PostScript Undead: Pwning the web with a 35 year old language Jens - - PowerPoint PPT Presentation

▶
postscript undead
SMART_READER_LITE
LIVE PREVIEW

PostScript Undead: Pwning the web with a 35 year old language Jens - - PowerPoint PPT Presentation

Sep 15, 2023 478 likes •825 views

PostScript Undead: Pwning the web with a 35 year old language Jens Mller, Vladislav Mladenov, Dennis Felsch, Jrg Schwenk About @jensvoid Passionate bounty hunter Interests: IoT, web security Likes mixing old tech and new tech

slide-1
SLIDE 1

PostScript Undead:

Pwning the web with a 35 year old language

Jens Müller, Vladislav Mladenov, Dennis Felsch, Jörg Schwenk

slide-2
SLIDE 2
  • Passionate bounty hunter
  • Interests: IoT, web security
  • Likes mixing old tech and new tech

– Printer hacking – EFAIL attacks

About @jensvoid

2

slide-3
SLIDE 3
  • Remember ImageTragick?

Today: PostScript in the web

CVE-2016–3714

3

slide-4
SLIDE 4

Today: PostScript in the web

3

Web App

(/etc/passwd) (r) file root:x:0:0:root:/root:/bin/sh

PS

  • Similar attack surface
  • Impact: DoS, LFI, RCE
  • But much less known
slide-5
SLIDE 5

Today: PostScript in the web

3

Web App

PS

  • Similar attack surface
  • Impact: DoS, LFI, RCE
  • But much less known
slide-6
SLIDE 6
  • 1. Motivation
  • 2. Attacking websites
  • 3. Evaluation
  • 4. Mitigations

Overview

4

slide-7
SLIDE 7
  • Invented by Adobe (1982 – 1984)
  • Heavily used on laser printers

PostScript

5

slide-8
SLIDE 8
  • Invented by Adobe (1982 – 1984)

PostScript

5

  • Turing complete language
slide-9
SLIDE 9

%!PS /Helvetica 100 selectfont 50 500 moveto (Hello World) show showpage

Hello World Hello World

6

slide-10
SLIDE 10

Hello World

%!PS /Helvetica 100 selectfont 50 500 moveto product show showpage

GPL Ghostscript

6

slide-11
SLIDE 11

Hello World

%!PS /Helvetica 100 selectfont 50 500 moveto product show showpage

hp LaserJet 4250

6

slide-12
SLIDE 12
  • CPU:
  • Memory:
  • Storage:

Denial-of-Service (DoS) null (w) .tempfile {dup 0 write} loop {} loop {65535 array} loop

7

slide-13
SLIDE 13

Information disclosure

%!PS /Helvetica 100 selectfont 50 500 moveto pop show showpage

8

slide-14
SLIDE 14

Information disclosure jens

%!PS /Helvetica 100 selectfont 50 500 moveto pop show showpage

8

(USER) getenv

slide-15
SLIDE 15
  • Read, write, delete, list, stat
  • Depending on Ghostscript version, this is

somewhat restricted if -dSAFER is used

File system access

09

slide-16
SLIDE 16
  • RCE by design w/o –dSAFER

Shell command execution

10

slide-17
SLIDE 17
  • RCE by design w/o –dSAFER
  • Various -dSAFER bypasses

Shell command execution

10

slide-18
SLIDE 18

Content masking: example.pdf

11

slide-19
SLIDE 19
  • 1. Motivation
  • 2. Attacking websites
  • 3. Evaluation
  • 4. Mitigations

Overview

12

slide-20
SLIDE 20
  • Who process PostScript on the web?

– Conversion websites – Thumbnail preview

  • PDF is more common these days

– Can we embed PostScript in PDF? – Yes we can (four methods) Attacking websites with PS/EPS/AI

13

slide-21
SLIDE 21
  • What about `image only’ websites?
  • Vulnerable if ImageMagick used

– Has its own file format detection Attacking websites with images

14

slide-22
SLIDE 22

$img->resize()

Chain of escalation

15

slide-23
SLIDE 23

$img->resize() Imagick::resizeImage()

Chain of escalation

15

slide-24
SLIDE 24

$img->resize() Imagick::resizeImage() convert/libmagick++

Chain of escalation

15

slide-25
SLIDE 25

$img->resize() Imagick::resizeImage() convert/libmagick++ system('/usr/bin/gs')

Chain of escalation

15

slide-26
SLIDE 26

Chain of escalation

“Hey, I just wanted to resize an image...”

15

slide-27
SLIDE 27
  • Additional file type checks required
  • How do web applications do it?

– File extension – Content type – Convert file – File header Attacking websites

?

GIF89a… %PDF-1.2 %!PS

}≤1023 bytes

16

slide-28
SLIDE 28

Putting it all together

17

slide-29
SLIDE 29
  • 1. Motivation
  • 2. Attacking websites
  • 3. Evaluation
  • 4. Mitigations

Overview

18

slide-30
SLIDE 30

Evaluation: Conversion websites

19

slide-31
SLIDE 31

Evaluation: High value websites

RCE (no -dSAFER)

RCE (-dSAFER bypass)

Telekom GMX Box.com ZoHo 99Designs Steam Imgur Shutterstock Basecamp Evernote + 2 Bitcoin Exchanges

20

LFI (+list) Microsoft

slide-32
SLIDE 32
  • 1. Motivation
  • 2. Attacking websites
  • 3. Evaluation
  • 4. Mitigations

Overview

21

slide-33
SLIDE 33
  • If not required, do not execute PostScript

– Remove ImageMagick handlers (policy.xml) – PDF: Replace Ghostscript with Poppler

  • If required, use additional sandboxing

– chroot, firejail, seccomp, … Countermeasures

22

slide-34
SLIDE 34
  • PostScript must die!

Conclusion

Thank you! Questions?

Ghostscript exploitation:

http://bit.ly/gs-cheat-sheet