Credentials Disclosure / Brute-Force
Last updated
Was this helpful?
Last updated
Was this helpful?
Printers are commonly deployed with a default password or no initial password at all. In both cases, end-users or administrators have to actively set a password to secure the device.
Ancient HP printers had a vulnerable OID that returned the password. Other vendors may have similar SNMP based issues.
If the printer is authorising people using an external LDAP. If you have access to the change this settings (maybe using a web console interface) you can make the printer connects to your LDAP server and authorise any user. Note that you could abuse this settings also to steal the credentials the printer is using to connect to the LDAP server. .
PJL passwords however are vulnerable to brute-force attacks because of their limited 16 bit key size. Noways in less than 30min you can guess the correct password.
You can use lock and unlock commands of to test bruteforce:
PostScript offers two types of passwords: The SystemParamsPassword is used to change print job settings like paper size, while the StartJobPassword is required to exit the server loop and therefore permanently alter the PostScript environment.
Brute-force attacks against PostScript passwords can be performed extremely fast because the PostScript interpreter can be programmed to literally crack itself:
Another approach is to bypass PostScript passwords by resetting them with Adobe's proprietary superexec operator. This operator resides in the internaldict dictionary, which is ‘protected’ by a static, magic password (1183615869). Wrapping PostScript code into superexec allows an attacker to ignore various protection mechanisms of the language, which would normally raise an invalidaccess error. This can be used to set PostScript passwords without initially submitting the current password as shown below:
The lock and unlock commands of can be used to test brute-force attacks against numeric (integer) PostScript passwords or to bypass them with superexec magic:
More information about Password Disclosure and Brute-Force in ****