Re: Undocumented telnet access to Brother HL-2280DW
On Mon, 30 Dec 2013 00:00:51 +0400
Reco <recoverym4n@gmail.com> wrote:
> On Sun, 29 Dec 2013 13:52:13 -0500
> Celejar <celejar@gmail.com> wrote:
>
> > > This:
> > >
> > > http://www.brother-usa.com/VirData/Content/en-US%5CPrinters%5CConsumer%5CNetworkUsersManual%5CNUM_DCP_7065DN_HL_2280DW_MFC_7360N_7460DN_7860DW_EN_2845.PDF
> > >
> > > gave me an idea - they run telnet, but they use some variation of tcp
> > > wrappers which forbids any telnet connections (possibly other services
> > > too) from anything except maybe 192.168.0.1 (or, 192.168.0.5, or
> > > 169.254.0.0/16).
> >
> > What did you see there (what page)?
>
> Nothing in particular, just a guess. Manufacturers like to do stuff
> like this. Best of them think 'like, everyone and their dog uses
> 192.168.0.0/24 for the home network, let's secure our product by
> denying access from anyone outside'. Of course, to hardcode
> 192.168.0.0/24 is the easiest these guys can do.
>
> So, I browsed that pdf, searched for IPs, and sure enough, there was
> 192.168.0.1 as a default gateway example and 192.168.0.5 as a printer
> example, and some explanation of LLNR.
>
> > I tried telnetting from my router, an OpenWrt box with address
> > 192.168.0.1, and I get:
> >
> > Entering character mode
> > Escape character is '^]'.
> >
> > And then pretty much the same thing: no response, and eventual
> > disconnect after several carriage returns.
>
> So, no luck. Maybe it requires some engineering password first.
> Can you dump the firmware from the printer?
Not sure - even the process to upload new firmware doesn't give a
firmware file, just an .exe "upload tool" - don't know if the firmware
is embedded therein, or if it tries to download it from somewhere. I
ran strings against it, but couldn't find anything for '23' or 'telnet':
http://welcome.solutions.brother.com/bsc/public/us/us_ot/en/dlf/download_index.html?reg=us&c=us_ot&lang=en&prod=hl2280dw_us&type2=4&os=all&flang=all&dlid=
> Reco
Celejar
Reply to: