Skip to main content

LPD Pentesting

Default Port: 515

LPD (Line Printer Daemon), is a protocol used to manage and process print jobs on Unix-based systems. While it is primarily used for printing purposes, it can sometimes be misconfigured, allowing for potential security vulnerabilities. In this article, we will explore pentesting techniques for LPD, categorized under the following headings: Connect, Recon, Enumeration, Attack Vectors, and Post-Exploitation.

Connect​

Connecting to an LPD Service​

To begin pentesting LPD services, you need to connect to the LPD port (default port 515). You can use tools like telnet or Netcat to manually interact with the service:

nc <target-ip> 515

Alternatively, you can use lpq (line printer queue) to retrieve the status of the print queue:

lpq -P <printer-name> -h <target-ip>

This command allows you to interact with the printer daemon to check for active print jobs on a remote host.

Executing Print Jobs​

Once connected, you can attempt to send a print job to the remote LPD service:

lpr -P <printer-name> -h <target-ip> <file-to-print>

This sends the specified file to the printer for printing. Misconfigured LPD services may allow unauthorized users to send jobs, filling up the print queue or accessing printed documents.

Recon​

Identifying an LPD Service​

You can use Nmap to identify if an LPD service is running on the target system:

nmap -p 515 <target-ip>

This command checks if port 515 is open, which is the default port for the LPD service.

To collect more detailed information about the LPD service, you can use Netcat to perform banner grabbing:

nc -nv <target-ip> 515

This retrieves the initial response from the LPD service, which can contain useful information about the server version and configuration.

Fingerprinting the LPD Version​

Once you have identified the LPD service, you can attempt to fingerprint its version. Some LPD services may return detailed version information that could reveal known vulnerabilities. Tools like nmap -sV can help:

nmap -sV -p 515 <target-ip>

Enumeration​

Checking for Open Ports​

To gather more information about the target system, you can perform a full port scan to see what other services might be running:

nmap -sS -p- <target-ip>

This command checks all open ports on the target system, which could provide additional attack vectors.

Collecting Print Queue Information​

You can retrieve the list of print jobs currently in the queue using the lpq command:

lpq -P <printer-name> -h <target-ip>

If the LPD service is misconfigured, this command may reveal sensitive information about users or documents currently in the print queue.

Verifying Access Control​

Some LPD services use /etc/hosts.lpd or similar files to define which hosts are allowed to connect. If this file is not properly configured, unauthorized access may be possible. You can test access by trying to send print jobs or retrieve print queue information.

Attack Vectors​

Exploiting Weak Authentication​

LPD services may rely on weak or outdated authentication mechanisms. If /etc/hosts.lpd is misconfigured (for example, allowing any host), you could potentially exploit this by sending print jobs or retrieving sensitive documents without needing valid credentials.

Denial of Service (DoS) Attacks​

One attack vector is to overwhelm the LPD service by sending numerous print jobs, which could fill up the queue and potentially cause a Denial of Service (DoS). You can use a script to send multiple print jobs quickly:

    for i in {1..1000}; do
      lpr -P <printer-name> -h <target-ip> <file-to-print>;
    done

This can flood the service, making it unusable for legitimate users.

Unauthorized File Access​

In some cases, LPD misconfigurations might allow access to print jobs from other users. For example, you could retrieve the contents of a printed document from the queue, which may contain sensitive information:

lpq -P <printer-name> -h <target-ip>

Exploiting Buffer Overflows​

Older versions of the LPD service may be vulnerable to buffer overflow exploits. By sending specially crafted data, you could potentially crash the service or execute arbitrary code. Tools like Metasploit can be used to check for known vulnerabilities in specific LPD versions.

Post-Exploitation​

Privilege Escalation​

Once access is gained through the LPD service, look for opportunities to escalate privileges. For example, you can search for writable or executable directories owned by root:

find / -perm -4000 -type f 2>/dev/null

This command lists SUID binaries, which could be exploited for privilege escalation.

Extracting Sensitive Information​

After gaining access, it’s essential to gather as much information as possible. For instance, you can search for files related to print jobs:

rsh <target-ip> -l <username> find /var/spool -type f

This can reveal information about current or past print jobs, potentially exposing confidential data.

Maintaining Persistence​

To maintain persistent access to the compromised system, you can modify configuration files to allow ongoing unauthorized access. For instance, you can add your machine’s IP to the /etc/hosts.lpd file, allowing continuous access to the LPD service:

echo "attacker-ip" >> /etc/hosts.lpd

This entry ensures that the attacker’s IP is trusted by the LPD service.

Covering Tracks​

To avoid detection, it is crucial to cover your tracks by deleting any logs or job history files. You can clear logs related to LPD activities using commands like:

rsh <target-ip> -l <username> echo "" > /var/log/lpd-errs
rsh <target-ip> -l <username> rm /var/spool/lpd/*

These commands help to eliminate traces of your activities on the system.

By following these LPD pentesting steps, you can systematically identify vulnerabilities, exploit misconfigurations, and assess the security posture of LPD services. Always ensure you have the necessary permissions to conduct such tests in a legal and ethical manner.