Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

PJL / PostScript → printer root → quiet network foothold

PRET-style payloads against TCP/9100 give RCE on the printer's controller. The printer is a stable, EDR-free Linux box trusted by the rest of the network — perfect long-term implant.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: a Windows-style enterprise network with HP / Lexmark / Xerox MFPs. Printers reachable on 9100/tcp from the internal foothold. No printer-specific monitoring.

§ Steps

  1. 01
    Drop into printer controller shellExecution
    T1059— Command and Scripting Interpreter
  2. 02
    Enumerate printers on port 9100Discovery
    N-NMAP-INTERNAL— Internal Nmap Sweep
  3. 03
    Run PRET — PJL FSDOWNLOAD / FSUPLOADExecution
    PRT-PJL-PS-RCE— PJL / PostScript Code Execution
  4. 04
    Use printer as pivot to coerce internal hostsCredential Access
    PRT-SMB-REL-CRED— MFP Scan-to-SMB Coerce
  5. 05
    Intercept print jobs (scan-to-pdf, copies)Collection
    PRT-PRINT-JOB-INTERCEPT— Print Job Interception
  6. 06
    Plant implant in firmware / on flashExecution
    PRT-WEB-PANEL-RCE— Printer Web Panel RCE

§ References

§ Frequently asked

What is the "PJL / PostScript → printer root → quiet network foothold" attack path?
PRET-style payloads against TCP/9100 give RCE on the printer's controller. The printer is a stable, EDR-free Linux box trusted by the rest of the network — perfect long-term implant. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Drop into printer controller shell (T1059) — a execution primitive. Assumed environment: a Windows-style enterprise network with HP / Lexmark / Xerox MFPs.
What is the final impact of this kill-chain?
The final step lands on Plant implant in firmware / on flash (PRT-WEB-PANEL-RCE), which falls under Execution. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers