In this lesson, we're going
to explore lateral movement within a network using
the Line Printer Daemon, or LPD,
and the JetDirect protocols.
These protocols are primarily used
for managing printing services
and can be exploited by attackers
to move laterally through a network.
Let's start with the Line Printer Daemon, or LPD.
LPD is a network protocol for submitting print jobs
to a remote printer.
It is part of the line printer remote protocol suite
and is widely used on Unix and Unix-like systems.
Attackers can exploit LPD
by targeting weak or default configurations,
which may allow unauthorized access to the print server.
For example, if an LPD service is misconfigured
to allow unauthenticated access,
an attacker can use it to upload malicious print jobs
containing scripts or commands that get executed
on the print server.
From there, the attacker can use
the compromised server as a foothold
to explore and exploit other systems within the network.
Now, in 2019, a vulnerability was discovered
in several popular print models that used LPD.
These printers were found to be configured
with several default settings
that did not require authentication.
The attacker exploited this
by sending specially-crafted print jobs
containing malicious scripts to the printer.
Because the LPD service was not properly configured,
the printer processed these jobs
and executed the embedded commands,
giving the attacker control over the printer.
Once the printer was compromised,
the attacker used it as a foothold to exploit the network.
They scanned for other vulnerable devices and systems,
eventually gaining access
to sensitive information stored on that network.
Next, we have JetDirect.
JetDirect is a technology developed by Hewlett-Packard,
or HP, for connecting printers to a network.
JetDirect-enabled printers typically use
the Simple Network Management Protocol, or SNMP,
and the Transmission Control Protocol (TCP) port 9100
for direct print job submissions.
Attackers often target JetDirect printers
by exploiting default SNMP community strings,
which are just SNMP's versions of password
or unsecured TCP ports.
By gaining access to a JetDirect-enabled printer,
an attacker can perform various actions,
such as intercepting print jobs, modifying the print data,
or even using the printer as a relay
to launch attacks on other network devices.
For instance, an attacker gained access
to a JetDirect printer via an open TCP port 9100
and exploited the printer's default
SNMP community string "public,"
which was not changed from its factory setting.
Using this access, the attacker uploaded and executed
a script on the printer.
The script scanned the network,
capturing sensitive data from ongoing print jobs.
Additionally, the attacker also used a printer
as a launch point to deploy malware
to other connected systems,
using the printer's trusted status within the network
to bypass certain security measures.
Because printers are often less frequently monitored
and less secure than other network devices,
this breach went unnoticed for a significant period.
The compromised printer served as
an attractive target for the attacker,
enabling them to establish a persistent presence
within the network and continuously collect
sensitive information without immediate detection.
This example shows us the importance
of securing JetDirect-enabled printers
by changing the default settings
and implementing robust security measures
to prevent unauthorized access
and potential network exploitation.
We can also take this information
and use it to our advantage if we are conducting
a pen test in a corporate environment
with network-connected printers.
To mitigate these risks, it is essential
to follow best practices for securing LPD
and JetDirect Services.
This includes changing the default SNMP community streams,
securing print services
with strong authentication mechanisms,
regularly updating firmware,
and monitoring network traffic
for suspicious activity related to printing services.
So remember, understanding the methods of lateral movement,
such as through LPD and JetDirect is crucial
for securing your network and for penetration testing.
These protocols, while primarily used for printing,
can be exploited by attackers to gain unauthorized access
and move laterally within the network.
By learning how these protocols work
and how they can be exploited, you can better defend
against lateral movement in your network.