dreadnaught- Machine
- EvilCUPS
- OS
- Linux
- Difficulty
- Medium
- Steps
- 3
- Added
- 2 Oct 2024
A spoofed cups-browsed printer injection gives a shell as lp; an old root print job in the CUPS spool leaks the root password.
How it went
- 0nmap
nmap finds SSH and CUPS 2.4.2, with cups-browsed listening on UDP 631.
- 1CUPS injection
A spoofed browse packet feeds cups-browsed a poisoned PPD, so printing a test page runs an injected command as lp (CVE-2024-47176).
- 2print spool
lp can traverse /var/spool/cups; the old root print job d00001-001 holds the root password.
- 3su root
su with the recovered password gives root.