| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 30 Jan 2017 13:43:59 +0100 From: Jens Müller <jens.a.mueller@....de> To: fulldisclosure@...lists.org Subject: [FD] Hacking Printers Advisory 5/6: HP printers restoring factory defaults through PML commands TL;DR: In the scope of academic research on printer security, various vulnerabilities in network printers and MFPs have been discovered. This is advisory 5 of 6 of the `Hacking Printers' series. Each advisory discusses multiple issues of the same category. This post is about resetting a printer to factory defaults through ordinary print jobs, therefore bypassing all protection mechanisms like user-set passwords. The attack can be performed by anyone who can print, for example through USB or network. It can even be carried out by a malicious website, using cross-site printing techniques (see http://hacking-printers.net/wiki/index.php/Cross-site_printing). ========================[ Factory Defaults ]========================== -------------------------[ Affected Devices ]------------------------- This vulnerability has been verfied for the devices listed below: - HP LaserJet 4200N (Firmware version: 20050602) → PML based attacks - HP LaserJet 4250N (Firmware version: 20150130) → PML based attacks - HP LaserJet P2015dn (Firmware version: 20070221) → PML based attacks - HP LaserJet M2727nfs (Firmware version: 20140702) → PML based attacks - HP LaserJet 3392 AiO (Firmware version: 20120925) → PML based attacks - HP LaserJet CP1515n (Firmware version: 20120110) → PML based attacks - Lexmark X264dn (Firmware version: NR.APS.N645) → SNMP only - Lexmark E360dn (Firmware version: NR.APS.N645) → SNMP only - Lexmark C736dn (Firmware version: NR.APS.N644) → SNMP only - Dell 1720n (Firmware version: NM.NA.N099) → SNMP only - Kyocera FS-C5200DN (Firmware version: 2011.05.16) → SNMP only Further HP printers are likely to be affected. Vendor informed: 2016-10-17 --------------------[ Vulnerability Description ]--------------------- The `Printer-MIB' (RFC3805) defines the prtGeneralReset Object (OID 1.3.6.1.2.1.43.5.1.1.3.1) which allows an attacker to restore factory defaults (resetToFactoryDefaults(6)) using SNMP (port 161/udp). This is a legitimate feature, but can also be used by an attacker to remove/bypass protection mechanisms like user-set passwords for the embedded web server, PJL and PostScript if the default/public SNMP community string has not been changed: ---------------------------------------------------------------------- snmpset -v1 -c public printer 1.3.6.1.2.1.43.5.1.1.3.1 i 6 ---------------------------------------------------------------------- In many scenarios an attacker does not have the capabilities to perform SNMP requests because of firewalls or unknown SNMP community strings. On HP devices however, she can transform SNMP into its PML representation and embed the request within a legitimate print job: ---------------------------------------------------------------------- @PJL DMCMD ASCIIHEX="040006020501010301040106" ---------------------------------------------------------------------- This way, anyone who can print can reset the device to factory defaults and hereby remove any protection mechanisms. -------------------------[ Proof of Concept ]------------------------- A Python based proof of concept software entitled Printer Exploitation Toolkit (PRET) has been published. The attack can be reproduced as follows: $ git clone https://github.com/RUB-NDS/PRET.git $ cd PRET $ ./pret.py -q printer pjl Connection to printer established Welcome to the pret shell. Type help or ? to list commands. printer:/> reset Note that if your printer does not restart and restore factory defaults, it may still be vulnerable to SNMP based attacks as mentioned above. -----------------------[ Further Information ]------------------------ Information on this bug/feature of SNMP and PML can be found at: http://hacking-printers.net/wiki/index.php/Factory_defaults https://tools.ietf.org/html/rfc3805 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists