Cybersecurity Researcher Exploits Ghostscript Vulnerability in Penetration Test, Demonstrates Full System Compromise

A cybersecurity researcher (NahamSec) was hired by a media company to conduct a high-impact penetration test targeting internal systems, databases, and customer data. The entry point was a file upload feature that converted uploaded files (e.g., SVG, EPS, PDF) into other formats, exploiting a known vulnerability in Ghostscript—a tool commonly used for such conversions. Using AI (ChatGPT), the researcher automated the identification of recent (last 3 years) remote code execution (RCE) and local file inclusion vulnerabilities with public proof-of-concept (POC) exploits, generating 14 candidate payloads for testing. After uploading malicious files, one payload succeeded, granting a shell on the staging server, where further reconnaissance revealed SSH keys and hardcoded database credentials in backup files. The attack culminated in accessing the customer database via MySQL, demonstrating full compromise. The video also showcased Teleport’s role in mitigating such attacks by replacing static SSH keys with short-lived, identity-based certificates. The engagement highlighted how initial access often relies on simple flaws, while lateral movement exploits misconfigured trust within internal networks.