On today's edition of "Things You Shouldn't Be Able To Do From a Browser"...
Seriously though, sending PJL commands directly to printers on port 9100 is such a neat hack. Back when I was working help desk in college, much fun was had the day I discovered you could change the "READY" string on HP printer displays to anything you wanted. "INSERT COIN", "CHECK ENGINE", etc.
PJL is easier to parse than it looks at first glance. I worked on a laser printer controller back in the late '80s that for convenience we made mostly HP compatible. Have fun!
This is a very old technique. I came across it six or so years ago: the article where I found the code, http://odetocode.com/humor/68.aspx, is from 2003.
It's a lot of fun though. And PJL can be very interesting to work with: I built a tool that used it to query printers for status information (although the amount of information I could extract seemed very dependent on the printer).
I know I commented earlier, but I slept on it last night and I realised I'd already hacked printers in this way and got paid to do it - I'd just completely forgotten.
Years ago, I was working for well known lighting manufacturer and CD inventor you know who I mean... they had a SAP system that did not have a printer driver for the thermal printers they were using on all their products. I'd been using a bizarre pseudo mark-up language called SAPScript on a couple of projects and discovered quite by accident ;) that you could encode printer commands directly into the SAPscript. Exactly the same principle I guess as including php code in HTML. At some point the machine knows to parse the code not print it. I could get it to do some mad printed stuff as long as you could controll the variables that you passed to the script. I never tried the burn baby burn effect though. I was too nice.
I remember having to debug the printing system (lpq, converters etc.) on my first Slackware system back in the early years of the second age, with plenty of shell scripts and literal postscript output. So I regard this with a certain amount of schadenfreude.
(Although the "printer" part of the headline makes this sound much more fancy and hardware-oriented than what it is, yet another HTTP-based protocol that's parsed enough to work for a few use cases).
«By redefining the `showpage' operator which is contained in every
PostScript document to print the current page, an attacker can hook in
there and execute her our own PostScript code. Long term redefinition
(until the device is restarted) is possible by prepending the
`startjob'/`exitserver' operators.»
Then all bets are off, any print job can be captured, altered, stored, denied, etc.
I wrote a scriptable "chooser" when I was at Apple -- it let you programmatically find and select a printer to print to.
I enumerated every printer on campus (about 900 of them at the time, I think), and came /this close/ to printing a snarky page -- a fake version of the "Five Star News" internal company news -- on each one of them. Decided not to; probably a good career move that I resisted that urge.
> However, at least in Win 98 SE, PostScript drivers finally worked… sort of…
> Fun fact: Up to NS4 / IE4, you couldn't print a JavaScript generated HTML output, which was a major restriction in the days, when "the Internet" was commonly printed by a assistant for the benefit of a higher echelon...
Fun fact: printing web pages today is a PITA. The only browser which some years ago made a decent job was Opera. Firefox, Chrome and IE are total disasters.
Aaand this is how I made my printer spit out dozens of garbage pages with just one to two lines of gibberish on each (the PDF source code, admirably giving up the page at each occurrence of the corresponding char)...
Oh fascinating. If I use the system dialogue, I can choose the application to print to. There is an `lpr` option, and I can specify the application it invokes in a "Command Line" field.
I can put `nc [printer_ip] 9100` there and it will just print. I just printed your comment this way.
Seriously though, sending PJL commands directly to printers on port 9100 is such a neat hack. Back when I was working help desk in college, much fun was had the day I discovered you could change the "READY" string on HP printer displays to anything you wanted. "INSERT COIN", "CHECK ENGINE", etc.
reply