SGIA Eagles' Nest

pierre_pineda

More information

pierre_pineda

When we published our research on network printer security at the beginning of the year, one major point of criticism was that the tested printers models had been quite old. This is a legitimate argument. Most of the evaluated devices had been in use at our university for years and one may raise the question if new printers share the same weaknesses.

35 year old bugs features

The key point here is that we exploited PostScript and PJL interpreters. Both printer languages are ancient, de-facto standards and still supported by almost any laser printer out there. And as it seems, they are not going to disappear anytime soon. Recently, we got the chance to test a $2,799 HP PageWide Color Flow MFP 586 brand-new high-end printer. Like its various predecessors, the device was vulnerable to the following attacks:

Capture print jobs of other users if they used PostScript as a printer driver; This is done by first infecting the device with PostScript code
Manipulate printouts of other users (overlay graphics, introduce misspellings, etc.) by infecting the device with PostScript malware
List, read from and write to files on the printers file system with PostScript as well as PJL functions; limited to certain directories
Recover passwords for PostScript and PJL credentials; This is not an attack per se but the implementation makes brute-force rather easy
Launch denial of Service attacks of various kinds:
- PostScript based infinite loops
- PostScript showpage redefinition
- Disable jobmedia with proprietary PJL
- Set the device to offline mode with PJL

Now exploitable from the web

All attacks can be carried out by anyone who can print, which includes:

Web attacker:
- A malicious website that uses XSP
Network access:
- Via Jetdirect (port 9100/tcp)
- Via LPD (port 515/tcp)
- Via IPP (port 631/tcp)
Wireless access:
- Apple Air Print (enabled by default)
Cloud access:
- Google Cloud Print (disabled by default)
Physical access:
- Printing via USB cable or USB drive
- Potentially NFC printing (haven't tested)

Note that the product was tested in the default configuration. To be fair, one has to say that the HP PageWide Color Flow MFP 586 allows strong, Kerberos based user authentication. The permission to print, and therefore to attack the device, can be be limited to certain employees, if configured correctly. The attacks can be easily reproduced using our PRET software. We informed HP's Software Security Response Team (SSRT) in February.

Conclusion: Christian Slater is right

PostScript and PJL based security weaknesses have been present in laser printers for decades. Both languages make no clear distinction between page description and printer control functionality. Using the very same channel for data (to be printed) and code (to control the device) makes printers insecure by design. Manufacturers however are hard to blame. When the languages were invented, printers used to be connected to a computer's parallel or serial port. No one probably thought about taking over a printer from the web (actually the WWW did not even exist, when PostScript was invented back in 1982). So, what to do? Cutting support for established and reliable languages like PostScript from one day to the next would break compatibility with existing printer drivers. As long as we have legacy languages, we need workarounds to mitigate the risks. Otherwise, "The Wolf" like scenarios can get very real in your office…

More info

pierre_pineda

PortWitness is a bash tool designed to find out active domain and subdomains of websites using port scanning. It helps penetration testers and bug hunters collect and gather information about active subdomains for the domain they are targeting.PortWitness enumerates subdomains using Sublist3r and uses Nmap alongwith nslookup to check for active sites.Active domain or sub-domains are finally stored in an output file.Using that Output file a user can directly start testing those sites.

Sublist3r has also been integrated with this module.It's very effective and accurate when it comes to find out which sub-domains are active using Nmap and nslookup.

This tool also helps a user in getting the ip addresses of all sub-domains and stores then in a text file , these ip's can be used for further scanning of the target.

Installation

git clone https://github.com/viperbluff/PortWitness.git

BASH
This tool has been created using bash scripting so all you require is a linux machine.

Usage

bash portwitness.sh url

Download PortWitness

Related links

pierre_pineda

About RED_HAWK: RED_HAWK is a all in one tool for Information Gathering, Vulnerability Scanning and Crawling. A must have tool for all pentesters and hackers.

RED_HAWK's features:

Basic ScanSite Title (NEW):
IP Address
Web Server Detection IMPROVED
CMS Detection
Cloudflare Detection
robots.txt Scanner

Whois Lookup (IMPROVED)

Geo-IP Lookup

Grab Banners IMPROVED

DNS Lookup

Subnet Calculator

Nmap Port Scan

Sub-Domain Scanner IMPROVED:
Sub Domain
IP Address

Reverse IP Lookup and CMS Detection IMPROVED:
Hostname
IP Address
CMS

Error Based SQLi Scanner

Bloggers View NEW
HTTP Response Code
Site Title
Alexa Ranking
Domain Authority
Page Authority
Social Links Extractor
Link Grabber

WordPress Scan NEW
Sensitive Files Crawling
Version Detection
Version Vulnerability Scanner

Crawler

MX Lookup NEW

Scan For Everything - The Old Lame Scanner

List of CMS Supported on RED_HAWK

RED_HAWK's CMS Detector currently is able to detect the following CMSs (Content Management Systems) in case the website is using some other CMS, Detector will return could not detect.

WordPress

Joomla

Drupal

Magento

RED_HAWK Installation
How To Configure RED HAWK with moz.com for Bloggers View Scan?

Create an account in moz follow this link: Register New Community Account - Moz
After successful account creation and completing the verification you need to generate the API Keys.
You can get your API Keys here: https://moz.com/products/mozscape/access.
Get your AccessID and SecretKey and replace the $accessID and $secretKey variable's value in the config.php file

All set, now you can enjoy the bloggers view.

How to use RED_HAWK?

Known Issues of RED_HAWK
ISSUE: Scanner Stops Working After Cloudflare Detection!
SOLUTION: Use the fix command (for Debian-based distros) or manually install php-curl and php-xml.

Watch the video to see how to solve that isuue:

Support and Donations
Found RED_HAWK cool? Well you could buy a cup of tea for the author 😉 Just send any amount of donations (in Bitcoin) to this address: 1NbiQidWWVVhWknsfPSN1MuksF8cbXWCku

Can't donate? well that's no problem just drop a "THANK YOU, AUTHOR" this will motivate me to create more exciting stuffs for you 😉

TODOs for RED_HAWK:

Make a proper update option ( Installs current version automatically )
Add more CMS to the detector
Improve The WordPress Scanner ( Add User, Theme & Plugins Enumeration )
Create a web version of the scanner
Add XSS & LFI Scanner
Improve the Links grabber thingy under bloggers view
Add some other scans under the Bloggers View

Download RED_HAWK

SGIA Eagles' Nest

Sunday, August 30, 2020

Webkiller Tool | Information Gathering | Github

New Printers Vulnerable To Old Languages

35 year old bugs features

Now exploitable from the web

Conclusion: Christian Slater is right

Saturday, August 29, 2020

PortWitness - Tool For Checking Whether A Domain Or Its Multiple Sub-Domains Are Up And Running

Related links

RED_HAWK: An Information Gathering, Vulnerability Scanning And Crawling Tool For Hackers

Related links

SGIA's Website

Eagles' Nest Blog Links

Favourites

Pierre's Ikeepbookmarks

Recommended Search Engines

Blog Archive

Rate this blog!