CVE-2024-47176-Scanner - A simple scanner for identifying vulnerable cups-b

项目说明

Quick Start

Example usage: python3 cups_scanner.py --targets 10.0.0.0/24 --callback 10.0.0.1:1337

C Scanner (cups-browsed)

What is CUPS And Why Does It Matter?

CUPS (Common Unix Printing System) is an open-source framework for managing and controlling printers on UNIX and UNIX-like systems.
It is one of the most used widely-used libraries for printing and is supported by UNIX, Linux, and some Apple devices.

Several critical were found in CUPS, which when chained together, can lead to remote code execution.
The CVEs in question are C, C, C, C.

The allow a remote attacker to add or re-configure network printers in such a way that they will execute arbitrary code when users try to print from them.

Scanning for CUPS Systems

A Quick O of C

The first in the chain, C, is a flaw in the cups-browsed daemon.

The arises from the fact that cups-browsed binds its control port (UDP port 631) to INADDR_ANY, exposing it to the world.
Since requests are not authenticated, anyone capable of reaching the control port can instruct cups-browsed to perform printer discovered.

In cases when the port is not reachable from the internet (due to firewalls or NAT), it may still be reachable via the local network, enabling pri escalation and lateral mo.
For this reason, I' this scanner designed to scan your local network for cups-browsed instances.

How C Scanning Works

Typically, an attacker would begin the exploitation process by sending a specially crafted request to cups-browsed on UDP port 631, causing it to reach out to a malicious URL under their control.

For example, a UDP packet containing the following: 0 3 would trigger cups-browsed to issue a HTTP request to .

If the URL were to present as a malicious printer, it could chain the rest of the CVEs in order to gain remote code execution.

Using this mechanism, we can trigger a cups-browsed instance to issue a HTTP request (callback) to our own server, identifying itself as .

The scanning process is as follows:
1. Set up a basic HTTP server (no need to identify as a printer, since we will not be exploiting the RCE ).
2. Craft a UDP packet which will instruct cups-browsed to connect to our HTTP server.
3. Send the UDP packet to every IP in a gi on port 631.
4. Log any POST requests to the /printers/ endpoint, which are triggered by cups-browsed instances.

Assuming our HTTP server is hosted on 10.0.0.1:1337, our UDP packet should look like this: 0 3

Automating Scans with cups_scanner.py

This python scanner handles e for you (both the HTTP server and scanning).

The script launches a temporary HTTP server via http.server on a specified ip and port, then constructs and sends UDP packets to the every IP in the specified range.
The HTTP server will automatically capture callbacks from cups-browsed instances and log them to disk.

User friendly logs are written logs/cups.log and raw HTTP requests are written to logs/requests.log

command line arguments

--target
the CIDR(s) to scan. Can be a single CIDR or multiple CIDRs separated by commas.
--callback the local ip and port to host our HTTP server on (must be reachable via the target range)
--scan-unsafe by default we only scan assignable host addresses (we exclude the network address and broadcast address)
in some cases it may be desirable to scan these addresses, so this behavior can be o with the --scan-unsafe flag.

Example Usage

Scanning CIDR 10.0.0.0/24 from ip address 10.0.0.1, hosting the callback server on 1337:
python3 cups_scanner.py --targets 10.0.0.0/24 --callback 10.0.0.1:1337

Scanning multiple CIDRs from ip address 10.0.0.1, hosting the callback server on 1337:
python3 cups_scanner.py --targets 10.0.0.0/24,10.0.1.0/24 --callback 10.0.0.1:1337

note: the callback server IP must belong to the scanning host, and the port must be reachable from every target IPs.

Example Output

for more info see: Official CUPS Write Up

项目信息

开发语言：Python

Star 数：67

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A simple scanner for identifying vulnerable cups-browsed instances on your network展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。