search

RUB-NDS / PRET

Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.
http://hacking-printers.net
GNU General Public License v2.0
3.89k stars 606 forks source link

PJL ls directory traversal outputting wrong data #25

Closed D4stiny closed 5 years ago

D4stiny commented 5 years ago

Hello there, I connected to a vulnerable printer at port 9100 using the PJL protocol and was confused by the fact that ls changed its output for the same directory. For example, I'd do "ls /", and get the right output. Then I do ls /somefolder and get the contents for /. Then I do ls /somefolder/someotherfolder and I get the contents for /somefolder.

I thought maybe the previous directory could have just been the / folder, so I investigated in wireshark. Filtering for port TCP 9100, I followed the TCP stream.

When I did "ls /somefolder", the client sent out the right packet:

.%-12345X@PJL FSDIRLIST NAME="0:/somefolder" ENTRY=1 COUNT=65535
@PJL ECHO DELIMITER27053

.%-12345X

and the server responded properly with the contents of /somefolder:

@PJL ECHO DELIMITER27053
.@PJL FSDIRLIST NAME="0:/somefolder" ENTRY=1
data TYPE=DIR
tmp_files TYPE=DIR
. TYPE=DIR
internal TYPE=DIR
.. TYPE=DIR
fonts TYPE=DIR

however, this is what the client showed:

x.x.x.x:/> ls /somefolder
d        -   BCEFontfiles
d        -   BCEtransfiles
...

even though that is the contents of the / folder. Next when I did ls /somefolder/data (using the output in wireshark):

.%-12345X@PJL FSDIRLIST NAME="0:/somefolder/data" ENTRY=1 COUNT=65535
@PJL ECHO DELIMITER38628

.%-12345X

and again, correct response:

@PJL ECHO DELIMITER38628
.@PJL FSDIRLIST NAME="0:/somefolder/data" ENTRY=1
. TYPE=DIR
.. TYPE=DIR
.

this is the output:

x.x.x.x:/> ls /somefolder/data
d        -   data
d        -   fonts
d        -   internal
d        -   tmp_files

Hopefully you can see the problem.

D4stiny commented 5 years ago

I have determined a partial issue that may or may not be related to the error. Let's say I'm retrieving the "/" folder. This is the packet sent:

.%-12345X@PJL FSDIRLIST NAME="0:/" ENTRY=1 COUNT=65535
@PJL ECHO DELIMITER15397

.%-12345X

However, this is the packet response:

@PJL ECHO DELIMITER15397
.@PJL FSDIRLIST NAME="0:/" ENTRY=1
...

The issue is that the delimiter is being placed on the top of the response, cutting off everything after it.

killzhack commented 5 years ago

why i cant install $pip colorama pysnmp

D4stiny commented 5 years ago

Closing because no response and to prevent spam