrary code with full SYSTEM privileges. He concludes with detection metrics and mitigation strategies for enterprise administrators.
(AI summary — Gemini Flash)
Related talks
Main Stage·43 min
Jacob Baines
Jacob Baines demonstrates how unprivileged Windows users can install vulnerable, signed third-party printer drivers (BYOVD) to escalate to SYSTEM on fully patched hosts.
Main Stage·31 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar audit the Windows Print Spooler service a decade after Stuxnet, uncovering multiple zero-day SYSTEM privilege escalation bugs.
Main Stage·35 min
Zhipeng Huo · Chuanda Ding
Zhipeng Huo and Chuanda Ding uncover critical vulnerabilities in the Windows Print Spooler RPC protocol, achieving local privilege escalation and remote code execution.