RUB-NDS/PRET
PRET
PRET es un framework de explotación de impresoras de red y utilidad de seguridad diseñada para descubrir hardware de impresión y auditar firmware. Sirve como un kit de herramientas para penetrar la infraestructura de impresión manipulando lenguajes y protocolos de control específicos de la impresora.
El proyecto proporciona capacidades especializadas para activar la ejecución remota de código a través de desbordamientos de búfer y gestionar sistemas de archivos de impresora utilizando el Printer Job Language. Permite la extracción de metadatos del dispositivo, como versiones de firmware y recursos de memoria, y la modificación de comportamientos de hardware y parámetros del sistema.
El framework cubre una amplia superficie de pruebas de seguridad, incluyendo descubrimiento de dispositivos de red, evaluación de vulnerabilidades a través de inundación de entrada e interceptación de flujos de trabajo de impresión. También incluye herramientas para la extracción de información del sistema y pruebas de denegación de servicio a nivel de hardware.
Features
- Firmware Exploitation - Delivers crafted payloads via printer languages to trigger buffer overflows and gain unauthorized remote code execution.
- Network Hardware Penetration Tools - Serves as a security utility for discovering printing hardware and intercepting print jobs on local networks.
- Printer-Specific File Access - Reads and writes files on internal device storage using specific control languages to identify sensitive data.
- Remote Device File System Analysis - Allows accessing and modifying internal storage on remote printers to extract sensitive credentials and configuration files.
- Printer File Managers - Provides capabilities to navigate, delete, and modify files and directories on a remote printer's storage.
- PJL File Management - Implements a manager for reading, writing, and modifying files on printer internal storage using the Printer Job Language.
- Firmware Vulnerability Assessment - Extracts device metadata and tests firmware vulnerabilities like buffer overflows through crafted payloads.
- Network Device Discovery - Searches for available printing devices on the local network using standard network management protocols.
- Infrastructure Pentesting - Evaluates the security of print workflows by intercepting print jobs and bypassing authentication controls.
- Network Security Auditing - Scans local networks to identify printing devices and audit them for common security vulnerabilities.
- Printer Exploitation Frameworks - Provides a comprehensive toolkit for auditing and exploiting network printers by manipulating printer-specific protocols.
- Remote Code Execution Tools - Delivers payloads through printer languages to trigger buffer overflows and gain system control.
- Vulnerability Assessment and Testing - Performs file system fuzzing and input flooding to identify buffer overflows and unauthorized access points.
- Printer Parameter Modifications - Provides the ability to update environment variables and system parameters to alter printer hardware behaviors.
- Security Information Extraction - Queries memory and configuration settings to uncover credentials, accounting data, and sensitive system details.
- Hardware Setting Manipulation - Translates commands into device languages to modify settings, bypass accounting, or test for denial of service.
- Print Workflow Interception - Captures print jobs and toggles job retention to intercept or block the output of documents.
- Denial of Service Tools - Ships utilities for simulating resource exhaustion and triggering system crashes to test printer stability.
- Device and Environment Metadata - Retrieves system information including firmware versions, page counters, and available memory resources.
- Hardware Level Management - Executes low-level hardware operations such as restarting the device or manipulating non-volatile memory.
- Analysis Frameworks - Specialized toolkit for printer exploitation and security testing.
- Exploitation Frameworks - Tool for testing and exploiting printer security vulnerabilities.
- Network Security Tools - Security testing tool for printer protocols and hardware.
- Service Brute Forcing - Printer exploitation toolkit.
