HP LaserJet Printer SNMP Enumeration - Metasploit

This page contains detailed information about how to use the auxiliary/scanner/snmp/snmp_enum_hp_laserjet metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.

Module Overview

---

Name: HP LaserJet Printer SNMP Enumeration
Module: auxiliary/scanner/snmp/snmp_enum_hp_laserjet
Source code: modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb
Disclosure date: -
Last modification time: 2017-08-26 21:01:10 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 161
List of CVEs: -

This module allows enumeration of files previously printed. It provides details as filename, client, timestamp and username information. The default community used is "public".

Module Ranking and Traits

---

Module Ranking:

• normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.

Basic Usage

---

This module is a scanner module, and is capable of testing against multiple hosts.

msf > use auxiliary/scanner/snmp/snmp_enum_hp_laserjet
msf auxiliary(snmp_enum_hp_laserjet) > show options
    ... show and set options ...
msf auxiliary(snmp_enum_hp_laserjet) > set RHOSTS ip-range
msf auxiliary(snmp_enum_hp_laserjet) > exploit

Other examples of setting the RHOSTS option:

Example 1:

msf auxiliary(snmp_enum_hp_laserjet) > set RHOSTS 192.168.1.3-192.168.1.200 

Example 2:

msf auxiliary(snmp_enum_hp_laserjet) > set RHOSTS 192.168.1.1/24

Example 3:

msf auxiliary(snmp_enum_hp_laserjet) > set RHOSTS file:/tmp/ip_list.txt

Required Options

---

• RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'

Go back to menu.

Msfconsole Usage

---

Here is how the scanner/snmp/snmp_enum_hp_laserjet auxiliary module looks in the msfconsole:

msf6 > use auxiliary/scanner/snmp/snmp_enum_hp_laserjet

msf6 auxiliary(scanner/snmp/snmp_enum_hp_laserjet) > show info

       Name: HP LaserJet Printer SNMP Enumeration
     Module: auxiliary/scanner/snmp/snmp_enum_hp_laserjet
    License: Metasploit Framework License (BSD)
       Rank: Normal

Provided by:
  Matteo Cantoni <[email protected]>

Check supported:
  No

Basic options:
  Name       Current Setting  Required  Description
  ----       ---------------  --------  -----------
  COMMUNITY  public           yes       SNMP Community String
  RETRIES    1                yes       SNMP Retries
  RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
  RPORT      161              yes       The target port (UDP)
  THREADS    1                yes       The number of concurrent threads (max one per host)
  TIMEOUT    1                yes       SNMP Timeout
  VERSION    1                yes       SNMP Version <1/2c>

Description:
  This module allows enumeration of files previously printed. It 
  provides details as filename, client, timestamp and username 
  information. The default community used is "public".

References:
  http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
  http://net-snmp.sourceforge.net/docs/man/snmpwalk.html
  http://www.nothink.org/perl/snmpcheck/
  http://www.securiteam.com/securitynews/5AP0S2KGVS.html
  http://stuff.mit.edu/afs/athena/dept/cron/tools/share/mibs/290923.mib

Module Options

---

This is a complete list of options available in the scanner/snmp/snmp_enum_hp_laserjet auxiliary module:

msf6 auxiliary(scanner/snmp/snmp_enum_hp_laserjet) > show options

Module options (auxiliary/scanner/snmp/snmp_enum_hp_laserjet):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   COMMUNITY  public           yes       SNMP Community String
   RETRIES    1                yes       SNMP Retries
   RHOSTS                      yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
   RPORT      161              yes       The target port (UDP)
   THREADS    1                yes       The number of concurrent threads (max one per host)
   TIMEOUT    1                yes       SNMP Timeout
   VERSION    1                yes       SNMP Version <1/2c>

Advanced Options

---

Here is a complete list of advanced options supported by the scanner/snmp/snmp_enum_hp_laserjet auxiliary module:

msf6 auxiliary(scanner/snmp/snmp_enum_hp_laserjet) > show advanced

Module advanced options (auxiliary/scanner/snmp/snmp_enum_hp_laserjet):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   CHOST                                 no        The local client address
   CPORT                                 no        The local client port
   ShowProgress         true             yes       Display progress messages during a scan
   ShowProgressPercent  10               yes       The interval in percent that progress should be shown
   VERBOSE              false            no        Enable detailed status messages
   WORKSPACE                             no        Specify the workspace for this module

Auxiliary Actions

---

This is a list of all auxiliary actions that the scanner/snmp/snmp_enum_hp_laserjet module can do:

msf6 auxiliary(scanner/snmp/snmp_enum_hp_laserjet) > show actions

Auxiliary actions:

   Name  Description
   ----  -----------

Evasion Options

---

Here is the full list of possible evasion options supported by the scanner/snmp/snmp_enum_hp_laserjet auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):

msf6 auxiliary(scanner/snmp/snmp_enum_hp_laserjet) > show evasion

Module evasion options:

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------

Go back to menu.

Error Messages

---

This module may fail with the following error messages:

Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.

<IP>, SNMP request timeout.

