Fun with a JetDirect

Fun with a JetDirect

Well, I’ve been playing with JetDirect enabled printers and other a few Savins so I can make a video for the next Infonomicon TV. Here is what I have so far for what I want to show, starting from the simple to the arcane:

1. Intro to the concept.
2. Diagnostics page.
3. Finding Network printers using Nmap.
4. What an Nmap scan looks like (garbage print jobs)
5. Using an JetDirect box for an Nmap Zombie scan bounce.
6. Setting up a direct IP printer in Windows (I may skip this).
7. Controlling the JetDirect box with telnet/a web browser.
8. Jetadmin.
9. DoSing the printer.
10. Changing the LCD display text using HPhack, IGhphack and Hijetter.
11. Changing settings with Hijetter.
12. Using Hijetter to treat some JetDirect boxes as files/web servers.
13. Finding stored faxes and print jobs on the Jetdirect printers.


Other ideas? Many folks don't realize some of the stuff you can find out/do with a network printer, otherwise they would secure them more.

Just for sh*ts and giggles.. ping the (subnet) broadcast address and see how many printers respond ;) Probably don't have to tell you it's easy to spoof icmp :D

So I assume a network-printer is not secure within a network? Hmmm. Maybe Symantec will one day make a virusscanner for printers. :)

(Help, my printer is infected with AdWare!)

Would be interesting if you could add some additional text to be printed with every print command on every page. Or have every document sent to some location outside the company, as some kind of industrial espionage.

Well, I just recently found out how easy it is to sniff print jobs and collect them for later viewing with Ethereal.

Hey Iron, when is the next infonomicon due out? If you ever get bored, I bet a video tut on etheral alone would be very useful!

This perl script is fun..
http://www.phfactor.net/code/hpset/

Quote:

---

Requirements

1. A networked HP printer, HP4M+ or later, with JetDirect card. Tested on 4M+, 8150DN, and 8500 so far. The later machines appear to lack lower case characters, for some reason, and all of them have varying lengths of strings they can display.
2. A host able to connect to said printer and run Perl.

Usage

hpset -m my.printer.com 'Chode Rules'
hpset -m hp.marketing.example.com 'YOU ARE WEASELS'

Actually, the quotes are optional:

hpset -m hp2.example.edu Lunch wasn't Really Chicken

There's also a -p argument to set the port, but as far as I know they all use port 9100. To reset the message, either reset the printer or run hpset with the default message, usually 'READY'.

---

HPhack, IGhphack and Hijetter can do much the same thing.

http://www.irongeek.com/i.php?page=security/hphack

hmmm

I\m tempted to try this at work...

Quote:

---

Originally posted here by Irongeek
Well, I just recently found out how easy it is to sniff print jobs and collect them for later viewing with Ethereal.

---

Yep, the same goes for the insecure pop3 mail passwords... ethereal...

Sniffing the printer traffic means you have to be in the path somewhere. The 'normal' sniffing rules apply. What I found really, really troublesome is the fact that a lot of the modern printers (usually the ones with fax and scanning capabilities) store documents. Anyone with a browser can just connect to that printer and browse scanned/printed documents.

The TCP/IP stack on these printers is usually seriously flawed too. No way to configure certain aspects.. Like turning ICMP broadcast pings on/off.

That's one of the reasons I usually put all printers on a seperate network, firewall them and only allow the printserver access.

Quote:

---

Originally posted here by SirDice

That's one of the reasons I usually put all printers on a seperate network, firewall them and only allow the printserver access.

---

BLEEPING FUGGIN GOOD IDEA!!! I will add this to my list of things to do during maintenece down time. If I just VLAN them into their own VLAN world -- could I just do that if i don't want to bother with the hassle?

At my last job we did it using VLANs. Especially with big sites using dedicated switches is probably not going to work. You would need a lot more switches. Just define a printing VLAN and use an accesslist to regulate who can do what. We had to add 1 or 2 workstations so the guys 'n girls from facility management could monitor the printers for empty toners/papers etc.. Everybody else had to use the printserver.. Pretty simple setup but still effective :D

How about a quick "port scanner" that will scan for port 9100 (jet direct port) and send a print job to it. This could easily be done in perl. I have found example code for a perl based port scanner that can be easily modified to do the job.

