IoT Penetration Testing: Using Printers to Breach Corporate Networks

1. Why Printers?

Every office printer is a network device exposing services like LDAP, SMTP, SMB, and FTP. Misconfigurations let attackers exploit them.

Default admin credentials not changed – anyone knowing the vendor defaults can log in.

Open network ports – IPP, LPD, RAW 9100, SNMP are reachable remotely.

SNMPv2 still in use – unchanged community strings allow direct reading of sensitive settings.

Plaintext stored credentials – some devices keep passwords in clear text.

Printers also support page description languages (PostScript, PJL, PCL). Tools such as the Printer Exploitation Toolkit (PRET) leverage these interfaces to access the internal file system and configuration files. Scripts like default-http-login-hunter.sh can brute‑force HTTP admin passwords.

2. Possible Attack Paths

The most recurring scenario is the Pass‑Back Attack . An attacker sets up a malicious service (e.g., a fake SMTP server) and reconfigures the printer’s SMTP/LDAP/SMB settings to point to it. When the printer attempts authentication, it sends the plaintext credentials to the attacker.

Illustrated on a Brother printer, the SMTP traffic reveals domain credentials in clear text. The same technique works on HP, Kyocera, and other brands.

Responder can capture these credentials via the SMTP protocol.

SMB can be abused similarly:

Responder can also capture plaintext credentials via SMB.

Other techniques include:

SNMP – poorly protected SNMP can reveal login credentials.

Address book – stored contacts may contain domain usernames or authentication data.

Firmware vulnerabilities – RCE bugs allow full device takeover.

Printer proxy – using the printer to launch attacks against other internal systems.

Print jobs – jobs may contain sensitive information.

From an attacker’s perspective, Pass‑Back attacks are preferred because printers often bypass strict firewall rules and have minimal logging, leaving a blind spot for lateral movement.

3. From SNMP to RCE

Historical cases show printers exposing sensitive data via SNMP. Attackers can retrieve credentials used for file shares, leading to data leakage.

Management interfaces have also suffered vulnerabilities such as CVE‑2022‑1026 , which allows unauthenticated access to address books and remote code execution. Once a printer joins a domain, the impact escalates quickly.

With a single valid account, attackers can query LDAP to discover privileged groups (e.g., Domain Admins) and check for Kerberoasting or AS‑REP roasting vulnerabilities. Tools like BloodHound map AD relationships to reveal complex attack paths.

Misconfigurations in AD Certificate Services (ADCS) further ease privilege escalation. If no exploitable vulnerability is found, harvested printer credentials can poison shared directories with LNK files, enabling NTLM relay attacks that dump SAM hashes. Because local admin passwords are often reused, attackers can leverage them across multiple machines to locate active domain admin sessions.

4. Defense Recommendations

Treat printers as full network nodes and apply the same security rigor as other assets.

Change default admin passwords – the most basic step.

Disable unnecessary services – reduce attack surface.

Upgrade SNMPv2 to SNMPv3 – add authentication and encryption.

Restrict Web UI access by IP and enforce HTTPS – prevent exposure of management traffic.

Turn off unused wireless functions .

Place printers in an isolated VLAN – limit interaction with sensitive systems.

Regularly update firmware – many vulnerabilities are patched.

Enable IPPS encrypted printing – protect data in transit.

5. Conclusion

A compromised printer is far more dangerous than a leaked document; it can serve as an internal foothold for lateral movement and control of critical systems.

Most common issues are mitigated through proper configuration and auditing. When organizations treat printers as genuine network assets, the entire class of easy entry points disappears.

IoT devices in general are often vulnerable and lack protection. Firmware can be reverse‑engineered with basic Linux skills to extract credentials, and many other attack vectors exist.

Source: Translated from Hackers Arise, original article "IoT Hacking: Abusing Printers to Gain Access to Corporate Networks" by Collateral.