PRET - Printer Exploitation Toolkit
PRET adalah tools baru untuk pengujian keamanan printer yang dikembangkan dalam lingkup Master's Thesis di Ruhr University Bochum. Ini terhubung ke perangkat via Network atau USB dan exploit fitur-fitur bahasa printer yang digunakan. Saat ini PostScript, PJL dan PCL didukung oleh sebagian besar printer laser. Ini memungkinkan hal-hal keren seperti meng capture atau memanipulasi program printer itu sendiri, mengakses sistem file dan memori printer atau bahkan menyebabkan kerusakan fisik (hardware) pada perangkat. Semua serangan didokumentasikan secara rinci di The Hacking Printers Wiki.
Fungsi utama PRET adalah untuk memfasilitasi komunikasi antara end-user dan printer. Jadi, setelah memasukkan perintah UNIX-like, PRET menerjemahkannya ke PostScript, PJL atau PCL, mengirimkannya ke printer, mengevaluasi hasilnya dan menerjemahkannya kembali ke format yang user-friendly. PRET juga menyediakan sejumlah perintah yang berguna untuk serangan printer dan fuzzing.
PRET membutuhkan target yang valid dan printer language sebagai argumen. Target dapat berupa IP address/hostname dari network printer (dengan port 9100/tcp open) atau perangkat seperti / dev / usb / lp0 untuk local USB printer. Untuk menemukan semua printer jaringan di subnetmu bisa menggunakan SNMP Broadcast, jalankan PRET tanpa argumen:
Daftar perintah umum PRET lihat di bawah ini:
Generic file system operations dengan PS/PJL/PCL :
Tidak semua perintah didukung oleh setiap printer. Terutama perangkat Brother dan Kyocera menggunakan klon PostScript mereka sendiri - Br-Script dan KPDL - bukan lisensi asli 'Adobe PostScript'.
Daftar File :
Fungsi utama PRET adalah untuk memfasilitasi komunikasi antara end-user dan printer. Jadi, setelah memasukkan perintah UNIX-like, PRET menerjemahkannya ke PostScript, PJL atau PCL, mengirimkannya ke printer, mengevaluasi hasilnya dan menerjemahkannya kembali ke format yang user-friendly. PRET juga menyediakan sejumlah perintah yang berguna untuk serangan printer dan fuzzing.
Instalasi :
PRET hanya membutuhkan interpreter Python2. Namun, untuk output berwarna dan SNMP Support, kita harus menginstall beberapa modul:# pip install colorama pysnmp# pip install win_unicode_console# apt-get install imagemagick ghostscriptCara Menggunakan :
usage: pret.py [-h] [-s] [-q] [-d] [-i file] [-o file] target {ps,pjl,pcl}
positional arguments:
target printer device or hostname
{ps,pjl,pcl} printing language to abuse
optional arguments:
-h, --help show this help message and exit
-s, --safe verify if language is supported
-q, --quiet suppress warnings and chit-chat
-d, --debug enter debug mode (show traffic)
-i file, --load file load and run commands from file
-o file, --log file log raw data sent to the targetContoh Penggunaan :
$ ./pret.py laserjet.lan ps
$ ./pret.py /dev/usb/lp0 pjlPRET membutuhkan target yang valid dan printer language sebagai argumen. Target dapat berupa IP address/hostname dari network printer (dengan port 9100/tcp open) atau perangkat seperti / dev / usb / lp0 untuk local USB printer. Untuk menemukan semua printer jaringan di subnetmu bisa menggunakan SNMP Broadcast, jalankan PRET tanpa argumen:
./pret.py
No target given, discovering local printers
address device uptime status
───────────────────────────────────────────────────────────────────────────────
192.168.1.5 hp LaserJet 4250 10:21:49 Ready
192.168.1.11 HP LaserJet M3027 MFP 13 days Paper jam
192.168.1.27 Lexmark X792 153 days Ready
192.168.1.28 Brother MFC-7860DW 16:31:17 Sleep mode Perintah Dasar :
Setelah terhubung ke perangkat printer, kamu akan melihat shell PRET dan dapat menjalankan berbagai perintah:$ ./pret.py laserjet.lan pjl
________________
_/_______________/|
/___________/___//|| PRET | Printer Exploitation Toolkit v0.25
|=== |----| || by Jens Mueller <jens.a.mueller@rub.de>
| | ô| ||
|___________| ô| ||
| ||/.´---.|| | || 「 cause your device can be
|-||/_____\||-. | |´ more fun than paper jams 」
|_||=L==H==||_|__|/
(ASCII art by
Jan Foerster)
Connection to laserjet.lan established
Device: hp LaserJet 4250
Welcome to the pret shell. Type help or ? to list commands.
