Windows and infrastructure hosts expose a wide range of network-reachable services and RPC interfaces, and many of them were designed for a trusted LAN rather than a hostile one. A single reachable service can be enough to coerce a machine into authenticating to an attacker, or to load code as SYSTEM, which is why these interfaces are a staple of internal compromise.
Services#
- Print Spooler: the Windows print service (MS-RPRN / MS-PAR), source of both the PrinterBug coercion primitive and the Point and Print driver-loading code execution.