How a Forgotten Office Printer Gave Us the Entire Network

Every security budget goes to the servers, the firewalls, the endpoints. Nobody, in the history of IT, has lain awake worrying about the printer. Which is precisely why, on engagement after engagement, the printer is where we get in. It is the device everyone owns, everyone uses, and nobody defends — and it is very often connected to more than anyone realises.

This is the story of one such box: a multifunction printer in a corner of an office that its owners had entirely forgotten was a computer at all. By the end of the afternoon it had handed us domain credentials and a route to the file server. Not through any clever exploit — through the sheer, total absence of anyone thinking about it.

The most invisible device on the network

A modern office printer is not a printer. It is a full Linux computer with a web server, a hard drive, network access, and often a permanent connection to the company's directory so it can offer "scan to email" and "scan to folder". It has an administrative web interface, and in the overwhelming majority of cases that interface still has its factory default password, because nobody ever imagined they needed to change it.

During enumeration, printers light up like beacons. They answer on well-known ports, they advertise their make and model, and a quick search tells you the default credentials for that exact device. Where a server might take real effort, the printer usually takes a browser and a password you found in a manual.

Finding the forgotten box# Printers announce themselves loudly
nmap -p 80,443,9100,515,631 --open 10.10.0.0/24

# The admin panel is usually just... there
# default creds for the model are a search away
curl -s http://10.10.0.50/ | grep -i "model"

From default password to credentials

Here is the part that turns a printer from a curiosity into a catastrophe. To offer "scan to folder", the printer needs an account on the network — usually a domain account — and it stores that account's credentials so it can log in and drop files. Those credentials sit in the printer's configuration, and an administrator who can log into the web panel can very often read them back, or trick the printer into revealing them.

In our case the printer's stored account was not some locked-down, single-purpose identity. It was a domain user with more access than it needed, because setting it up properly was more work than making it work, and "make it work" won. The moment we had those credentials, we were no longer looking at a printer. We were a legitimate user on the domain.

The pivot nobody expects

From a valid domain account, the rest followed the familiar path: enumerate what that account could reach, find the shares it could read, and discover that the "scan to folder" account had access to far more of the file server than a printer could ever need. Sensitive documents, internal shares, and enough of a foothold to keep escalating.

The client was stunned, and their reaction is the one I hear most often: "but it's just the printer". That phrase is exactly the vulnerability. The printer was trusted precisely because nobody thought about it, and that unthinking trust is what made it the perfect way in. Attackers do not attack the thing you defend; they attack the thing you forgot you had.

How the client should have stopped us

The fixes are almost embarrassingly simple, which is what makes the whole thing so common and so preventable. Change the default administrative password on every networked device, printers included — this one step would have stopped us at the front door. Give the "scan to folder" account the absolute minimum access it needs and nothing more, so that even if it leaks, it leaks almost nothing. Segment printers onto their own network so a compromised one cannot reach the servers. And include printers, cameras, badge readers, and every other "smart" device in your patching and inventory, because every one of them is a computer whether you treat it as one or not.

None of that requires budget. It requires remembering that the beige box in the corner is a networked computer with credentials on it, and defending it accordingly. On the exam and in the field, this is the lesson PenTest+ keeps teaching: the interesting attacks are rarely the exotic ones. They are the obvious ones against the things nobody was watching.

Why attackers love the overlooked

The printer is a specific example of a general truth that runs through every engagement: attackers do not go where the defences are strongest, they go where nobody is looking. Defenders naturally pour effort into the assets they consider important — the domain controllers, the customer database, the crown jewels — and that effort is exactly why those are rarely the way in. The way in is the thing considered too trivial to matter: the printer, the meeting-room display, the smart thermostat, the test server someone spun up two years ago and forgot. Each is a full computer on the network, and each is defended by the assumption that it is not worth attacking. That assumption is the vulnerability. A mature security programme inventories and defends everything with an IP address, precisely because the attacker's first move is to find the one device the inventory missed. The engagement is often won or lost on that completeness alone.

The next time you walk past the office printer, remember that it is a computer with a password and an account, sitting quietly on the same network as everything you care about. Treat it like one, and you close a door that attackers walk through more often than any firewall breach. Ignore it, and it will keep being the first domino — on the exam, and in the real world.