webPromedium

Lab 343 — FrameCast — RCE via Ghostscript EPS Processing in Thumbnail Import

hackadvisor

Task: FrameCast video hosting platform with thumbnail import from URL; Pillow delegates EPS processing to Ghostscript 9.23 with -dSAFER. Solution: CVE-2018-16509 bypasses SAFER sandbox via failed restore in PostScript, enabling %pipe% command execution to exfiltrate /root/flag.txt through the web-accessible uploads directory.

flask ssrf rce pillow image_processing honeypot_flag interaction_server ghostscript postscript eps pipe_operator cve_2018_16509 thumbnail_import safer_bypass

honeypot_flag_detectionghostscript_safer_bypass_via_failed_restorepostscript_pipe_command_executionurl_import_ssrf_to_internal_serviceeps_rendering_to_ocr_exfiltrationinteraction_server_file_hosting

$ ls tags/ techniques/

flask ssrf rce pillow image_processing honeypot_flag interaction_server ghostscript postscript eps pipe_operator cve_2018_16509 thumbnail_import safer_bypass

honeypot_flag_detectionghostscript_safer_bypass_via_failed_restorepostscript_pipe_command_executionurl_import_ssrf_to_internal_serviceeps_rendering_to_ocr_exfiltrationinteraction_server_file_hosting

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups