FROM ZERO TO SYSTEM: BUILDING PRINTSPOOFER FROM SCRATCH

Summary from the TLDR InfoSec newsletter

A Windows privilege escalation technique exploits named pipes and the Print Spooler's RPC interface to elevate accounts with SeImpersonatePrivilege, such as IIS app pool identities, to SYSTEM. It exploits its lack of SQOS protection and a path-validation bug that can be bypassed by crafting backslash/forward-slash-separated pipe paths to trigger SYSTEM connections to an attacker‑controlled pipe.