Saint PrinterBug, Who Makes Domain Controllers Call Out

Patron of print spoolers running where nobody needs them, overly polite domain controllers, and printers nobody has ever seen.

Life

At DerbyCon in October 2018 Lee Christensen, Will Schroeder and Matt Nelson showed that a call in Windows' print protocol, MS-RPRN, forced any machine running the spooler, domain controllers included, to authenticate to a host of the attacker's choosing. Combined with Kerberos unconstrained delegation it let you capture a domain controller's ticket, even across forest trusts. Microsoft deemed it mostly by design, but fixed delegation across forests in 2019.

Prayer

O Saint PrinterBug, who rings the phone of those who never print anything, switch off the spoolers on our domain controllers. Amen.

How to celebrate

Celebrated by disabling the Print Spooler service on domain controllers, where in living memory nobody has ever printed a thing.

Leave the spooler running and you get visitors at night.