Line Printer Daemon (LPD) - Port 515
Last updated
Was this helpful?
Last updated
Was this helpful?
Become VeryLazyTech ! 🎁
Follow us on:
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚
Port Number: 515
Service: Line Printer Daemon (LPD)
Common Usage: LPD is a network printing protocol used to manage print jobs on UNIX and Linux systems. It allows remote computers to submit print jobs to a central print server.
Default State: Open on many older UNIX/Linux distributions, but often disabled in modern systems.
Security Concerns:
Lacks authentication, allowing unauthorized access if improperly configured.
Susceptible to command injection and buffer overflow attacks.
Can be used for denial-of-service (DoS) attacks by sending large or malformed print jobs.
Print job manipulation may allow sensitive document interception.
LPD listens on port 515 and operates by receiving print job commands. You can interact with it manually using netcat or telnet:
If the connection is successful, LPD is running and ready for further enumeration.
You can also check the /etc/printcap file (if accessible) to see available printers:
Use Nmap to detect if the LPD service is running:
Expected output:
For a deeper scan using NSE scripts:
This will attempt to enumerate available printers and configurations.
If LPD is running, you can list print queues using:
If no authentication is required, this command may reveal active print jobs.
Try checking the configuration of remote printers:
If a printer is misconfigured, it might allow arbitrary command execution.
Anonymous Printing Abuse – If LPD is open and does not require authentication, an attacker can send unlimited print jobs, leading to resource exhaustion (Denial of Service).
Command Injection in Print Jobs – Certain LPD implementations allow escape sequences that can lead to remote code execution.
Directory Traversal – Some older LPD implementations allow path traversal, enabling an attacker to overwrite files outside the spool directory.
Print Job Interception – If an attacker gains access, they may be able to capture sensitive documents submitted for printing.
Send a large number of print jobs to overwhelm the system:
This fills the print queue, preventing legitimate users from printing.
Some LPD services allow malicious escape sequences that execute shell commands. Try submitting a print job with a malicious payload:
If successful, this opens a reverse shell on the target system.
Metasploit has modules that can exploit LPD misconfigurations:
This attempts to crash the LPD service.
Nmap – Scanning and service detection
LPQ / LPSTAT – Printer queue enumeration
Netcat (nc) – Manual interaction and exploitation
Hydra – Brute-force login attempts (if authentication is enabled)
Metasploit – LPD-specific exploits and auxiliary modules
Burp Suite – If a web-based printer management interface is available
If you gain access through LPD, check for SUID binaries to escalate privileges:
To maintain persistence, add an SSH key to the target machine:
If access is gained, look for spool files that contain document data:
Print jobs often contain PII (Personally Identifiable Information) or sensitive corporate data.
To secure against LPD exploitation: ✅ Disable LPD if not required:
✅ Restrict access using firewall rules:
✅ Enforce authentication for print jobs and disable guest access. ✅ Use modern alternatives like CUPS (Common Unix Printing System) with encrypted communication.
Learn & practice
Become VeryLazyTech ! 🎁
✖ Twitter .
👾 Github .
📜 Medium .
📺 YouTube .
📩 Telegram .
🕵️♂️ My Site .
Visit our for e-books and courses. 📚