Retrieves configuration information from a Lexmark S300-S400 printer.
The Lexmark S302 responds to the NTPRequest version probe with its configuration. The response decodes as mDNS, so the request was modified to resemble an mDNS request as close as possible. However, the port (9100/udp) is listed as something completely different (HBN3) in documentation from Lexmark. See http://www.lexmark.com/vgn/images/portal/Security%20Features%20of%20Lexmark%20MFPs%20v1_1.pdf.
nmap -sU -p 9100 --script=lexmark-config <target>
Interesting ports on 192.168.1.111: PORT STATE SERVICE REASON 9100/udp unknown unknown unknown-response | lexmark-config: | IPADDRESS: 10.46.200.170 | IPNETMASK: 255.255.255.0 | IPGATEWAY: 10.46.200.2 | IPNAME: "ET0020006E4A37" | MACLAA: "000000000000" | MACUAA: "0004007652EC" | MDNSNAME: "S300-S400 Series (32)" | ADAPTERTYPE: 2 | IPADDRSOURCE: 1 | ADAPTERCAP: "148FC000" | OEMBYTE: 1 0 | PASSWORDSET: FALSE | NEWPASSWORDTYPE: TRUE | 1284STRID: 1 "S300-S400 Series" | CPDATTACHED: 1 1 | SECUREMODE: FALSE | PRINTERVIDPID: 1 "043d0180" |_ product=(S300-S400: Series)
Author: Patrik Karlsson
License: Same as Nmap--See https://nmap.org/book/man-legal.html