id: printers-info-leak

info:
  name: Unauthorized Printer Access
  author: pussycat0x,matejsmycka
  severity: info
  description: |
    Unauthorized access to printers allows attackers to print, eavesdrop sensitive documents.
  impact: |
     Attackers can gain access to sensitive printed documents, manipulate print jobs, and potentially compromise printer security
  remediation: |
     Implement proper network segmentation, disable unnecessary printer services, and ensure printers are not directly accessible from untrusted networks.
  reference:
    - https://book.hacktricks.xyz/pentesting/9100-pjl
    - https://en.wikipedia.org/wiki/Printer_Job_Language
  metadata:
    max-request: 1
    vendor: generic
    product: printer
    shodan-query: port:9100
  tags: network,iot,printer,misconfig,tcp,pjl

tcp:
  - inputs:
      - data: "@PJL INFO ID\n"
    host:
      - "{{Hostname}}"
    port: 9100

    matchers:
      - type: binary
        binary:
          - "40504a4c20494e464f2049440d0a22"

    extractors:
      - type: regex
        group: 1
        regex:
          - '"([^"]+)"'
# digest: 490a00463044022032f9fa2f5481673fa2087c672c4ab2275ee9a06f6cc6ef7bb35e04ad09b47c3a02202f3dd54cde2fcf0348d0e6427bd23be46721e6693b313067aa32a325d400b35f:922c64590222798bb761d5b6d8e72950