search

RUB-NDS / PRET

Printer Exploitation Toolkit - The tool that made dumpster diving obsolete.
http://hacking-printers.net
GNU General Public License v2.0
3.81k stars 605 forks source link

Overlay or Cross "No data received" #5

Open superteece opened 7 years ago

superteece commented 7 years ago

Is the message "No data received" indicating that the attempt has failed? Nothing is printed on the subsequent jobs except for what is on the printed document.

jensvoid commented 7 years ago

No, the message just means that no data was returned by the printer, which is absolutely correct behavior in case of the "overlay" command. (However, we should definitely use more meaningful messages in future releases).

There are two potentials reasons, the attack did not work:

  1. The printer is not vulnerable because the exitserver/startjob operators as described in the PostScript standard are not supported by the device to access subsequent jobs (e.g. Brother printers and some older Xerox printers). You can easily test this by permanently defining "foo":

    printer:/> site true 0 startjob /foo true def printer:/> site userdict /foo known == true

    If the printer responds with "false" instead, attacks like "overlay" or "capture" will not work.

  2. Subsequent jobs have not been printed using PostScript as a printer driver. This is important, because PostScript-based attacks like "overlay" can only affect PostScript-based documents (and not PCL, for example). You can easily test this:

    printer:/> overlay overlays/smiley.eps printer:/> print testpages/lorem.ps

    If you can see the smiley on this test printout, but not on your own print jobs, you are not using PostScript as a printer driver. The attack however will/can only work on PostScript-based documents.