laserjet.lan:/> help
Available commands (type help <topic>):
=======================================
append debug edit free id ls open restart timeout
cat delete env fuzz info mirror printenv selftest touch
cd df exit get load mkdir put set traversal
chvol disable find help lock nvram pwd site unlock
close display format hold loop offline reset status version
laserjet.lan:/> ls ../../
- 834 .profile
d - bin
d - dev
d - etc
d - hp
d - hpmnt
- 1276 init
d - lib
d - pipe
d - tmp
laserjet.lan:/> exitDaftar perintah umum PRET lihat di bawah ini:
help List available commands or get detailed help with 'help cmd'.
debug Enter debug mode. Use 'hex' for hexdump: debug [hex]
load Run commands from file: load cmd.txt
loop Run command for multiple arguments: loop <cmd> <arg1> <arg2> …
open Connect to remote device: open <target>
close Disconnect from device.
timeout Set connection timeout: timeout <seconds>
discover Discover local printer devices via SNMP.
print Print image file or raw text: print <file>|"text"
site Execute custom command on printer: site <command>
exit Exit the interpreter.Generic file system operations dengan PS/PJL/PCL :
┌───────────┬─────┬─────┬─────┬────────────────────────────────────────┐
│ Command │ PS │ PJL │ PCL │ Description │
├───────────┼─────┼─────┼─────┼────────────────────────────────────────┤
│ ls │ ✓ │ ✓ │ ✓ │ List contents of remote directory. │
│ get │ ✓ │ ✓ │ ✓ │ Receive file: get <file> │
│ put │ ✓ │ ✓ │ ✓ │ Send file: put <local file> │
│ append │ ✓ │ ✓ │ │ Append to file: append <file> <str> │
│ delete │ ✓ │ ✓ │ ✓ │ Delete remote file: delete <file> │
│ rename │ ✓ │ │ │ Rename remote file: rename <old> <new> │
│ find │ ✓ │ ✓ │ │ Recursively list directory contents. │
│ mirror │ ✓ │ ✓ │ │ Mirror remote filesystem to local dir. │
│ cat │ ✓ │ ✓ │ ✓ │ Output remote file to stdout. │
│ edit │ ✓ │ ✓ │ ✓ │ Edit remote files with vim. │
│ touch │ ✓ │ ✓ │ │ Update file timestamps: touch <file> │
│ mkdir │ ✓ │ ✓ │ │ Create remote directory: mkdir <path> │
├───────────┼─────┼─────┼─────┼────────────────────────────────────────┤
│ cd │ ✓ │ ✓ │ │ Change remote working directory. │
│ pwd │ ✓ │ ✓ │ │ Show working directory on device. │
│ chvol │ ✓ │ ✓ │ │ Change remote volume: chvol <volume> │
│ traversal │ ✓ │ ✓ │ │ Set path traversal: traversal <path> │
├───────────┼─────┼─────┼─────┼────────────────────────────────────────┤
│ format │ ✓ │ ✓ │ │ Initialize printer's file system. │
│ fuzz │ ✓ │ ✓ │ │ File system fuzzing: fuzz <category> │
├─ ─ ─ ─ ─ ─┴─ ─ ─┴─ ─ ─┴─ ─ ─┴─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ┤
│ path - Explore fs structure with path traversal strategies. │
│ write - First put/append file, then check for its existence. │
│ blind - Read-only tests for existing files like /etc/passwd. │
├───────────┬─────┬─────┬─────┬────────────────────────────────────────┤
│ df │ ✓ │ ✓ │ │ Show volume information. │
│ free │ ✓ │ ✓ │ ✓ │ Show available memory. │
└───────────┴─────┴─────┴─────┴────────────────────────────────────────┘Perintah di PS mode :
id Show device information.
