Printer File Upload Scanner - Metasploit

This page contains detailed information about how to use the auxiliary/scanner/printer/printer_upload_file metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

---

Name: Printer File Upload Scanner
Module: auxiliary/scanner/printer/printer_upload_file
Source code: modules/auxiliary/scanner/printer/printer_upload_file.rb
Disclosure date: -
Last modification time: 2017-07-24 06:26:21 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 9100
List of CVEs: -

This module uploads a file to a set of printers using the Printer Job Language (PJL) protocol.

Module Ranking and Traits

---

Module Ranking:

• normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

---

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/printer/printer_upload_file
msf auxiliary(printer_upload_file) > show options
    ... show and set options ...
msf auxiliary(printer_upload_file) > set RHOSTS ip-range
msf auxiliary(printer_upload_file) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(printer_upload_file) > set RHOSTS 192.168.1.3-192.168.1.200 

Example 2:

msf auxiliary(printer_upload_file) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(printer_upload_file) > set RHOSTS file:/tmp/ip_list.txt

Required Options

---

• RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage

---

Here is how the scanner/printer/printer_upload_file auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/printer/printer_upload_file

msf6 auxiliary(scanner/printer/printer_upload_file) > show info

       Name: Printer File Upload Scanner
     Module: auxiliary/scanner/printer/printer_upload_file
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  wvu <[email protected]>
  sinn3r <[email protected]>
  MC <[email protected]>
  Myo Soe
  Matteo Cantoni <[email protected]>

Check supported:
  No

Basic options:
  Name     Current Setting                                              Required  Description
  ----     ---------------                                              --------  -----------
  LPATH    /opt/metasploit-framework/embedded/framework/data/eicar.com  yes       Local path
  RHOSTS                                                                yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPATH    0:\..\..\..\eicar.com                                        yes       Remote path
  RPORT    9100                                                         yes       The target port (TCP)
  THREADS  1                                                            yes       The number of concurrent threads (max one per host)

Description:
  This module uploads a file to a set of printers using the Printer 
  Job Language (PJL) protocol.

References:
  https://en.wikipedia.org/wiki/Printer_Job_Language

Module Options

---

This is a complete list of options available in the scanner/printer/printer_upload_file auxiliary module:

msf6 auxiliary(scanner/printer/printer_upload_file) > show options

Module options (auxiliary/scanner/printer/printer_upload_file):

   Name     Current Setting                                              Required  Description
   ----     ---------------                                              --------  -----------
   LPATH    /opt/metasploit-framework/embedded/framework/data/eicar.com  yes       Local path
   RHOSTS                                                                yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPATH    0:\..\..\..\eicar.com                                        yes       Remote path
   RPORT    9100                                                         yes       The target port (TCP)
   THREADS  1                                                            yes       The number of concurrent threads (max one per host)

Advanced Options

---

Here is a complete list of advanced options supported by the scanner/printer/printer_upload_file auxiliary module:

msf6 auxiliary(scanner/printer/printer_upload_file) > show advanced

Module advanced options (auxiliary/scanner/printer/printer_upload_file):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ConnectTimeout       10               yes       Maximum number of seconds to establish a TCP connection
   Proxies                               no        A proxy chain of format type:host:port[,type:host:port][...]
   SSL                  false            no        Negotiate SSL/TLS for outgoing connections
   SSLCipher                             no        String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"
   SSLVerifyMode        PEER             no        SSL verification method (Accepted: CLIENT_ONCE, FAIL_IF_NO_PEER_CERT, NONE, PEER)
   SSLVersion           Auto             yes       Specify the version of SSL/TLS to be used (Auto, TLS and SSL23 are auto-negotiate) (Accepted: Auto, TLS, SSL23, SSL3, TLS1, TLS1.1, TLS1.2)
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              false            no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

---

This is a list of all auxiliary actions that the scanner/printer/printer_upload_file module can do:

msf6 auxiliary(scanner/printer/printer_upload_file) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

---

Here is the full list of possible evasion options supported by the scanner/printer/printer_upload_file auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/printer/printer_upload_file) > show evasion

Module evasion options:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   TCP::max_send_size  0                no        Maxiumum tcp segment size.  (0 = disable)
   TCP::send_delay     0                no        Delays inserted before every send.  (0 = disable)

Go back to menu.

Related Pull Requests

---

• #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
• #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
• #6655 Merged Pull Request: use MetasploitModule as a class name
• #6648 Merged Pull Request: Change metasploit class names
• #4844 Merged Pull Request: Add file query/upload/deletion support to Rex::Proto::PJL

References

---

• CVE: Not available
• https://en.wikipedia.org/wiki/Printer_Job_Language

See Also

---

Check also the following modules related to this module:

• auxiliary/dos/http/canon_wireless_printer
• auxiliary/scanner/printer/canon_iradv_pwd_extract
• auxiliary/scanner/printer/printer_delete_file
• auxiliary/scanner/printer/printer_download_file
• auxiliary/scanner/printer/printer_env_vars
• auxiliary/scanner/printer/printer_list_dir
• auxiliary/scanner/printer/printer_list_volumes
• auxiliary/scanner/printer/printer_version_info
• exploit/irix/lpd/tagprinter_exec
• exploit/windows/browser/hp_easy_printer_care_xmlcachemgr
• exploit/windows/browser/hp_easy_printer_care_xmlsimpleaccessor
• exploit/windows/iis/ms01_023_printer
• exploit/windows/local/cve_2020_1048_printerdemon
• exploit/windows/local/cve_2020_1337_printerdemon
• exploit/linux/http/netgear_readynas_exec
• exploit/windows/browser/mozilla_firefox_onreadystatechange
• exploit/windows/ftp/winaxe_server_ready
• auxiliary/client/telegram/send_message
• auxiliary/scanner/http/openmind_messageos_login
• exploit/linux/local/exim4_deliver_message_priv_esc
• exploit/windows/brightstor/message_engine
• exploit/windows/brightstor/message_engine_72
• exploit/windows/brightstor/message_engine_heap
• payload/windows/messagebox
• payload/windows/x64/messagebox
• post/osx/gather/enum_messages
• auxiliary/scanner/printer/printer_ready_message
• auxiliary/scanner/redis/file_upload
• auxiliary/scanner/snmp/cisco_upload_file
• auxiliary/admin/oracle/post_exploitation/win32upload
• auxiliary/admin/smb/upload_file
• auxiliary/dos/http/apache_commons_fileupload_dos

Authors

---

• wvu
• sinn3r
• MC
• Myo Soe
• Matteo Cantoni <goony[at]nothink.org>

Version

---

This page has been produced using Metasploit Framework version 6.1.27-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.