Ok! Figured out a simple way to pull *local* hashes out of Canon iR-ADV (imageRunner) printers.

The goal of this "hack" is to use access to a printer to gain further credentials that can be used to pivot further into the network.

This is a separate "attack" than pulling the LDAP domain credentials out of the printer.

So you *start* with administrative access to the printer - say through the use of default credentials (Most iR-ADV printers have the default credentials of User: Administrator (with a capital A) and Pass: 7654321 ).

Once logged into the printer with admin credentials, go to "Authentication Management > User Management > Export"

Export the file into an Excel spreadsheet.

In the column "sdl_digest" you'll see the password hash. The hash is "Raw-MD5" with no salt. So load that into your favorite hash cracker and have fun.

Note, this account is a LOCAL account on the printer. This only works if some printer admin went in and created a new local account. Not all printers have local accounts. There is no reason for this account to give you any access into anything else besides the printer that you ALREADY HAVE ADMIN access to.

Buuuuuuut..... folks often set up their account to mimic their domain accounts. So the password is often the same as their domain accounts (or was the same two years ago... so take the time since creation, divide by 90 days, and add that resultant number to the end of the password you cracked).

#hacking #printer #infosec #canon #iRADV

One of my all-time weirdest Wordles

Wordle 950 5/6

⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜
⬜⬜⬜⬜⬜
🟩🟩🟩⬜⬜
🟩🟩🟩🟩🟩