3 ms·
So I started to read about Postscript in attempt to learn more about printers and what's hackable about them. I know all the embedded stuff is about using embed
by 616c 10y ago
So I started to read about Postscript in attempt to learn more about printers and what's hackable about them. I know all the embedded stuff is about using embedded web servers with crap configs and coding, but there is something appealing to the potential of powning a printer by just sending it a print job.
Has anyone studied that, a la devttys0.com, and how did you get there? I am digging through old PS books, so I am hoping in a decade when I finish that to learn from your comments if left here. Haha.
- tacostakohashi 10y agoSome of the best resources are: PostScript Language Reference Manual (PLRM) http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf Experiment with GhostScript, the #ghostscript channel on freenode Although PostScript is a complete programming language, allowing obvious attacks like going into an infinite loop, exhausting memory, etc, it's also easy enough for the printer to sandbox print jobs to prevent you from doing anything too nasty. Also, PostScript is really on used to define the print job output, it doesn't give you low-level control over the hardware or anything.
- Someone 10y agoIt's not low-level, but you could send faxes from some Apple Laserwriters from postscript (although that may not have been a generic faxing ability, according to https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Questions https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Que...)
- 616c 10y agoCool. Now only to find an Apple Laserwriter in my neck of the woods. Haha.
- 616c 10y agoThis is the book I am referring to. As for ghostscript, good point. Is it used enough even on the printer side to be exploitable, or you mean exploiting clients sending print jobs? I don't follow 100%.
- GregBuchholz 10y agoWhat do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF
- 616c 10y agoI thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
- tacostakohashi 10y agoghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
- 616c 10y agoThat's what I thought. Thanks though, your comments are still very useful.
- agumonkey 10y agoTypography reminiscent of ThinkingForth ..