Factory defaults - Revision history

Admin: /* PostScript */

2017-06-25T11:29:36Z

‎PostScript

Admin: /* PostScript */

2017-06-25T11:28:29Z

‎PostScript

Admin at 11:26, 25 June 2017

2017-06-25T11:26:18Z

Admin at 11:26, 25 June 2017

2017-06-25T11:26:03Z

Admin at 11:45, 21 January 2017

2017-01-21T11:45:04Z

Admin: /* PRESCRIBE */

2017-01-20T16:05:12Z

‎PRESCRIBE

Admin at 16:04, 20 January 2017

2017-01-20T16:04:37Z

92.227.58.56: /* PRESCRIBE */

2017-01-15T15:39:56Z

‎PRESCRIBE

Admin at 20:02, 14 January 2017

2017-01-14T20:02:41Z

Admin: /* PostScript */

2017-01-14T20:01:08Z

‎PostScript

@@ Line 40: / Line 40: @@
 == PostScript ==
-PostScript offers a similar feature: The ''FactoryDefaults'' system parameter, ‘a flag that, if set to true immediately before the printer is turned off, causes all nonvolatile parameters to revert to their factory default values at the next power-on’ <ref>''[https://www.adobe.com/products/postscript/pdfs/PLRM.pdf PostScript Language Reference Manual, 3rd Edition]'', Adobe Systems Inc., 1999, p. 751</ref>. Restarting the printer on the other hand can be accomplished by SNMP and PML as described above. It must be noted that PostScript itself also has the capability to restart its environment but it requires a [[Credential disclosure|valid password]]. The PostScript interpreter however can be put into an infinite loop as discussed in [[transmission channel]] which forces the user to manually restart the device and thus reset the PostScript password.
+PostScript offers a similar feature: The ''FactoryDefaults'' system parameter, ‘a flag that, if set to true immediately before the printer is turned off, causes all nonvolatile parameters to revert to their factory default values at the next power-on’ <ref>''[https://www.adobe.com/products/postscript/pdfs/PLRM.pdf PostScript Language Reference Manual, 3rd Edition]'', Adobe Systems Inc., 1999, p. 751</ref>. Restarting the printer on the other hand can be accomplished by SNMP and PML as described above. It must be noted that PostScript itself also has the capability to restart its environment but it requires a [[Credential disclosure|valid password]]. The PostScript interpreter however can be put into an infinite loop as discussed in [[document processing]] DoS attacks which forces the user to manually restart the device and thus reset the PostScript password.
 Reset PostScript system parameters to factory defaults:

@@ Line 40: / Line 40: @@
 == PostScript ==
-PostScript offers a similar feature: The ''FactoryDefaults'' system parameter, ‘a flag that, if set to true immediately before the printer is turned off, causes all nonvolatile parameters to revert to their factory default values at the next power-on’ <ref>''[https://www.adobe.com/products/postscript/pdfs/PLRM.pdf PostScript Language Reference Manual, 3rd Edition]'', Adobe Systems Inc., 1999, p. 751</ref>. Restarting the printer on the other hand can be accomplished by SNMP and PML as described above. It must be noted that PostScript itself also has the capability to restart its environment but it requires a [[Credential disclosure|valid password]]. The PostScript interpreter however can be put into an infinite loop as discussed in [[eval-transmission-channel]] which forces the user to manually restart the device and thus reset the PostScript password.
+PostScript offers a similar feature: The ''FactoryDefaults'' system parameter, ‘a flag that, if set to true immediately before the printer is turned off, causes all nonvolatile parameters to revert to their factory default values at the next power-on’ <ref>''[https://www.adobe.com/products/postscript/pdfs/PLRM.pdf PostScript Language Reference Manual, 3rd Edition]'', Adobe Systems Inc., 1999, p. 751</ref>. Restarting the printer on the other hand can be accomplished by SNMP and PML as described above. It must be noted that PostScript itself also has the capability to restart its environment but it requires a [[Credential disclosure|valid password]]. The PostScript interpreter however can be put into an infinite loop as discussed in [[transmission channel]] which forces the user to manually restart the device and thus reset the PostScript password.
 Reset PostScript system parameters to factory defaults:

