Jump to content
Sign in to follow this  
Gecko

"Hacking" printers worldwide via Shodan

Recommended Posts

Mi se pare destul de ingenios doar faptul ca s-a gandit la asta.

 

---

 

Here is how the entire #pewdiepie printer hack went down:

I was bored after playing Destiny 2 for a continous 4 hours, and decided I wanted to hack something. So I thought of any vulnerable protocols I could find on shodan

 

While playing around on Shodan, the idea came to me that maybe I can hack printers around the world to print something, I didn't know what at the time. After learning about the three different printing protocols (IPP, LPD, JetDirect), I went and searched those ports on shodan.

 

I was horrified to see over 800,000 results show up in total. I was baffled, but determined to try and fix this. So I picked the first 50,000 printers I found running on port 9100 and downloaded the list off shodan.

 

Now I had to think...What to print? It didn't take me long to realize that the most perfect thing to print would be a message supporting our dear overlord @pewdiepie himself! And so I opened up my text editor and typed up the following note: https://pastebin.com/raw/ASuKK3qL

 

Now: I needed a tool that lets me connect to printers on this port and print...a google search and I stumbled across PRET (https://github.com/RUB-NDS/PRET ) that fulfilled all my hopes and dreams...but also my nightmares.

 

PRET had the scariest of features. Ability to access files, damage the printer, access the internal network...things that could really cause damage. So I had to do this, to at least help organizations and people that can protect themselves.

 

I typed up the following bash script which ironically can fit in a tweet:

#!/bin/bash
while read -r line; do
    ip="$line"
    torify ./PRET/pret.py $ip pjl -q -i ./commands.txt
done < "./potential_bros.txt"

 

Now what this script does, is simply take my input (potential_bros.txt) and loop through every line, running PRET against that IP with the commands in commands.txt

 

Commands.txt contains the following:

print ./message.pdf
display HACKED
quit

That's literally it.

 

Uploaded the script onto my server, opened a tmux session, ran the script in there and left it running. Came back to check Thursday night and just seeing the first person to be hacked by this made my entire week.

 

 

 

 

Sursa, tweet + comments.

 

 

  • Like 1
  • Thanks 2
  • Upvote 4

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...