---

Here is a relevant code snippet related to the "<IP>, SNMP request timeout." error message:

131:	      end
132:	
133:	      disconnect_snmp
134:	
135:	    rescue SNMP::RequestTimeout
136:	      print_error("#{ip}, SNMP request timeout.")
137:	    rescue Errno::ECONNREFUSED
138:	      print_error("#{ip}, Connection refused.")
139:	    rescue SNMP::InvalidIpAddress
140:	      print_error("#{ip}, Invalid IP Address. Check it with 'snmpwalk tool'.")
141:	    rescue ::Interrupt

<IP>, Connection refused.

---

Here is a relevant code snippet related to the "<IP>, Connection refused." error message:

133:	      disconnect_snmp
134:	
135:	    rescue SNMP::RequestTimeout
136:	      print_error("#{ip}, SNMP request timeout.")
137:	    rescue Errno::ECONNREFUSED
138:	      print_error("#{ip}, Connection refused.")
139:	    rescue SNMP::InvalidIpAddress
140:	      print_error("#{ip}, Invalid IP Address. Check it with 'snmpwalk tool'.")
141:	    rescue ::Interrupt
142:	    raise $!
143:	    rescue ::Exception => e

<IP>, Invalid IP Address. Check it with 'snmpwalk tool'.

---

Here is a relevant code snippet related to the "<IP>, Invalid IP Address. Check it with 'snmpwalk tool'." error message:

135:	    rescue SNMP::RequestTimeout
136:	      print_error("#{ip}, SNMP request timeout.")
137:	    rescue Errno::ECONNREFUSED
138:	      print_error("#{ip}, Connection refused.")
139:	    rescue SNMP::InvalidIpAddress
140:	      print_error("#{ip}, Invalid IP Address. Check it with 'snmpwalk tool'.")
141:	    rescue ::Interrupt
142:	    raise $!
143:	    rescue ::Exception => e
144:	      print_error("#{ip}, Unknown error: #{e.class} #{e}")
145:	    end

<IP>, Unknown error: <E.CLASS> <E>

---

Here is a relevant code snippet related to the "<IP>, Unknown error: <E.CLASS> <E>" error message:

137:	    rescue Errno::ECONNREFUSED
138:	      print_error("#{ip}, Connection refused.")
139:	    rescue SNMP::InvalidIpAddress
140:	      print_error("#{ip}, Invalid IP Address. Check it with 'snmpwalk tool'.")
141:	    rescue ::Interrupt
142:	    raise $!
143:	    rescue ::Exception => e
144:	      print_error("#{ip}, Unknown error: #{e.class} #{e}")
145:	    end
146:	  end
147:	end

Go back to menu.

Related Pull Requests

---

• #8888 Merged Pull Request: spelling/grammar fixes part 1
• #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
• #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
• #6655 Merged Pull Request: use MetasploitModule as a class name
• #6648 Merged Pull Request: Change metasploit class names
• #3399 Merged Pull Request: Rewire some snmp modules to use print_error instead of print_status.
• #3159 Merged Pull Request: Auxiliary module to HP LaserJet Printer SNMP Enumeration (redux)

References

---

• CVE: Not available
• http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
• http://net-snmp.sourceforge.net/docs/man/snmpwalk.html
• http://www.nothink.org/perl/snmpcheck/
• http://www.securiteam.com/securitynews/5AP0S2KGVS.html
• http://stuff.mit.edu/afs/athena/dept/cron/tools/share/mibs/290923.mib

See Also

---

Check also the following modules related to this module:

• auxiliary/scanner/snmp/snmp_enum
• auxiliary/scanner/snmp/snmp_enumshares
• auxiliary/scanner/snmp/snmp_enumusers
• auxiliary/scanner/snmp/snmp_login
• auxiliary/scanner/snmp/snmp_set
• auxiliary/scanner/snmp/aix_version
• auxiliary/scanner/snmp/arris_dg950
• auxiliary/scanner/snmp/brocade_enumhash
• auxiliary/scanner/snmp/cisco_config_tftp
• auxiliary/scanner/snmp/cisco_upload_file
• auxiliary/scanner/snmp/cnpilot_r_snmp_loot
• auxiliary/scanner/snmp/epmp1000_snmp_loot
• auxiliary/scanner/snmp/netopia_enum
• auxiliary/scanner/snmp/sbg6580_enum
• auxiliary/scanner/snmp/ubee_ddw3611
• auxiliary/scanner/snmp/xerox_workcentre_enumusers
• exploit/linux/snmp/awind_snmp_exec
• exploit/linux/snmp/net_snmpd_rw_access
• exploit/linux/http/nagios_xi_snmptrap_authenticated_rce
• exploit/windows/http/hp_nnm_ovwebsnmpsrv_main
• exploit/windows/http/hp_nnm_ovwebsnmpsrv_ovutil
• exploit/windows/http/hp_nnm_ovwebsnmpsrv_uro
• exploit/windows/http/hp_nnm_snmp
• exploit/windows/http/hp_nnm_snmpviewer_actapp
• post/windows/gather/enum_snmp
• auxiliary/admin/hp/hp_data_protector_cmd
• auxiliary/admin/hp/hp_ilo_create_admin_account
• auxiliary/admin/hp/hp_imc_som_create_account
• auxiliary/dos/hp/data_protector_rds

Authors

---

Matteo Cantoni <goony[at]nothink.org>

Version

---

This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.

Go back to menu.