Check if MS-RPRN is remotely available with powershell/c#
Switch branches/tags
Nothing to show
Clone or download
Latest commit ee00f0e Oct 21, 2018
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE Initial commit Oct 21, 2018
README.md Update README.md Oct 21, 2018
SpoolerScan.ps1 Add missing parenthesis Oct 21, 2018

README.md

SpoolerScanner

Check if the spooler (MS-RPRN) is remotely available with powershell/c#

This is a follow-up of the DerbyCon presentation "The Unintended Risks of Trusting Active Directory @ DerbyCon 2018" made by @tifkin_ (Lee Christensen), @harmj0y(Will Schroeder), @enigma0x3(Matt Nelson)

Reference:

As an alternative, it can be tested by OpenPrinter but the API does not clearly expose if the parameter is incorrect or if the service is unaccessible.

My understanding of the spooler API is:

  • if you share a printer on the network, the spooler is remotely accessible on the computer sharing the printer
  • on a domain, the DC spooler may be accessible after the printer has been shared. A restart of the service on the DC switch it to an unavailable state until the printer is browser on the DC (like in the explorer when browsing a computer and its printer)
  • else the printer is not available