2 ms·

This is the book I am referring to. As for ghostscript, good point. Is it used enough even on the printer side to be exploitable, or you mean exploiting client

by 616c 10y ago

This is the book I am referring to. As for ghostscript, good point. Is it used enough even on the printer side to be exploitable, or you mean exploiting clients sending print jobs? I don't follow 100%.

GregBuchholz 10y ago
What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF
- 616c 10y ago
  I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
  - tacostakohashi 10y ago
    ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
    - 616c 10y ago
      That's what I thought. Thanks though, your comments are still very useful.

by 616c 10y ago

GregBuchholz 10y ago

What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF

616c 10y ago
I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
- tacostakohashi 10y ago
  ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
  - 616c 10y ago
    That's what I thought. Thanks though, your comments are still very useful.