## https://sploitus.com/exploit?id=3061357E-D2F6-5D0A-885D-77421FEE756B
# Ghost Arbitrary File Read Exploit (CVE-2023-40028)
### **Overview**
This script exploits a vulnerability in **Ghost CMS** (CVE-2023-40028) to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system.
---
### **Features**
1. Automates login to the Ghost CMS admin API.
2. Crafts a malicious ZIP payload with a symlink to the target file.
3. Exploits the Ghost CMS import functionality to upload and extract the payload.
4. Fetches and displays the contents of the target file.
---
### **Requirements**
- Access to the target Ghost CMS instance (credentials required).
- `curl`, `zip`, and basic Linux utilities installed on the attacker's system.
---
### **Usage**
```bash
./cve-2023-40028 -u -p -h
```
#### **Arguments**
- `-u `: The admin username for the target Ghost CMS.
- `-p `: The admin password for the target Ghost CMS.
- `-h `: The URL of the target Ghost CMS (e.g., `http://127.0.0.1`).
---
### **Example Usage**
```bash
./cve-2023-40028 -u admin -p admin123 -h http://127.0.0.1
```
1. **Login**:
The script logs in to the Ghost CMS admin API and generates a session cookie.
2. **Interactive File Reading**:
After successful login, you’ll enter an interactive shell:
```plaintext
WELCOME TO THE CVE-2023-40028 SHELL
Enter the file path to read (or type 'exit' to quit):
```
3. **Input File Path**:
Provide the absolute path of the file you want to read (e.g., `/etc/passwd`).
4. **Receive File Content**:
The file's content will be fetched and displayed:
```plaintext
File content:
root:x:0:0:root:/root:/bin/bash
...
```
5. **Exit the Shell**:
Type `exit` to terminate the session.
---
### **Workflow**
1. **Create Login Session**:
- Authenticates using the provided username and password.
- Stores the session cookie.
2. **Generate Malicious Payload**:
- Creates a symlink in a ZIP file pointing to the target file.
- Uses `mktemp` to generate a temporary working directory.
3. **Upload Payload**:
- Uploads the ZIP file to the Ghost CMS database import endpoint.
4. **Read the File**:
- Accesses the symlinked file through the extracted path.
5. **Cleanup**:
- Deletes the temporary payload and ZIP file after each request.
---
### **Disclaimer**
This script is for **educational and authorized penetration testing purposes only**. Misuse of this script to target systems without explicit permission is illegal and unethical.
---
### **References**
- [CVE-2023-40028](https://vulners.com/cve/CVE-2023-40028)
- [Ghost CMS Documentation](https://ghost.org/docs/)
---
Let me know if you need further details or adjustments! 🚀