Script lexmark-config

Script types: portrule
Categories: discovery, safe
Download: https://svn.nmap.org/nmap/scripts/lexmark-config.nse

Script Summary

Retrieves configuration information from a Lexmark S300-S400 printer.

The Lexmark S302 responds to the NTPRequest version probe with its configuration. The response decodes as mDNS, so the request was modified to resemble an mDNS request as close as possible. However, the port (9100/udp) is listed as something completely different (HBN3) in documentation from Lexmark. See http://www.lexmark.com/vgn/images/portal/Security%20Features%20of%20Lexmark%20MFPs%20v1_1.pdf.

Example Usage

nmap -sU -p 9100 --script=lexmark-config <target>

Script Output 

Interesting ports on 192.168.1.111:
PORT     STATE   SERVICE REASON
9100/udp unknown unknown unknown-response
| lexmark-config:
|   IPADDRESS: 10.46.200.170
|   IPNETMASK: 255.255.255.0
|   IPGATEWAY: 10.46.200.2
|   IPNAME: "ET0020006E4A37"
|   MACLAA: "000000000000"
|   MACUAA: "0004007652EC"
|   MDNSNAME: "S300-S400 Series (32)"
|   ADAPTERTYPE: 2
|   IPADDRSOURCE: 1
|   ADAPTERCAP: "148FC000"
|   OEMBYTE: 1 0
|   PASSWORDSET: FALSE
|   NEWPASSWORDTYPE: TRUE
|   1284STRID: 1 "S300-S400 Series"
|   CPDATTACHED: 1 1
|   SECUREMODE: FALSE
|   PRINTERVIDPID: 1 "043d0180"
|_  product=(S300-S400: Series)

Requires

Author:

  • Patrik Karlsson

License: Same as Nmap--See https://nmap.org/book/man-legal.html