Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-25 14:10:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/windows-hardening/active-directory-methodology/ad-information-in-printers.md
Translator workflow b442ae90c4 Translated to Klingon
2024-02-10 17:52:19 +00:00

6.2 KiB
Raw Permalink Blame History

htARTE (HackTricks AWS Red Team Expert) ! qaStaHvIS AWS hacking ghItlhvam

HackTricks poH support ways:

  • HackTricks advertised company see want SUBSCRIPTION PLANS Check HackTricks download PDF
  • PEASS & HackTricks swag official Get
  • PEASS Family The Discover NFTs exclusive collection our
  • Join 💬 group Discord The group telegram or us follow 🐦 Twitter @carlospolopm.
  • hacking tricks Share submitting by tricks hacking your Share repos github and HackTricks Cloud HackTricks PRs the to by submitting tricks hacking your Share github and HackTricks Cloud HackTricks

There are several blogs in the Internet which highlight the dangers of leaving printers configured with LDAP with default/weak logon credentials.
This is because an attacker could trick the printer to authenticate against a rouge LDAP server (typically a nc -vv -l -p 444 is enough) and to capture the printer credentials on clear-text.

Also, several printers will contains logs with usernames or could even be able to download all usernames from the Domain Controller.

All this sensitive information and the common lack of security makes printers very interesting for attackers.

Some blogs about the topic:

Printer Configuration

  • Location: The LDAP server list is found at: Network > LDAP Setting > Setting Up LDAP.
  • Behavior: The interface allows LDAP server modifications without re-entering credentials, aiming for user convenience but posing security risks.
  • Exploit: The exploit involves redirecting the LDAP server address to a controlled machine and leveraging the "Test Connection" feature to capture credentials.

Capturing Credentials

For more detailed steps, refer to the original source.

Method 1: Netcat Listener

A simple netcat listener might suffice:

sudo nc -k -v -l -p 386

Method 2: Full LDAP Server with Slapd

A more reliable approach involves setting up a full LDAP server because the printer performs a null bind followed by a query before attempting credential binding.

  1. LDAP Server Setup: The guide follows steps from this source.
  2. Key Steps:
  • Install OpenLDAP.
  • Configure admin password.
  • Import basic schemas.
  • Set domain name on LDAP DB.
  • Configure LDAP TLS.
  1. LDAP Service Execution: Once set up, the LDAP service can be run using:

Method 2: Slapd jIHDaq LDAP Server

ghItlhlaHbe'chugh, 'ej printer null bind followed by a query before attempting credential binding.

  1. LDAP Server Setup: This source laH follow steps.
  2. Key Steps:
  • OpenLDAP qay'be'.
  • admin password configure.
  • basic schemas Import.
  • LDAP DB domain name set.
  • LDAP TLS configure.
  1. LDAP Service Execution: ghItlhlaHbe'chugh, LDAP service run can be.
slapd -d 2

References

htARTE (HackTricks AWS Red Team Expert) ! qaStaHvIS AWS hacking vItlhutlh

Other ways to support HackTricks: