webPromedium
InkDrop
hackadvisor
Task: Flask blogging platform with Pillow-based image thumbnail generation; Ghostscript processes EPS content regardless of file extension. Solution: Upload EPS payload with .jpg extension exploiting CVE-2018-16509 (-dSAFER bypass via failed restore) to achieve RCE and exfiltrate /root/flag.txt.
$ ls tags/ techniques/
command_injectionflaskrcefile_uploadpillownginximage_processingghostscriptpostscriptepsthumbnail_generationcve_2018_16509safer_bypass
honeypot_flag_detectionghostscript_safer_bypass_via_failed_restoreeps_content_in_jpg_extension_bypassputdeviceprops_pipe_command_executiondynamic_path_discovery_for_exfiltrationpillow_eps_autodetection_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 126 — AssetForge — RCE via Ghostscript Pipe Device Bypass (CVE-2023-36664)— hackadvisor
- [web][Pro]Lab 343 — FrameCast — RCE via Ghostscript EPS Processing in Thumbnail Import— hackadvisor
- [web][Pro]Lab 324 — ImageMagick RCE (PixelForge)— hackadvisor
- [web][Pro]Lab 345 — PrintForge — RCE via Ghostscript Command Injection— hackadvisor
- [web][Pro]Photo Storage— miptctf