HTB - Thermal Receipt

Sypnosis

I was dropped into a scenario involving a networked thermal receipt printer left behind at an abandoned Eastreach ration kiosk. My job was to dig through it and recover an authorization token that would let supplies move through Crownspire's sealed checkpoints. The service exposed to me was a raw printer protocol.

Description

Keir and his undercity runners recovered a forgotten Eastreach ration kiosk after Damas Marrowcairn sent clerks to strip the counting terminal and burn the paper ledger. They missed the networked thermal receipt printer bolted beneath the counter. This is a printer challenge, not a kiosk or web-application challenge: the exposed service speaks a raw printer protocol, so PRET in PJL mode is the intended starting point. If the printer still remembers the right transaction, it may hold the authorization token needed to move supplies through Crownspire sealed checkpoints.

Skills Required

• Basic familiarity with network service enumeration (raw TCP interaction)
• Understanding of printer control languages (PJL/PCL/PostScript) at a conceptual level
• Comfort navigating a filesystem-like shell environment

Skills Learned

• Using PRET (Printer Exploitation Toolkit) to interact with a networked printer in PJL mode
• Enumerating printer filesystems and storage volumes
• Understanding how electronic journals (EJ) retain transaction logs on POS/receipt printers
• Extracting and reading NVRAM (Non-Volatile RAM) contents from a printer to recover hidden data

Application Overview

What I was looking at was a RiverGate RG-T80II Thermal Receipt Printer, the kind of device you'd find bolted under a checkout counter. It exposed a raw printer protocol over the network rather than any web interface, and it had an electronic journal (EJ) feature enabled — meaning it kept a running log of past transactions, which is standard behavior for POS and receipt printers used for auditing purposes.¹

Technology Background

I knew going in that this wasn't a web or kiosk challenge — the description was explicit that I'd be speaking a raw printer protocol, and that PJL mode was the intended entry point. PJL (Printer Job Language) is what HP and compatible printers use for job control and device management, and it's the language PRET is built to abstract away.² Rather than hand-crafting PJL commands over netcat — which is slow and error-prone for filesystem traversal or memory dumps³ — I reached for PRET, since it gives me a filesystem-like shell for navigating printer storage, reading files, and dumping memory directly.²⁴

Enumeration

I started by connecting to the target using PRET in PJL mode:

./pret.py 154.57.164.70:32689 pjl

PRET identified the device for me right away as a RiverGate RG-T80II Thermal Receipt Printer, confirming I was dealing with real (emulated) printer firmware and not some generic web app wrapped around a printer theme.

From there I enumerated the printer's storage using the shell-like commands PRET gives me:

154.57.164.70:32689:/> ls
d        -   config
d        -   journal
-       97   readme.txt
d        -   spool

Reading readme.txt confirmed my suspicion: the electronic journal was enabled and stored under 0:/journal. That told me exactly where to look next.

I navigated into the journal directory and found five files sitting there:

154.57.164.70:32689:/journal> ls
-       17   last.txt
-      191   receipt_0000.txt
-      192   receipt_0001.txt
-      195   receipt_0002.txt
-      241   receipt_0003.txt

I read through the first three receipts and found nothing unusual — just standard transaction logs with plaintext authorization codes (RG-5812-OK, RG-4421-OK, RG-9014-OK). But receipt_0003.txt stood out immediately:

DATE: 2026-06-01 00:17:33
GATE: ASH-03
CARGO: BRINE FILTERS
SEAL FEE: 42.10
AUTH CODE: STORED IN NVRAM
NVRAM REF: EJ_AUTH_0421 ADDR=53264 LEN=60

This was my pivot point. The auth code wasn't sitting in the filesystem at all — it had been pushed into NVRAM, at address 53264, 60 bytes long. The filesystem had led me exactly where I needed to go next.

Solution

Finding the vulnerability

The "vulnerability" here wasn't a bug in the traditional sense — it was a design pattern I recognized from real-world printer deployments. Printers use NVRAM to persist configuration, job logs, and other sensitive data across reboots, and in the wild that memory often holds things like Wi-Fi passwords, SNMP community strings, or cached print jobs. This challenge leaned into that reality: instead of dropping the flag in a plaintext file, it tucked it away in memory, with the filesystem itself giving me the exact pointer I needed to go find it.

My reasoning chain went like this:

1. Context clue: The brief told me to use PRET in PJL mode and hinted the printer "still remembers the right transaction" — a clear nod toward persistent storage.
2. Filesystem dead end: Four of the five journal receipts were plain and complete, but the fifth withheld its auth code entirely, forcing me to look past the filesystem.
3. Explicit metadata: That same receipt handed me the NVRAM reference (EJ_AUTH_0421), the address (53264), and the length (60) — the object itself was pointing directly at the hidden data.
4. Tool choice: Since I now knew the data lived in NVRAM, PRET was clearly the right tool, since it handles memory dump formatting for me rather than requiring manual PJL scripting.

Exploitation

With the NVRAM reference in hand, I used PRET's built-in dump command to pull the printer's entire non-volatile memory to a local file:

154.57.164.70:32689:/> nvram dump
Writing copy to nvram/154.57.164.70:32689

Getting the flag

Opening the dump, I found the flag sitting right next to the printer's configuration and the EJ_AUTH_0421 reference I'd been chasing:

.MODEL=RG-T80II.FW=3.18EJOURNAL=ON...............EJ_LAST=0:/journal/receipt_0003.txt..EJ_AUTH_0421.HTB{REDACTED}..............

The printer really had remembered the right transaction — I just had to know where to look.

Flag:

HTB{REDACTED}

Key Takeaways

• Printer security is often overlooked. Networked printers frequently expose filesystem and memory access via PJL and other printer languages with little to no authentication.
• Electronic journals are treasure troves. POS printers retain transaction logs in NVRAM for compliance, and that means attackers can potentially extract sensitive business data or credentials from those logs.
• Follow the metadata. When a file references a memory address or another storage medium, I treat it as a direct pointer and go investigate immediately.

References