infosecn1nja
/
metasploit-framework
mirror of https://github.com/infosecn1nja/metasploit-framework.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update Ghostscript/ImageMagick modules

master
William Vu 2019-04-23 16:24:15 -05:00
parent c0e675abfb
commit 30b8625885
3 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
modules/exploits/multi/fileformat/ghostscript_failed_restore.rb
View File

@ -22,12 +22,7 @@ class MetasploitModule < Msf::Exploit
arbitrary commands by handling a failed restore (grestore) in arbitrary commands by handling a failed restore (grestore) in
PostScript to disable LockSafetyParams and avoid invalidaccess. PostScript to disable LockSafetyParams and avoid invalidaccess.
This vulnerability is reachable via libraries such as ImageMagick, This vulnerability is reachable via libraries such as ImageMagick.
and this module provides the latest vector for Ghostscript.
For previous Ghostscript vectors, please see the following modules:
exploit/unix/fileformat/ghostscript_type_confusion
exploit/unix/fileformat/imagemagick_delegate
}, },
'Author' => [ 'Author' => [
'Tavis Ormandy', # Vuln discovery and exploit 'Tavis Ormandy', # Vuln discovery and exploit
@ -61,7 +56,13 @@ class MetasploitModule < Msf::Exploit
'Type' => :linux_dropper 'Type' => :linux_dropper
] ]
], ],
'DefaultTarget' => 0 'DefaultTarget' => 0,
'Notes' => {
'RELATED' => [
'exploit/unix/fileformat/ghostscript_type_confusion',
'exploit/unix/fileformat/imagemagick_delegate'
]
}
)) ))
register_options([ register_options([

11
modules/exploits/unix/fileformat/ghostscript_type_confusion.rb
View File

@ -16,15 +16,12 @@ class MetasploitModule < Msf::Exploit
be exploited to obtain arbitrary command execution. This vulnerability affects be exploited to obtain arbitrary command execution. This vulnerability affects
Ghostscript versions 9.21 and earlier and can be exploited through libraries Ghostscript versions 9.21 and earlier and can be exploited through libraries
such as ImageMagick and Pillow. such as ImageMagick and Pillow.
For more recent Ghostscript vectors, please see the following modules:
exploit/multi/fileformat/ghostscript_failed_restore
}, },
'Author' => [ 'Author' => [
'Atlassian Security Team', # Vulnerability discovery 'Atlassian Security Team', # Vulnerability discovery
'hdm' # Metasploit module 'hdm' # Metasploit module
], ],
'References' => [ 'References' => [
%w{CVE 2017-8291}, %w{CVE 2017-8291},
%w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808}, %w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808},
%w{URL https://seclists.org/oss-sec/2017/q2/148}, %w{URL https://seclists.org/oss-sec/2017/q2/148},
@ -44,7 +41,11 @@ class MetasploitModule < Msf::Exploit
], ],
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'Notes' => { 'Notes' => {
'AKA' => [ 'ghostbutt' ] 'AKA' => ['ghostbutt'],
'RELATED' => [
'exploit/multi/fileformat/ghostscript_failed_restore',
'exploit/unix/fileformat/imagemagick_delegate'
]
} }
)) ))

12
modules/exploits/unix/fileformat/imagemagick_delegate.rb
View File

@ -25,10 +25,6 @@ class MetasploitModule < Msf::Exploit
Ghostscript versions 9.18 and later are affected. This target is Ghostscript versions 9.18 and later are affected. This target is
provided as is and will not be updated to track additional vulns. provided as is and will not be updated to track additional vulns.
For more recent Ghostscript vectors, please see the following modules:
exploit/multi/fileformat/ghostscript_failed_restore
exploit/unix/fileformat/ghostscript_type_confusion
If USE_POPEN is set to true, a |-prefixed command will be used for the If USE_POPEN is set to true, a |-prefixed command will be used for the
exploit. No delegates are involved in this exploitation. exploit. No delegates are involved in this exploitation.
}, },
@ -63,7 +59,13 @@ class MetasploitModule < Msf::Exploit
['PS file', template: 'msf.ps'] # PoC from taviso ['PS file', template: 'msf.ps'] # PoC from taviso
], ],
'DefaultTarget' => 0, 'DefaultTarget' => 0,
'Notes' => {'AKA' => ['ImageTragick']} 'Notes' => {
'AKA' => ['ImageTragick'],
'RELATED' => [
'exploit/unix/fileformat/ghostscript_type_confusion',
'exploit/multi/fileformat/ghostscript_failed_restore'
]
}
)) ))
register_options([ register_options([