> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/print-spooler.md).
# Print Spooler
We need to escalate our privileges. Let’s check our current privileges using the command:
```
whoami /priv
```
We have `SeImpersonatePrivilege`, so we can easily elevate our privileges using PrintSpoofer. The PrintSpoofer executable is already available on our local machine in the `/root/Desktop` directory.
Let’s copy it to our SSH session using the command:
```
scp PrintSpoofer64.exe david@target.ine.local:"C:\\Users\\david\\"
```
And we have successfully transferred the file. Let’s confirm it by using the `dir` command.
Let’s execute the file using the command:
```
PrintSpoofer64.exe -i -c cmd
```
> The command `PrintSpoofer64.exe -i -c cmd` is used to exploit **SeImpersonatePrivilege** in Windows to escalate privileges. Here's a breakdown of its components:
>
> **`PrintSpoofer64.exe`** → This is the executable file for the **PrintSpoofer** exploit, which leverages the **Print Spooler service** to escalate privileges.
>
> **`-i`** → Runs the command in **interactive mode**, allowing the user to interact with the elevated session.
>
> **`-c cmd`** → Specifies the command to execute; in this case, it launches **cmd.exe** (Command Prompt) with elevated privileges.
So we need to enter the config directory using the command `cd config` and then type `dir` to list its contents.
