Search Irongeek. com. Help Irongeek. com pay for bandwidth and research equipment Hacking Network Printers Mostly HP Jet. Directs, but a little info on the. Ricoh Savins Hacking Network PrintersMostly HP Jet. Directs, but a little info on the Ricoh SavinsBy Adrian Irongeek Crenshaw. Hack a printer you say, what kind of toner have you. HP Jetdirect is the name of a technology sold by HewlettPackard that allows computer printers to be directly attached to a Local Area Network. The Jetdirect. Parts and support for HP C7770B DesignJet 500 42in roll printer. Irongeek Well, Im here to tell you, theres more that can be done. In the olden. days a printer may not have been much of a concern other than the threat from. Operating Systems, storage and full IP stacks. This article will attempt to point out some of the more interesting things that. Some of this article may seem a little Black hat as it concentrates more on the. However I feel this information will be useful. If you want more advice on how to lock. Hacking Network Printers Mostly HP JetDirects, but a little info on the Ricoh Savins By Adrian Irongeek Crenshaw. Hack a printer you say, what kind of toner have. A guide from HP is linked. If nothing else, this article. For my tests I will mostly be using a Hewlett Packard Laser. Jet 4. 10. 0 MFP. FaxPrinterCopierScanner, an HP Jet. Direct 1. 70x and a HP Jet. Direct 3. 00. X J3. A but I will. bit on the Ricoh Savin series of printers lest you think HPs are the only. Much of this article. It. all started as a project for Droops Infonomicon TV and it snowballed from there. Bear with me as I clean it up and other folks send. The most recent version of this. Table of Contents Intro to the concepts        There are several TLAs Three letter. Products from a very wide variety of vendors may be affected. See Vendor Information for details from vendors who have provided feedback for this advisory. In. I will be using though out this article so I best get them out of the. Printer Control Language, which was developed by HP and has become one. Another page description language you. Post. Script. PS which was designed by Adobe to allow for more complicated things to be printed from a. PJL Printer Job Language is an. PCL that can tell a printer what to do, from changing device. There are also three. Heres a table. with some of the pertinent information about each protocol Name. Meaning. Port. LPDLine Printer Daemon protocol. IPPaka. Berkeley printing system. Internet Printing Protocol. Jet. Directaka. App. Socketaka. Rawaka. PDL datastream  9. Since my focus is on. Jetdirect 300x J3263a Firmware HuaweiJet. Directs I will mostly be talking about and using App. SocketPDL datastream, but. Jet. Directs can also work with IPP and LPD, and many non HP made. App. Socket, you should be aware of the existence of all. Theres are also network printers that use the IPX, Appletalk and SMB. Savins for example protocols to communicate. Ill not cover IPX and. Appletalk because of my lack of experience with them, maybe someone else who. SMB I may try to cover at a later time. Now that the formalities are out of the way, lets start playing. Diagnostics page        The pictures above. Jet. Direct 1. 70x box. Notice the picture on the right on the. Pressing. this button on most Jet. Direct boxes will print out a diagnostic page listing. IP setting for the Jet. Direct box. If your printer has an. Jet. Direct card you will have to negotiate the menus to find out how to. Once you hit the test button the printer should. MAC address,  IP. Address, subnet mask, default gateway, firmware revision and some general statistics. The IPhost. will be especially  useful if you want to bypass print quota software by. IP printing on your Windows or Linux box. If you dont have. Jet. Direct box you can still find its IP or host name by. Windows box you have access to.         