I've played with it a bit and gotten it to work quite nice. Though, the code is rather beefy. If I'm not too tired when I get home from the gym I might slim it down. I accidentially spammed some printers with the string "You suck, you jackass!" Immediately afterwards... I started getting phone calls... ooops! At least I know it works... just hopefully they don't report it to mgt. ;) ROFL

One problem with scanning on port 9100 come up with Nmap and version detection. You get garbage print jobs with text like:

GET / HTTP/1.0
OPTIONS / HTTP/1.0
OPTIONS / RTSP/1.0


I've found that using the following works well:

I don't think that is the case with the new version of nmap 3.90.
Well, I've been unable to duplicate it...

Maybe its just my version of jetdirect?

nmap -O printerip -p 9100

or with

nmap printerip -p 9100

Seems that the printer will print whatever you throw at port 9100

http://printerip:9100 will print your browser info

Quote:

---

------ HP JetDirect Configuration ------
Status: I/O Card Ready
Model Number: J6057A
Hardware Address: 000Exxxxxxxx
Firmware Version: R.25.09

---

Even your example with 9100 added to the port list doesn't set it off...
Either will --allports

Hmmm

I'll have to test with the newest version of Nmap sometime. I'm using 3.81 (I think) right now. I contacted Fydor awhile back about JetDirect and version detect, maybe he wrote a work around.

Ok, here is the answer:

Quote:

---

Thanks for the information Fyodor. I should have RTFCL.

Adrian

-----Original Message-----
From: Fyodor [mailto:[email protected]]
Sent: Thu 9/8/2005 5:10 PM
To: Crenshaw, Adrian D
Cc: [email protected]
Subject: Re: Nmap 3.90 and JetDirects
On Thu, Sep 08, 2005 at 05:04:33PM -0500, Crenshaw, Adrian D wrote:
> I’m writing an article on hacking network printers and this topic came up. One problem with Nmap scanning port 9100 with version detection turned on is you get garbage print jobs with text like:
>
> GET / HTTP/1.0
> OPTIONS / HTTP/1.0
> OPTIONS / RTSP/1.0
>
> That corresponds to the probes Nmap is sending to try and tell what
> service is running on that port. Or at least you use to, a friend said
> he tested with 3.90 and that no longer happens, at least on his
> JetDirect. Was something changed with 3.90 to fix the JetDirect port
> 9100 problems?

Yes, by default Nmap no longer service scans 9100:

o Added "Exclude" directive to nmap-service-probes grammar which
causes version detection to skip listed ports. This is helpful for
ports such as 9100. Some printers simply print any data sent to
that port, leading to pages of HTTP requests, SMB queries, X Windows
probes, etc. If you really want to scan all ports, specify
--allports. This patch came from Doug Hoyte (doug(a)hcsw.org).

[ http://www.insecure.org/nmap/nmap_changelog.html ]

With such a big changelog for this release, you can be forgiven for
missing it :). I'm looking forward to your paper on hacking network
printers.

Cheers,
-F

---

Makes sense. I briefly glanced at the change log when I downloaded it. I noticed that they don't scan 9100 by default but not that it doesn't try version detection. I even tried to use -O to "force" version detection. Seems it still ignores that port. :)

Does this mean I can telnet to the printer ip and type stuff and it will print?
That's almost as easy as typing my doc in MS Word and clicking "print"
:cool:

Quote:

---

Originally posted here by rcgreen
Does this mean I can telnet to the printer ip and type stuff and it will print?
That's almost as easy as typing my doc in MS Word and clicking "print"
:cool:

---

Kind of sorta if you telnet to port 9100 on a JetDirect. By the way, I hope to have my article up Monday.

thanks for the tut. this was helpful and fun.

i used it to put my name and support call # info to display on the printer display so staff can call for support faster.

just shows you --some hacks can be used for a good thing.

;-)