PRET - Printer Exploitation Toolkit - The tool that made

项目说明

PRET - Printer Exploitation Toolkit

Is your printer secure? Check before someone else does...

PRET is a new 工具 for printer security testing de in the scope of a Master's Thesis at Ruhr Uni Bochum. It connects to a device or USB and exploits the features of a gi language. Currently PostScript, PJL and PCL are supported which are spoken by most laser printers. This allows cool stuff like capturing or manipulating print jobs, accessing the printer's file system and memory or e physical damage to the device. All attacks are documented in detail in the Hacking Printers Wiki.

The main idea of PRET is to facilitate the communication between the end-user and the printer. Thus, after entering a UNIX-like command, PRET translates it to PostScript, PJL or PCL, sends it to the printer, e the result and translates it back to a user-friendly format. PRET offers a whole bunch of commands useful for printer attacks and fuzzing.

!PRET design

Installation

PRET only requires a Python2 interpreter. For colored output and SNMP support however, third party modules need to be installed:

# pip install colorama pysnmp

If running on a Windows console and Unicode characters are not displayed correctly, install the *win_unicode_console* module:

# pip install win_unicode_console

For experimental, ‘dri’ printing (see print command), ImageMagick and GhostScript need to be installed:

# apt-get install imagemagick ghostscript

Usage

###### Example usage:

$ ./pret.py laserjet.lan ps
$ ./pret.py /dev/usb/lp0 pjl

###### Positional Arguments:

PRET requires a valid target and a printer language as arguments. The target can either be the IP address/hostname of a 网络 printer (with port 9100/tcp open) or a device like /dev/usb/lp0 for a local USB printer. To quickly discover all 网络 printers in your subnet using SNMP broadcast, simply run PRET without arguments:

The printer language to be abused must be one of ps, pjl or pcl. Not all languages are supported by every printer, so you may want to switch languages if you don't receive any feedback. Each printer language is mapped to a different set of PRET commands and has different capabilities to exploit.

###### Optional Arguments:

--safe tries to check via IPP, HTTP and SNMP if the selected printing language (PS/PJL/PCL) is actually supported by the device before connecting. On non-networked printers (USB, parallel cable) this test will fail.

--quit suppresses printer model determination, intro message and some other chit-chat.

--debug shows the datastream actually sent to the device and the feedback received. Note that header data and other o is filtered. The see the whole traffic, use wireshark. Debugging can also be switched on/off within a PRET session using the debug command

--load filename reads and executes PRET commands from a text file. This is useful for automation. Command files can also be invoked later within a PRET session via the load command.

--log filename writes a copy of the raw datastream sent to the printer into a file. This can be useful to build a malicious print job file which can be deployed on another printer not directly reachable, for example by printing it from USB drive.

Generic Commands

After connecting to a printer device, you will see the PRET shell and can execute commands:

A list of generic PRET commands is gi:

Generic file system operations with a PS/PJL/PCL specific implementation are:

Commands in PS mode

Not all commands are supported by every printer. Especially Brother and Kyocera devices use their own PostScript clones – Br-Script and KPDL – instead of licensing original ‘Adobe PostScript’. Such flavours of the PostScript language may not be 100% compatible, especially concerning security sensiti like capturing print jobs. Access to the file system is supported by most printers, howe limited to a certain, sandboxed directory.

Commands in PJL mode

Some commands are supported exclusively by HP printers, because other have only implemented a subset of the PJL standard. This is especially true for PML based commands like restartor reset. Enabling long-term job retention via the hold command seems to be possible for some Epson devices only. NVRAM access via the nvram command is a proprietary feature of Brother printers. Limited access to the file system is supported by HP, OKI, Konica, Xerox, Epson and Ricoh devices.

Commands in PCL mode

PCL is a very limited page description language without access to the file system. The get/put/ls commands therefore use a file system based on PCL macros, implemented mostly for the hack value. This proof-of-concept shows that even a device which supports only minimalist languages like PCL can be used to store arbitrary files like copyright infringing material. Although such a file sharing service is not a security per se, it might apply as ‘misuse of service’ depending on the corporate policy

File Listing

Getting Started

Given the features and proprietary extensions in printing languages like PostScript and PJL, conducting a pentest on printers is not a trivial job. PRET can help to assist and known issues in the language. Once you ha around with the 工具, you may want to perform a systematic printer security analysis. A good starting point is the Printer Security Testing Cheat Sheet.

Happy Hacking!

项目信息

开发语言：Python

Star 数：4311

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Printer Exploitation Toolkit - The 工具 that made dumpster diving obsolete.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。