0xdtc/ghost-5.58-arbitrary-file-read-cve-2023-40028CVE-2023-40028 affects Ghost, an open source content management system, where versions prior to 5.59.1 allow authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system.
This script exploits a vulnerability in Ghost CMS (CVE-2023-40028) to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system.
curl, , and basic Linux utilities installed on the attacker's system.zip./cve-2023-40028 -u <username> -p <password> -h <host_url>
-u <username>: The admin username for the target Ghost CMS.-p <password>: The admin password for the target Ghost CMS.-h <host_url>: The URL of the target Ghost CMS (e.g., http://127.0.0.1)../cve-2023-40028 -u admin -p admin123 -h http://127.0.0.1
Login: The script logs in to the Ghost CMS admin API and generates a session cookie.
Interactive File Reading: After successful login, you’ll enter an interactive shell:
WELCOME TO THE CVE-2023-40028 SHELL
Enter the file path to read (or type 'exit' to quit):
Input File Path:
Provide the absolute path of the file you want to read (e.g., /etc/passwd).
Receive File Content: The file's content will be fetched and displayed:
File content:
root:x:0:0:root:/root:/bin/bash
...
Exit the Shell:
Type exit to terminate the session.
Create Login Session:
Generate Malicious Payload:
mktemp to generate a temporary working directory.Upload Payload:
Read the File:
Cleanup:
This script is for educational and authorized penetration testing purposes only. Misuse of this script to target systems without explicit permission is illegal and unethical.
Let me know if you need further details or adjustments! 🚀