After Stuxnet: Printing Still the Stairway to Heaven
Peleg Hadar and Tomer Bar audit the Windows Print Spooler service a decade after Stuxnet, uncovering multiple zero-day SYSTEM privilege escalation bugs.
Summary
The Persistent Legacy of Stuxnet's Print Spooler Exploit
In 2010, the Stuxnet worm weaponized a zero-day vulnerability in the Windows Print Spooler service to achieve SYSTEM-level code execution across industrial networks.
Revisiting the Print Spooler Attack Surface in 2020
SafeBreach researchers Peleg Hadar and Tomer Bar conduct a comprehensive audit of the modern Windows Print Spooler, expecting decades of hardening.
Discovering Multiple SYSTEM Privilege Escalation Zero-Days
Uncovering logic flaws in printer driver installation routines, directory junctions, and spool file handling enabled unprivileged local users to execute arbitrary code as SYSTEM.
Windows Architecture Hardening and Defensive Rules
The researchers discuss coordinated disclosure with Microsoft and provide endpoint detection telemetry to identify malicious spooler process injection.
Related talks
Main Stage·35 min
Zhipeng Huo · Chuanda Ding
Zhipeng Huo and Chuanda Ding uncover critical vulnerabilities in the Windows Print Spooler RPC protocol, achieving local privilege escalation and remote code execution.
Main Stage·43 min
Jacob Baines
Jacob Baines demonstrates how unprivileged Windows users can install vulnerable, signed third-party printer drivers (BYOVD) to escalate to SYSTEM on fully patched hosts.
Main Stage·24 min
Peleg Hadar · Tomer Bar
Peleg Hadar and Tomer Bar discuss Windows Print Spooler architecture, local privilege escalation techniques, and spooler patch testing.