Solutions for remote+localinitiated exploits
How to fix?
Not easy, since it’s PJL design + device vendors’ faults
Java, Word, LiveCycle, etc. have no big blame
They act as “channels” for delivering the 
exploits/malware/malicious commands
Rather than fixing channels, better fix specifications and devices
Perhaps correct PJL specs + follow standard and safe low-level 
communication with devices on top of PJL
Paranoid solution:
Print everything thru a virtual/proxy/filtering printer
That will filter out unsafe/suspect payloads (and alert!), producing 
“safe” docs to print on real devices
Unless the virtual printer has bugs/is exploitable itself
Change pdf to text file - Convert PDF to txt files in C#.net, ASP.NET MVC, WinForms, WPF application
C# PDF to Text (TXT) Converting Library to Convert PDF to Text
convert pdf to openoffice text; changing pdf to text
Change pdf to text file - VB.NET PDF Convert to Text SDK: Convert PDF to txt files in vb.net, ASP.NET MVC, WinForms, WPF application
VB.NET Guide and Sample Codes to Convert PDF to Text in .NET Project
pdf to text; remove text from pdf
Exploiting “test print” access in printers’ EWS
Print is unprotected! (and leaks internal network IP)
Do vendors think diagnostics actions can be harmless?
VB.NET PDF File Compress Library: Compress reduce PDF size in vb.
list below is mainly to optimize PDF file with multiple Program.RootPath + "\\" 3_optimized.pdf"; 'create optimizing 150.0F 'to change image compression
convert pdf file to text file; .pdf to .txt converter
C# PDF Text Extract Library: extract text content from PDF file in
Able to extract and get all and partial text content from PDF file. How to C#: Extract Text Content from PDF File. Add necessary references:
convert image pdf to text; convert pdf file to text online
Exploiting “test print” access in printers’ EWS
Accepts file as direct upload :
Filters based only on extension: txt, pdf, pcl, ps
Will notaccept:
print_my_hexor.rfuor 
print_my_hexor.fmw
Will accept:
print_my_hexor.pcl!
Yes, in PCL we can embed PJL UPGRADE/equivalent commands
Also, extension check doesn’t enforce content check:
Rename print_my_hexor.pclinto print_my_hexor.pdf
And here we go again 
Example: use HP_LJ5200_restart.pcl.pdf
VB.NET PDF Text Extract Library: extract text content from PDF
this advanced PDF Add-On, developers are able to extract target text content from source PDF document and save extracted text to other file formats through VB
convert pdf to text c#; convert pdf to text without losing formatting
C# PDF File Compress Library: Compress reduce PDF size in C#.net
list below is mainly to optimize PDF file with multiple Program.RootPath + "\\" 3_optimized.pdf"; // create optimizing 150F; // to change image compression
convert pdf to word editable text; convert pdf to text for
Exploiting “test print” access in printers’ EWS
Accepts file as URL link to a printable document:
Exploit as in previous direct local upload
Other interesting uses:
Check if printer can access external addresses (cool for command-
and-control type of attacks)
Might reveal internal/external topology, as well as proxies along the 
way
If the chain is not properly configured and secured
Try to DoS the MFP in two types of slowloris
Attacker’s http-client “slowloris”es MFP’s EWS
Attacker’s http-server “slowloris”es the MFP’s initiated http-clients to 
our URL-document
Do both from above simultaneously 
Find race conditions in parsers: direct print, direct URL print, port 
9100 print and print-server print; include also PJL/non-PDL
cmds
Online Convert PDF to Text file. Best free online PDF txt
from other C# .NET PDF to text conversion controls, RasterEdge C# PDF to text converter control toolkit can convert PDF document to text file with good
convert pdf to txt batch; convert image pdf to text pdf
VB.NET PDF File Merge Library: Merge, append PDF files in vb.net
Professional VB.NET PDF file merging SDK support Visual Studio .NET. Merge PDF without size limitation. Append one PDF file to the end of another one in VB.NET.
best pdf to text converter for; convert pdf to txt file format
Exploit printer management software
MITM –HP Example –firmware.glf:
Contains the links for DLD/RFU firmwares
Used in WJA, HP Download Manager
Uses plain HTTP (not even HTTPS), hence not a problem to MITM
Once MITMed, malicious DLD/RFU firmware binaries are supplied
Combined MITM+XSS attack:
MITM and supply malicious firmware binaries (as described above)
Exploit XSS bugs in admin panel of printer management software
Eg: HP WJA (or alike)
Use XSS to trigger automatic upgrade of devices
Two targets in one shot:
Devices infected
Web-admin software owned by XSS (can serve other purposes as well)
C# PDF File Split Library: Split, seperate PDF into multiple files
Application. Best and professional adobe PDF file splitting SDK for Visual Studio .NET. outputOps); Divide PDF File into Two Using C#.
convert pdf to ascii text; convert pdf picture to text
VB.NET PDF File Split Library: Split, seperate PDF into multiple
Professional VB.NET PDF file splitting SDK for Visual Studio and .NET framework 2.0. Split PDF file into two or multiple files in ASP.NET webpage online.
convert pdf into text file; convert scanned pdf to word text
Exploit printer management software
Use XSS as an infection-trigger step in combined 
MITM+XSS attack
Eg.: HP WJA has various persistent-XSS bugs, injectablefrom 
external channels
C# PDF File Merge Library: Merge, append PDF files in C#.net, ASP.
document file, and choose to create a new PDF file in .NET deleting, PDF document splitting, PDF page reordering and PDF page image and text extraction.
convert pdf image to text online; converting pdf to text
PostScript interpreters exploitation
PostScript interpreters have bugs as well
GhostScriptexploitable on your PC
“MfpPsInterpreter” exploitable on your MFP
Stack
and recursion
are nice weapons
%%[ Error: execstackoverflowOffendingCommand
: --nostringval--]%%
This is simple, but more complex/inconsistent stack operations can be done
Fuzzingthe interpreter and stack is a good way to find out
PostScript interpreters exploitation
PostScript-related exploits
CVE-2004-1717
Remote
buffer overflow
CVE-2007-6725
CVE-2008-0411 
CESA-2008-001
–Stack-based buffer overflow
CVE-2008-6679
CVE-2009-0196
CVE-2009-0583
CVE-2009-0584
CVE-2009-0792
CVE-2009-4195
Buffer overflow
CVE-2009-4270
CVE-2009-4897
CVE-2010-1628
CVE-2010-1869
Stack
based overflow
Try/tweak them out on your MFPs fleet
Some might surprise you
Got some (unreliable) crashes by tweaking few of the above
Locally-executed apps with rogue firmware
If all other fail
Because of: fixes in webserver, script-blockers, etc.
Social engineer the user to “download and play a nice 
game” application
Doesn’t have to be a PC virus, a valid app will do ok:
It will be just a printer malware
So zero antivirus detection guaranteed still 
Just connect to TCP port 9100 printer job spooler
Dump the exploit/malware 
Use @PJL UPGRADE style commands
Use @PJL FS* style commands
Locally-executed –Print subsystem hacks
Find exploit stream for unidrv.dll/pscript5.dll
Get LOCAL SYSTEM privileges (spoolsv
.exe
)
unidrv/pscript5 dllscalled from user space
No need for admin
Called locally
Called remotely –via shared printers
Examples:
Stuxnet
, well yeah!
Contained 0day exploiting spoolsv.exe / StartDocPrinter
/ policies
Well, 0day
back in Apr 2009
I’ve been warning back in Apr 2010
Nobody cared, except perhaps SIGINTs
-related
Printing sub-systems are broken…
Documents you may be interested
Documents you may be interested