Skip to content

ghost-cms.md

Latest commit

 

History

History
72 lines (49 loc) · 3.01 KB

ghost-cms.md

File metadata and controls

72 lines (49 loc) · 3.01 KB
Raw

Ghost CMS

Headless CMS (Node.js). Often detected as "Ghost" + version in Wappalyzer/nuclei (e.g. Ghost 5.58). Admin panel: /ghost/#/signin.

No default credentials — the initial admin is created during setup at first access.

Discovery

  • Footer: "Powered by Ghost"
  • Admin: http://TARGET/ghost/#/signin
  • Nuclei: nuclei -u http://TARGET -rl 13 -c 12 -as can detect ghost-panel, metatag-cms (version), and CVE-2022-41697.
  • VHost enum: ffuf with -H "Host: FUZZ.target.htb" and -fs SIZE (baseline size) to find subdomains like dev.

CVE-2022-41697 (user enum / auth bypass)

Affects Ghost admin API session endpoint. Use Content-Type: application/json or the request may not be handled as expected.

User enumeration (e.g. with ffuf) can be done by fuzzing the username/email and filtering on response (e.g. -fr "Authorization failed" or -fc 403). Using a request file is often easier: save the POST request from Burp with FUZZ in the email, then:

ffuf -request users.req --request-proto http -w /usr/share/seclists/Usernames/Names/names.txt:FUZZ -fc 403

Authenticated file read (LFI)

With valid admin credentials, some exploits provide an interactive file-read shell (e.g. via Ghost API or theme/settings abuse):

python3 ghost_fileread.py -t http://TARGET -u 'admin@TARGET' -p 'PASSWORD'
# Then at file> prompt:
file> /etc/passwd
file> /var/lib/ghost/config.production.json

Config path (production): /var/lib/ghost/config.production.json. Contains url, server.port, database, and often mail with SMTP credentials (auth.user, auth.pass) that may be reused for SSH or other services.

Exposed .git on subdomain

If a subdomain (e.g. dev.TARGET) serves the app from a directory with exposed .git, you can try to recover the repo:

  • feroxbuster: feroxbuster -u http://dev.TARGET -E -g -w common.txt — look for /.git (301 → /.git/).
  • Dump .git: git-dumper (Python) often works when other tools fail: 
    python3 git_dumper.py http://dev.TARGET/.git /tmp/out
  • Staged changes / secrets: After cloning or extracting, check staged diff for hardcoded credentials: 
    git diff --cached
    (Without --cached, only unstaged changes are shown.) Test files or config in the repo may contain passwords.

Typical path to shell

  1. Enumerate vhosts (ffuf -fs), find e.g. dev.
  2. Find exposed .git on dev, dump with git-dumper, run git diff --cached for credentials.
  3. Or exploit CVE-2022-41697 / brute force Ghost admin.
  4. Log in to Ghost, use file-read (e.g. ghost_fileread.py) to read config.production.json and obtain mail or other creds.
  5. Reuse creds for SSH or next service.