version Show PostScript interpreter version.
devices Show available I/O devices.
uptime Show system uptime (might be random).
date Show printer's system date and time.
pagecount Show printer's page counter.
lock Set startjob and system parameters password.
unlock Unset startjob and system parameters password.
restart Restart PostScript interpreter.
reset Reset PostScript settings to factory defaults.
disable Disable printing functionality.
destroy Cause physical damage to printer's NVRAM.
hang Execute PostScript infinite loop.
overlay Put overlay eps file on all hardcopies: overlay <file.eps>
cross Put printer graffiti on all hardcopies: cross <font> <text>
replace Replace string in documents to be printed: replace <old> <new>
capture Capture further jobs to be printed on this device.
hold Enable job retention.
set Set key to value in topmost dictionary: set <key=value>
known List supported PostScript operators: known <operator>
search Search all dictionaries by key: search <key>
dicts Return a list of dictionaries and their permissions.
resource List or dump PostScript resource: resource <category> [dump]
dump Dump dictionary: dump <dict>
Dictionaries: - systemdict - statusdict - userdict
- globaldict - serverdict - errordict
- internaldict - currentsystemparams
- currentuserparams - currentpagedevice
config Change printer settings: config <setting>
duplex - Set duplex printing.
copies # - Set number of copies.
economode - Set economic mode.
negative - Set negative print.
mirror - Set mirror inversion.Tidak semua perintah didukung oleh setiap printer. Terutama perangkat Brother dan Kyocera menggunakan klon PostScript mereka sendiri - Br-Script dan KPDL - bukan lisensi asli 'Adobe PostScript'.
Perintah di PJL mode :
id Show device information.
status Enable status messages.
version Show firmware version or serial number (from 'info config').
pagecount Manipulate printer's page counter: pagecount <number>
printenv Show printer environment variable: printenv <VAR>
env Show environment variables (alias for 'info variables').
set Set printer environment variable: set <VAR=VALUE>
display Set printer's display message: display <message>
offline Take printer offline and display message: offline <message>
restart Restart printer.
reset Reset to factory defaults.
selftest Perform various printer self-tests.
disable Disable printing functionality.
destroy Cause physical damage to printer's NVRAM.
flood Flood user input, may reveal buffer overflows.
lock Lock control panel settings and disk write access.
unlock Unlock control panel settings and disk write access.
hold Enable job retention.
nvram NVRAM operations: nvram <operation>
nvram dump [all] - Dump (all) NVRAM to local file.
nvram read addr - Read single byte from address.
nvram write addr value - Write single byte to address.
info Show information: info <category>
info config - Provides configuration information.
info filesys - Returns PJL file system information.
info id - Provides the printer model number.
info memory - Identifies amount of memory available.
info pagecount - Returns the number of pages printed.
info status - Provides the current printer status.
info ustatus - Lists the unsolicited status variables.
info variables - Lists printer's environment variables.Perintah di PCL mode :
selftest Perform printer self-test.
info Show information: info <category>
info fonts - Show installed fonts.
info macros - Show installed macros.
info patterns - Show user-defined patterns.
info symbols - Show symbol sets.
info extended - Show extended fonts.
Daftar File :
pret.py- Executable main programcapabilities.py- Routines to check for printer langauge supportdiscovery.py- Routines to list printers using SNMP broadcastprinter.py- Generic code to describe a printing devicepostscript.py- PS spezific code (inherits from class printer)pjl.py- PJL spezific code (inherits from class printer)pcl.py- PCL spezific code (inherits from class printer)helper.py- Help functions for output, logging, sockets, etc.codebook.py- Static table of PJL status/error codesfuzzer.py- Constants for file system fuzzingmibs/*- Printer specific SNMP MIBsdb/*- database of supported modelslpd/*- Scripts for LPD fuzzing
Comments
Post a Comment