Windows and infrastructure hosts expose a wide range of network-reachable services and RPC interfaces, and many of them were designed for a trusted LAN rather than a hostile one. A single reachable service can be enough to coerce a machine into authenticating to an attacker, or to load code as SYSTEM, which is why these interfaces are a staple of internal compromise.

Services#

• Print Spooler: the Windows print service (MS-RPRN / MS-PAR), source of both the PrinterBug coercion primitive and the Point and Print driver-loading code execution.

References#

• Microsoft: MS-RPRN, Print System Remote Protocol
• HackTricks: print spooler service abuse