Ghost-CMS-Exploit

Ghost-CMS Exploit is python script. This script first performs brute-force authentication attempts using the provided wordlists. If valid credentials are found, it proceeds to check for CVE-2024-23724 vulnerability and generates an exploit payload if vulnerable.

Requirements:

1. Python 3.x installed
2. Install required library: pip install requests
3. A boilerplate.svg file in the same directory (used for generating the exploit payload)
4. Wordlist files for usernames and passwords

Usage:

python3 ghost-cms.py -U userlist.txt -P passlist.txt -t http://target-domain

Features:

1. Brute-force attack with progress reporting
2. Session management for successful logins
3. Automatic CVE-2024-23724 vulnerability check
4. SVG payload generation for confirmed vulnerabilities
5. Timeout handling for network requests
6. Error handling for file operations and network issues

Note:

• The target URL should be provided without the port (e.g., http://localhost)
• The script assumes Ghost CMS is running on port 3001
• Wordlist files should contain one credential per line
• The boilerplate.svg file should contain the appropriate placeholders used in the original script