deardaniel/secdata-raw huggingface dataset:
Metasploit Module: SMBv3 Compression Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smb/cve_2020_0796_smbghost.rb
Platform: win
Disclosure date: 2020-03-13
References: CVE-2020-0796, URL-https://ricercasecurity.blogspot.com/2020/04/ill-ask-your-body-smbghost-pre-auth-rce.html, URL-https://github.com/chompie1337/SMBGhost_RCE_PoC, URL-https://www.youtube.com/watch?v=RSV3f6aEJFY&t=1865s, URL-https://www.coresecurity.com/core-labs/articles/getting-physical-extreme-abuse-of-intel-based-paging-systems, URL-https://www.coresecurity.com/core-labs/articles/getting-physical-extreme-abuse-of-intel-based-paging-systems-part-2-windows, URL-https://labs.bluefrostsecurity.de/blog/2017/05/11/windows-10-hals-heap-extinction-of-the-halpinterruptcontroller-table-exploitation-technique/
Targets: Windows 10 v1903-1909 x64

Description:
A vulnerability exists within the Microsoft Server Message Block 3.1.1 (SMBv3) protocol that can be leveraged to
          execute code on a vulnerable server. This remove exploit implementation leverages this flaw to execute code
          in the context of the kernel, finally yielding a session as NT AUTHORITY\SYSTEM in spoolsv.exe. Exploitation
          can take a few minutes as the necessary data is gathered.

Check method (fingerprinting):
begin
      client = RubySMB::Client.new(
        RubySMB::Dispatcher::Socket.new(connect(false)),
        username: '',
        password: '',
        smb1: false,
        smb2: false,
        smb3: true
      )
      protocol = client.negotiate
      client.disconnect!
    rescue Rex::Proto::SMB::Exceptions::Error, RubySMB::Error::RubySMBError
      return CheckCode::Unknown('SMB negotiation failed')
    rescue Errno::ECONNRESET
      return CheckCode::Unknown('Connection reset during SMB negotiation')
    rescue ::Exception => e # rubocop:disable Lint/RescueException
      vprint_error("#{rhost}: #{e.class} #{e}")
      return CheckCode::Unknown("Unexpected error during SMB negotiation: #{e.class}")
    end

    return CheckCode::Safe('Target does not support SMB3') unless protocol == 'SMB3'
    return CheckCode::Safe("Target SMB dialect #{client.dialect} is not 0x0311") unless client.dialect == '0x0311'

    lznt1_algorithm = RubySMB::SMB2::CompressionCapabilities::COMPRESSION_ALGORITHM_MAP.key('LZNT1')
    return CheckCode::Safe('Target does not support LZNT1 compression') unless client.server_compression_algorithms.include?(lznt1_algorithm)

    CheckCode::Detected('Target supports SMB 3.1.1 with LZNT1 compression')
  end
Metasploit Module: Novell NetIdentity Agent XTIERRPCPIPE Named Pipe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smb/netidentity_xtierrpcpipe.rb
Platform: win
Disclosure date: 2009-04-06
References: CVE-2009-1350, OSVDB-53351, BID-34400, URL-http://www.reversemode.com/index.php?option=com_content&task=view&id=62&Itemid=1

Description:
This module exploits a stack buffer overflow in Novell's NetIdentity Agent. When sending
          a specially crafted string to the 'XTIERRPCPIPE' named pipe, an attacker may be
          able to execute arbitrary code. The success of this module is much greater once the
          service has been restarted.
Metasploit Module: Group Policy Script Execution From Shared Resource
Type: exploit
Path: modules/exploits/windows/smb/group_policy_startup.rb
Platform: win
Disclosure date: 2015-01-26
References: URL-http://blog.gdssecurity.com/labs/2015/1/26/badsamba-exploiting-windows-startup-scripts-using-a-maliciou.html, URL-https://github.com/GDSSecurity/BadSamba
Targets: Windows x86, Windows x64

Description:
This is a general-purpose module for exploiting systems with Windows Group Policy
          configured to load VBS startup/logon scripts from remote locations. This module runs
          a SMB shared resource that will provide a payload through a VBS file. Startup scripts
          will be executed with SYSTEM privileges, while logon scripts will be executed with the
          user privileges. Have into account which the attacker still needs to redirect the
          target traffic to the fake SMB share to exploit it successfully. Please note in some
          cases, it will take 5 to 10 minutes to receive a session.
Metasploit Module: MS06-025 Microsoft RRAS Service RASMAN Registry Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms06_025_rasmans_reg.rb
Platform: win
Disclosure date: 2006-06-13
References: CVE-2006-2370, OSVDB-26437, BID-18325, MSB-MS06-025

Description:
This module exploits a registry-based stack buffer overflow in the Windows Routing
          and Remote Access Service. Since the service is hosted inside svchost.exe,
          a failed exploit attempt can cause other system services to fail as well.
          A valid username and password is required to exploit this flaw on Windows 2000.
          When attacking XP SP1, the SMBPIPE option needs to be set to 'SRVSVC'.
          Exploiting this flaw involves two distinct steps - creating the registry key
          and then triggering an overwrite based on a read of this key. Once the key is
          created, it cannot be recreated. This means that for any given system, you
          only get one chance to exploit this flaw. Picking the wrong target will require
          a manual removal of the following registry key before you can try again:
          HKEY_USERS\.DEFAULT\Software\Microsoft\RAS Phonebook
Metasploit Module: MS06-066 Microsoft Services nwwks.dll Module Exploit
Type: exploit
Path: modules/exploits/windows/smb/ms06_066_nwwks.rb
Platform: win
Disclosure date: 2006-11-14
References: CVE-2006-4688, OSVDB-30260, BID-21023, MSB-MS06-066