As you can see by the. Jet. Direct box is npib. Sometimes you will see a port listed as something like IP1. Jet. Directs IP. You can pretty much use a host. IP interchangeably on your LAN, and if the host name has a fully. Internet. as well. If you dont have. Jet. Direct box, or if your PC is not connected to one, dont despair. In next few sections I will describe how to find these printers on the LANInternet. Nmap and Jet. Admin. Stupid Printer Tricks. I called this section Stupid Printer Tricks because while. RAWApp. Sock protocol that listens on port 9. Jet. Directs and most other. Try this, find your printers IP using the. Diagnostics page then web surf to   http your printers ip 9. The 9. 10. 0 at the end is there to tell your browser to connect on port 9. When you try to establish the connection you should notice that the browser does. Click the stop button on your browser to tell it to stop trying to. Depending on what browser you use. Firefox. Internet Exploiter. GET HTTP1. 1. Host tux 9. User Agent Mozilla5. Windows U Windows NT 5. US rv 1. 8. 0. 1. Gecko2. 00. 60. 11. Firefox1. 5. 0. 1. Accept textxml,applicationxml,applicationxhtmlxml,texthtml q0. Accept Language en us,en q0. Accept Encoding gzip,deflate. Accept Charset ISO 8. Keep Alive 3. 00. Connection keep alive. GET HTTP1. 1. Accept imagegif, imagex xbitmap, imagejpeg, imagepjpeg. Accept Language en us. Accept Encoding gzip, deflate. User Agent Mozilla4. MSIE 6. 0 Windows NT 5. SV1. NET CLR. 1. NET CLR 2. 0. 5. 07. Host test 9. 10. Connection Keep Alive        You see, anything. The two texts you see above are HTTP get requests for the root document of. The network printer does not understand this and just tries to print. Another thing you can try is telneting to port 9. IP is 1. 92. 1. 68. Irongeek. telnet 1. Trying 1. 92. 1. 68. Connected to 1. 92. Escape character is. Connection closed. Irongeek         You should now see a. The represents the. Control key and the bracket at the same time. The above. example was done in nix, but the same commands should work in Windows. Keep in. mind you may not see all of what you type in the parts in red unless you have. Windows.         There are exceptions. This trick. for which there will be more details given later, should change LCD display to. Its not supported on all printers, but If you have an HP it. Ive got to thank. Dipswitch for pointing out that you dont need fancy tools or code to do it. With Telnet Irongeek. PJL RDYMSG DISPLAYSome Textquit. Irongeek Or Netcat Irongeek. PJL RDYMSG DISPLAYSome Text. Irongeek Jet. Direct password notes        Most of the time. Jet. Directs password options on, but if they do they quickly. If you are using a. Jet. Direct box like one of the following 6. N J6. 05. 8A6. 15. N J6. 05. 7A6. 10. N J4. 16. 9A, J4. A3. 80. X J6. 06. A3. 10. X J6. 03. A,2. 50. M J6. 04. A7. 5XJ6. 03. 5Aor an HP printer with and internal Jet. Direct card like HP Laser. Jet 4. 10. 0 series. HP Laser. Jet 8. 15. HP Laser. Jet 9. 00. HP Color Laser. Jet 4. HP Color Laser. Jet 4. HP Designjet 5. 00. HP Business Inkjet 2. Web interface. and Jet. Admin software are the same. If you telnet in you will be prompted for a. The user names root, admin, administrator and supervisor are. If you are using an. Jet. Direct box like one of the following 6. N J3. 11. 0A, J3. A, J3. 11. 2A. J3. A4. 00. N J4. 10. A, J4. 10. 5A, J4. A3. 00. X5. 00. X1. XJ3. 29. 6A, J4. B, J3. 26. 3A, J3. A, 3. 26. 5A, J4. B, J3. 25. 8Bthen things are more confusing. First, if you telnet in you will. If you setup a password for the. In other words there are two passwords on at least some Jet. Direct boxes. one for telneting into it and one for the web interfaceJet. Admin software. Telnet. WebJet. Admin passwords are not. Telnet passwords. WebJet. Admin passwords to 1. Just so you. know, Hijetter discussed later may report the password as disabled even if both. The Web interface and. Jet. Admin use SNMP Simple. Network Management Protocol to control the Jet. Direct boxes and require that you. Ive read that other third party SNMP configuration utilities. Jet. Direct anyway.