Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Focus on Linux
Re: SMB : TCP/445 impossible to sniff a document sent to be printed to a MS Spooler Server Aug 25 2005 09:14AM
no_spam me com
Hi,

Nothing to prove, it's already unencrypted :)

You can sniff the print job at two places:

or between PC->print_server on TCP/445
(RAW which is PS/TXT/PCL/ blabla or EMF in this case)

or between Print_server->Printer on TCP/515 (LPR) or TCP/9100(Raw printer)
(PS/TXT/PCL/HPGL/GDI/device dependent language in this case)

Depending on the print processor used in Windows,
sniffed print file (prn) will be either in PCL/TXT/PS/ .... (RAW print processor) or EMF

You have viewer for each type of file (dig internet ...)

For ex:
EMF: EMF VIEWER (Win32)
PS: GHOST SCRIPT/GHOST VIEW (LINUX/Win32)
PCL: REDTITAN or SWIFTVIEW (Win32)
...

HTH
Regards
traxx
=================================
Visit us at www.knowledgecave.com
=================================

[ reply ]







 

Privacy Statement
Copyright 2008, SecurityFocus