Bring Your Own Print Driver Vulnerability
Jacob Baines demonstrates how unprivileged Windows users can install vulnerable, signed third-party printer drivers (BYOVD) to escalate to SYSTEM on fully patched hosts.
Summary
The Unprivileged Installation of Windows Printer Drivers
Point and Print features in Windows allow standard unprivileged domain users to install certified third-party printer drivers without administrative approval.
Bring Your Own Vulnerable Driver (BYOVD) for Spooler Exploitation
Jacob Baines demonstrates curating a repository of signed, historically vulnerable printer drivers distributed by major hardware manufacturers.
Escalating from Low-Privilege User to SYSTEM
Installing these vulnerable drivers onto a fully patched Windows target enables an attacker to exploit known driver vulnerabilities, gaining arbitrary code execution as NT AUTHORITY\SYSTEM.
Disabling Point and Print and Restricting Driver Installation
Baines outlines Group Policy configurations and registry mitigations to restrict printer driver installation strictly to administrators.
Related talks
Main Stage·31 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar audit the Windows Print Spooler service a decade after Stuxnet, uncovering multiple zero-day SYSTEM privilege escalation bugs.
Main Stage·24 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar discuss Windows Print Spooler architecture, local privilege escalation techniques, and spooler patch testing.
Main Stage·43 min
Jacob Baines
Abusing Windows print driver installation as a path from low privilege toward SYSTEM.