How to save a copy of files that are sent to a printer?

[nuria24]

Hello, anyone know any software for Windows 7 that make/save a copy of all files that are sent to a printer?

Thanks!

[0E 800]

Joined to just ask that single question huh?

http://www.papercut.com/products/free_software/print_logger/

[nuria24]

Thanks but your reply, but it is only a logging print application. It.only give for example:

- the name of the user who printed,
- the total number of pages,
- document names and titles

But I am not looking that. I am looking a software that make a copy of all files that are sent to a printer. Copy file, not information about file. Thanks!

[0E 800]

Your going to have to leave the comforts of Windows for that.

http://blog.c22.cc/2010/11/23/printer-mitm-revisited-prn-2-me/

[Teapot]

Your going to have to leave the comforts of Windows for that.

http://blog.c22.cc/2010/11/23/printer-mitm-revisited-prn-2-me/

Your assuming that he is attempting this from a 3rd party machine.
If he is attempting to grab the files being sent from his computer/ a computer
he has access to it would be much easier just to hook the process and copy the
data.

this would require some programming and at least a little bit of win API knowledge.

[0E 800]

If he/she had access to the computers, it wouldnt be too difficult to find what was printed. He/she is not interested in logging, me thinks he/she just wants to cheat on homework.

Try this:

Procedure

To grab a print job from the Windows Spooler or captue a spooler file:

Go to "Printers and Faxes" and highlight the printer driver and right click and choose the printer "Properties".
Then click on the "Advanced" tab.
 Check mark the "Keep printed documents" box. See below:

 
 

The Windows Spooler will generate a SPL file and save it to:

C:\WINDOWS\system32\spool\PRINTERS”

Print the SPL file with:
http://www.lvbprint.de/html/splviewer1.html

When you open the SPL file, it will look like gibberish, but when you print it out, it will print out the original.

This program will open the SPL file for actually viewing:
http://splviewer.sourceforge.net/

[Teapot]

Oh shit a printer MiTM attack would actually a brilliant idea to steal tests and cheat sheets lol

[0E 800]

You could take it a step further and run a copy of srvdir.exe in the spooler folder so that you could grab the spl files remotely.

That way you can take your sick day at school during the test and see what the smartest kid printed out.

Come to school the next day ready to pass.

https://www.srvdir.net/

[nuria24]

Hello, I have access to computer, not like administrator but I can add a new admin account with any software, change the printer options and after delete the account.

I think that 0E 800 is the best option and easy to do.

Thanks for your help!

[proxx]

With a simple MITM on the printer you can just grab the raw bits and reconstruct those.
No need for no account.
Higher succes rate?
Leave something permanent on the network and fetch anything sent from anywhere, not likely to be noticed.

[nuria24]

What is a MITM?

I search on internet and it is Man-in-the-Middle and I read about it but I dont undertand how I can do a MITM attack about the printer.

I have access to computer but I dont know what to do about MITM.... and I need to be "online" when anyone is going to print, right? Also, I need a acces to the net of printer? Because there are 2 differentes nets and everyone have their own printer, so I only have access to one printer, not to the other printer where I can to copy the files.

Any software that check all printer avalaible on the net that I have access?

Thanks!

[backdoorexfil]

MiTM - Man-in-the-Middle (not always an attack)
Become the MiTM for the print server and intercept the print jobs. The print server may be the printer itself or a tertiary device between end users and the printer (typically seen on an enterprise-level domain).

You aren't actually "attacking" anything. You are intercepting. This technique was used by the Russians in the early 90's to intercept weapons' blueprints that were being sent over the wire from a US military base in the UK to a US-based large-scale printer. They intercepted the traffic on the wire, duplicated it and allowed it to pass through. No one questioned why the print jobs were taking 5 minutes longer than usual, especially when sending over telecoms.

[proxx]

MiTM - Man-in-the-Middle (not always an attack)
Become the MiTM for the print server and intercept the print jobs. The print server may be the printer itself or a tertiary device between end users and the printer (typically seen on an enterprise-level domain).

You aren't actually "attacking" anything. You are intercepting. This technique was used by the Russians in the early 90's to intercept weapons' blueprints that were being sent over the wire from a US military base in the UK to a US-based large-scale printer. They intercepted the traffic on the wire, duplicated it and allowed it to pass through. No one questioned why the print jobs were taking 5 minutes longer than usual, especially when sending over telecoms.

Thanks for putting that down I was too lazy to respond, thats pretty much dead-on.

[backdoorexfil]

Thanks proxx 

[xor]

In this case, you could have a software MITM, or a hardware MITM.


With software, you can:

• Copy the SPL files as they are created;
• Change the printer config so that it points to another IP, log, then forward on the traffic to the actual printer;
• Install the printer on a computer, share it, connect them to the shared printer instead.
• ARP Spoof the network and packet log.
• Modify the printer settings to store jobs on the internal hard drive for reprinting.
• More and more creative things.

With hardware, you could:

• Install a print server or custom logging device to intercept data
•                         v          RJ45 or USB        v                         
•      [Network] <-----> [LoggingDevice] <-----> Printer

Get creative.
There are a lot of ways to exfiltrate data.


-- xor