Ghostscript -dSAFER sandbox bypass via invalidaccess privilege restoration

This repository contains a single Metasploit module: 'ghostscript_failed_restore.rb', which exploits CVE-2018-16509, a -dSAFER bypass in Ghostscript. The exploit allows arbitrary command execution by crafting a malicious PostScript file that, when processed by a vulnerable Ghostscript instance (often via libraries like ImageMagick), disables security restrictions and executes attacker-supplied commands. The module supports multiple platforms (Unix, Linux, Windows) and payload types (in-memory shell, PowerShell, Linux dropper). The main file is a standard Metasploit exploit module, leveraging Metasploit's FILEFORMAT, CmdStager, and Powershell mixins. The exploit generates a malicious 'msf.ps' file as output, which is intended to be delivered to the target for processing. The only notable endpoints are the generated PostScript file and a writable directory (default '/tmp') for Linux payloads. The module is weaponized, allowing for easy payload customization and delivery through the Metasploit framework.

This repository provides a Docker-based playground for exploiting CVE-2018-16509, a critical command execution vulnerability in Artifex Ghostscript versions prior to 9.24. The structure includes a Dockerfile that builds a CentOS 7 container, compiles Ghostscript 9.22 from source, and sets up the environment for testing. The README.md details the vulnerability, build and run instructions, and provides a step-by-step demonstration of the exploit using the Ghostscript interpreter. The exploit leverages crafted PostScript input to abuse the 'pipe' instruction, allowing arbitrary shell command execution as root. The main exploit is performed interactively within the container using the vulnerable Ghostscript binary. The repository includes the full Ghostscript 9.22 source and resources, but the exploit logic is described in the README and executed via command line. No network endpoints are exposed; the attack vector is local, requiring the attacker to supply malicious PostScript to the Ghostscript interpreter.

This repository is a proof-of-concept exploit for CVE-2018-16509, a vulnerability in Ghostscript (prior to v9.24) that allows remote code execution via a crafted EPS file. The repository contains a Flask web application (app.py) that allows users to upload images, which are then processed using the Python Pillow (PIL) library. If a specially crafted EPS file (disguised as a JPG, e.g., rce.jpg) is uploaded, Ghostscript is invoked during image processing, and the exploit payload is executed, allowing arbitrary shell command execution on the server. The Dockerfile and docker-compose.yml provide an isolated environment for testing the exploit. The main attack vector is via HTTP POST requests to the web application's root endpoint, where image uploads are handled. The exploit demonstrates successful code execution by creating a file (/tmp/got_rce) on the server. The repository is structured for easy testing and demonstration of the vulnerability, and is not weaponized for real-world attacks but serves as a clear proof-of-concept.