@@ Line 3: / Line 3: @@
 == SNMP ==
-The Printer-MIB <ref>''[https://www.ietf.org/rfc/rfc3805.txt RFC3805: Printer MIB v2]'', R. Bergman, I. McDonald and H. Lewis, 2004</ref> defines the ''prtGeneralReset'' Object (OID 1.3.6.1.2.1.43.5.1.1.3.1) which allows an attacker to restart the device (''powerCycleReset(4)''), reset the NVRAM settings (''resetToNVRAM(5)'') or restore factory defaults (''resetToFactoryDefaults(6)'') using [[SNMP]]. This feature/attack is supported by a large variety of printers and removes all protection mechanisms like user-set passwords for the embedded web server. While protection mechanisms can be efficiently bypassed, a practical drawback of this approach is that all static IP address configuration will be lost. If no [DHCP https://de.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol] service is available, the attacker will not be able to reconnect to the device anymore after resetting it to factory defaults.
+The Printer-MIB <ref>''[https://www.ietf.org/rfc/rfc3805.txt RFC3805: Printer MIB v2]'', R. Bergman, I. McDonald and H. Lewis, 2004</ref> defines the ''prtGeneralReset'' Object (OID 1.3.6.1.2.1.43.5.1.1.3.1) which allows an attacker to restart the device (''powerCycleReset(4)''), reset the NVRAM settings (''resetToNVRAM(5)'') or restore factory defaults (''resetToFactoryDefaults(6)'') using [[SNMP]]. This feature/attack is supported by a large variety of printers and removes all protection mechanisms like user-set passwords for the embedded web server. While protection mechanisms can be efficiently bypassed, a practical drawback of this approach is that all static IP address configuration will be lost. If no [https://de.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol DHCP] service is available, the attacker will not be able to reconnect to the device anymore after resetting it to factory defaults.
 '''How to test for this attack?'''

@@ Line 3: / Line 3: @@
 == SNMP ==
-The Printer-MIB <ref>''[https://www.ietf.org/rfc/rfc3805.txt RFC3805: Printer MIB v2]'', R. Bergman, I. McDonald and H. Lewis, 2004</ref> defines the ''prtGeneralReset'' Object (OID 1.3.6.1.2.1.43.5.1.1.3.1) which allows an attacker to restart the device (''powerCycleReset(4)''), reset the NVRAM settings (''resetToNVRAM(5)'') or restore factory defaults (''resetToFactoryDefaults(6)'') using [[SNMP]]. This feature/attack is supported by a large variety of printers and removes all protection mechanisms like user-set passwords for the embedded web server. While protection mechanisms can be efficiently bypassed, a practical drawback of this approach is that all static IP address configuration will be lost. If no [[DHCP]] service is available, the attacker will not be able to reconnect to the device anymore after resetting it to factory defaults.
+The Printer-MIB <ref>''[https://www.ietf.org/rfc/rfc3805.txt RFC3805: Printer MIB v2]'', R. Bergman, I. McDonald and H. Lewis, 2004</ref> defines the ''prtGeneralReset'' Object (OID 1.3.6.1.2.1.43.5.1.1.3.1) which allows an attacker to restart the device (''powerCycleReset(4)''), reset the NVRAM settings (''resetToNVRAM(5)'') or restore factory defaults (''resetToFactoryDefaults(6)'') using [[SNMP]]. This feature/attack is supported by a large variety of printers and removes all protection mechanisms like user-set passwords for the embedded web server. While protection mechanisms can be efficiently bypassed, a practical drawback of this approach is that all static IP address configuration will be lost. If no [DHCP https://de.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol] service is available, the attacker will not be able to reconnect to the device anymore after resetting it to factory defaults.
 '''How to test for this attack?'''

@@ Line 9: / Line 9: @@
 Resetting the device to factory default can be accomplished using ''snmpset'' command as shown below:
- $ snmpset -v1 -c public printer 1.3.6.1.2.1.43.5.1.1.3.1 i 6
+<syntaxhighlight lang=sh>
 '''Who can perform this attack?'''

@@ Line 78: / Line 78: @@
 '''How to test for this attack?'''
-Open a raw network connection (using ''netcat'' <ref>''[http://nc110.sourceforge.net/ Netcat – TCP/IP Swiss Army Knife]'', Hobbit, 1996</ref>, for example) to port 9100/tcp of the printer and send the PRESCRIBE commands documented above.
+Open a raw network connection (using ''netcat'' <ref>''[http://nc110.sourceforge.net/ Netcat – TCP/IP Swiss Army Knife]'', Hobbit, 1996</ref>, for example) to port 9100/tcp of the printer and send the commands documented above.
 '''Who can perform this attack?'''

@@ Line 13: / Line 13: @@
 '''Who can perform this attack?'''
-Any anyone who can send network packets to port 161/udp of the printer device.
+Anyone who can send network packets to port 161/udp of the printer device.
 == PML/PJL ==
@@ Line 34: / Line 34: @@
 '''Who can perform this attack?'''
-Any anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
+Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
 == PostScript ==
@@ Line 65: / Line 65: @@
 '''Who can perform this attack?'''
-Any anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
+Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
 == PRESCRIBE ==
@@ Line 82: / Line 82: @@
 '''Who can perform this attack?'''
-Any anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
+Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
 ----

@@ Line 43: / Line 43: @@
 <syntaxhighlight lang=postscript>
- << /FactoryDefaults true >> setsystemparams
+<< /FactoryDefaults true >> setsystemparams
 </syntaxhighlight>
@@ Line 49: / Line 49: @@
 <syntaxhighlight lang=postscript>
- true 0 startjob systemdict /quit get exec
+true 0 startjob systemdict /quit get exec
 </syntaxhighlight>