printspoofer

Rust implementation of the printspoofer privilege escalation technique.

Creates a named pipe and listens for connections. Once an account connects, a primary token gets created from the impersonation token and cmd.exe is spawned in the context of the impersonated user.

Compile with cargo build

Original research: PrintSpoofer - Abusing Impersonation Privileges on Windows 10 and Server 2019
Use can use SpoolSample to force the SYSTEM account to connect to your named pipe.

printspoofer