cupscheck.go

package main
/*
cups_browsed CVE-2024-47176 vulnerability checker.
Based off the writeup from Simone Margaritelli
on the vulnerability he identified. 

His blog is here: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
*/

import (
	"flag"
	"fmt"
	"log"
	"net"
	"net/http"
	"os"
	"os/user"
	"strings"
	"time"
)

var vulnerableMachines []string

func startHTTPListener() {
	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
		log.Printf("Received connection from %s\n", r.RemoteAddr)
		// Log headers
		for key, value := range r.Header {
			log.Printf("%s Header: %s -> %s\n", r.RemoteAddr, key, strings.Join(value, ", "))
		}
		vulnerableMachines = append(vulnerableMachines, r.RemoteAddr) // Add to vulnerable machines
	})
	log.Println("Starting HTTP listener on port 9180...")
	if err := http.ListenAndServe(":9180", nil); err != nil {
		log.Fatalf("Failed to start listener: %v", err)
	}
}

func parseIPRange(cidr string) ([]net.IP, error) {
	ip, ipnet, err := net.ParseCIDR(cidr)
	if err != nil {
		return nil, err
	}

	var ips []net.IP
	for ip := ip.Mask(ipnet.Mask); ipnet.Contains(ip); incIP(ip) {
		ipCopy := make(net.IP, len(ip))
		copy(ipCopy, ip)
		ips = append(ips, ipCopy)
	}

	if len(ips) > 2 {
		return ips[1 : len(ips)-1], nil
	}
	return ips, nil
}

func incIP(ip net.IP) {
	for j := len(ip) - 1; j >= 0; j-- {
		ip[j]++
		if ip[j] > 0 {
			break
		}
	}
}

func sendUDPPacket(ip net.IP, localIP string) {
	conn, err := net.Dial("udp", fmt.Sprintf("%s:631", ip.String()))
	if err != nil {
		log.Printf("Error connecting to %s: %v\n", ip, err)
		return
	}
	defer conn.Close()

	msg := fmt.Sprintf("0 3 http://%s:9180/printer/", localIP)
	if _, err := conn.Write([]byte(msg)); err != nil {
		log.Printf("Error sending packet to %s: %v\n", ip, err)
	}
	log.Printf("Sent request packet to %s.\n", ip)
}

func checkIfRunningAsRoot() {
	currentUser, err := user.Current()
	if err != nil {
		log.Fatalf("Failed to get current user: %v", err)
	}
	if currentUser.Uid != "0" {
		fmt.Println("This program must be run as root/administrator.")
		os.Exit(1)
	}
}

func main() {
	log.Println("Cups_Browsed Vulnerability Check Script - Nicholas Albright (@nma-io)")
    log.Println("Based off of the great research by Simone Margaritelli.")
	checkIfRunningAsRoot()
	localIP := flag.String("l", "", "Local IP address to use in the packet")
	targetRange := flag.String("t", "", "Target IP range in CIDR format (e.g., 192.168.1.0/24)")
	flag.Parse()

	if *localIP == "" || *targetRange == "" {
		fmt.Printf("Usage: sudo %s <local IP> -t <target CIDR>\n", os.Args[0])
		os.Exit(1)
	}

	go startHTTPListener()

	ips, err := parseIPRange(*targetRange)
	if err != nil {
		log.Fatalf("Failed to parse IP range: %v", err)
	}

	for _, ip := range ips {
		go sendUDPPacket(ip, *localIP) // No need to worry here - we can just blast each ip on the network. The CUPS server will ignore the packets if it's not vulnerable.
	}

	log.Println("Waiting 60 seconds for all hosts to respond...")
	time.Sleep(60 * time.Second)

	if len(vulnerableMachines) > 0 {
		log.Println("Vulnerable machines detected:")
		for _, machine := range vulnerableMachines {
			log.Println(machine)
		}
	} else {
		log.Println("No vulnerable machines detected.")
	}

	log.Println("Shutting down.")
}