HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
9100 - Pentesting Raw Printing (JetDirect, AppSocket, PDL-datastream)
Support HackTricks and get benefits!

Basic Information

Raw printing is what we define as the process of making a connection to port 9100/tcp of a network printer. It is the default method used by CUPS and the Windows printing architecture to communicate with network printers as it is considered as โ€˜the simplest, fastest, and generally the most reliable network protocol used for printersโ€™. Raw port 9100 printing, also referred to as JetDirect, AppSocket or PDL-datastream actually is not a printing protocol by itself. Instead all data sent is directly processed by the printing device, just like a parallel connection over TCP. In contrast to LPD, IPP and SMB, this can send direct feedback to the client, including status and error messages. Such a bidirectional channel gives us direct access to results of PJL, PostScript or PCL commands. Therefore raw port 9100 printing โ€“ which is supported by almost any network printer โ€“ is used as the channel for security analysis with PRET and PFT. (From here)
If you want to learn more about hacking printers read this page.
Default port: 9100
9100/tcp open jetdirect

Enumeration

Manual

nc -vn <IP> 9100
@PJL INFO STATUS #CODE=40000 DISPLAY="Sleep" ONLINE=TRUE
@PJL INFO ID # ID (Brand an version): Brother HL-L2360D series:84U-F75:Ver.b.26
@PJL INFO PRODINFO #Product info
@PJL FSDIRLIST NAME="0:\" ENTRY=1 COUNT=65535 #List dir
@PJL INFO VARIABLES #Env variales
@PJL INFO FILESYS #?
@PJL INFO TIMEOUT #Timeout variables
@PJL RDYMSG #Ready message
@PJL FSINIT
@PJL FSDIRLIST
@PJL FSUPLOAD #Useful to upload a file
@PJL FSDOWNLOAD #Useful to download a file
@PJL FSDELETE #Useful to delete a file

Automatic

nmap -sV --script pjl-ready-message -p <PORT> <IP>
msf> use auxiliary/scanner/printer/printer_env_vars
msf> use auxiliary/scanner/printer/printer_list_dir
msf> use auxiliary/scanner/printer/printer_list_volumes
msf> use auxiliary/scanner/printer/printer_ready_message
msf> use auxiliary/scanner/printer/printer_version_info
msf> use auxiliary/scanner/printer/printer_download_file
msf> use auxiliary/scanner/printer/printer_upload_file
msf> use auxiliary/scanner/printer/printer_delete_file

Printers Hacking tool

This is the tool you want to use to abuse printers:
GitHub - RUB-NDS/PRET: Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.
GitHub

Hacking Printers best reference

File system access - Hacking Printers

Shodan

  • pjl port:9100
Support HackTricks and get benefits!