Description:
This module exploits a stack buffer overflow in the svchost service, when the netware
          client service is running. This specific vulnerability is in the nwapi32.dll module.
Metasploit Module: WebExec Authenticated User Code Execution
Type: exploit
Path: modules/exploits/windows/smb/webexec.rb
Platform: win
Disclosure date: 2018-10-24
References: URL-https://webexec.org, CVE-2018-15442

Description:
This module uses a valid username and password of any level (or
          password hash) to execute an arbitrary payload. This module is similar
          to the "psexec" module, except allows any non-guest account by default.
Metasploit Module: Microsoft Windows RRAS Service MIBEntryGet Overflow
Type: exploit
Path: modules/exploits/windows/smb/smb_rras_erraticgopher.rb
Platform: win
Disclosure date: 2017-06-13
References: CVE-2017-8461, BID-99012, EDB-41929, URL-https://www.securitytracker.com/id/1038701, URL-https://github.com/x0rz/EQGRP_Lost_in_Translation/blob/master/windows/exploits/Erraticgopher-1.0.1.0.xml, URL-https://support.microsoft.com/en-us/topic/microsoft-security-advisory-4025685-guidance-for-older-platforms-june-13-2017-05151e8a-bd7f-f769-43df-38d2c24f96cd, URL-https://docs.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa374540(v=vs.85), URL-https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/ebc5c709-36d8-4520-a0ac-6f36d2d6c0b2, URL-https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/5dca234b-bea4-4e67-958e-5459a32a7b71, URL-https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrasm/4305d67f-9273-49fe-a067-909b6ae8a341

Description:
This module exploits an overflow in the Windows Routing and Remote
          Access Service (RRAS) to execute code as SYSTEM.

          The RRAS DCERPC endpoint is accessible to unauthenticated users via
          SMBv1 browser named pipe on Windows Server 2003 and Windows XP hosts;
          however, this module targets Windows Server 2003 only.

          Since the service is hosted inside svchost.exe, a failed exploit
          attempt can cause other system services to fail as well.

          The module has been successfully tested on:

          Windows Server 2003 SP0 (x86);
          Windows Server 2003 SP1 (x86);
          Windows Server 2003 SP2 (x86); and
          Windows Server 2003 R2 SP2 (x86).

Check method (fingerprinting):
begin
      connect(versions: [1])
      smb_login
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
      if e.message.include?('Connection reset')
        return CheckCode::Unknown('Connection reset during login. This most likely means a previous exploit attempt caused the service to crash.')
      end

      return CheckCode::Safe("SMB error: #{e.message}")
    end

    handle = dcerpc_handle('8f09f000-b7ed-11ce-bbd2-00001a181cad', '0.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"])

    begin
      dcerpc_bind(handle)
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
      return CheckCode::Safe("SMB error: #{e.message}")
    end

    CheckCode::Detected('RRAS enabled and accessible.')
  end
Metasploit Module: MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)
Type: exploit
Path: modules/exploits/windows/smb/ms07_029_msdns_zonename.rb
Platform: win
Disclosure date: 2007-04-12
References: CVE-2007-1748, OSVDB-34100, MSB-MS07-029

Description:
This module exploits a stack buffer overflow in the RPC interface
          of the Microsoft DNS service. The vulnerability is triggered
          when a long zone name parameter is supplied that contains
          escaped octal strings. This module is capable of bypassing NX/DEP
          protection on Windows 2003 SP1/SP2. This module exploits the
          RPC service using the \DNSSERVER pipe available via SMB. This
          pipe requires a valid user account to access, so the SMBUSER
          and SMBPASS options must be specified.
Metasploit Module: MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability
Type: exploit
Path: modules/exploits/windows/smb/ms10_061_spoolss.rb
Platform: win
Disclosure date: 2010-09-14
References: OSVDB-67988, CVE-2010-2729, MSB-MS10-061, URL-https://www.tenable.com/plugins/nessus/49219

Description:
This module exploits the RPC service impersonation vulnerability detailed in
          Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the
          StartDocPrinter procedure, an attacker can impersonate the Printer Spooler service
          to create a file. The working directory at the time is %SystemRoot%\system32.
          An attacker can specify any file name, including directory traversal or full paths.
          By sending WritePrinter requests, an attacker can fully control the content of
          the created file.

          In order to gain code execution, this module writes to a directory used by Windows
          Management Instrumentation (WMI) to deploy applications. This directory (Wbem\Mof)
          is periodically scanned and any new .mof files are processed automatically. This is
          the same technique employed by the Stuxnet code found in the wild.
Metasploit Module: Microsoft Windows Shell LNK Code Execution
Type: exploit
Path: modules/exploits/windows/smb/ms10_046_shortcut_icon_dllloader.rb
Platform: win
Disclosure date: 2010-07-16
References: CVE-2010-2568, OSVDB-66387, MSB-MS10-046, URL-https://github.com/rapid7/metasploit-framework/pull/4911

Description:
This module exploits a vulnerability in the handling of Windows
          Shortcut files (.LNK) that contain an icon resource pointing to a
          malicious DLL. This creates an SMB resource to provide the payload
          inside a DLL, and generates a LNK file which must be sent to the
          target.
Metasploit Module: Timbuktu PlughNTCommand Named Pipe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smb/timbuktu_plughntcommand_bof.rb
Platform: win
Disclosure date: 2009-06-25
References: CVE-2009-1394, OSVDB-55436, BID-35496, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=809

Description:
This module exploits a stack based buffer overflow in Timbuktu Pro version <= 8.6.6
          in a pretty novel way.

          This exploit requires two connections. The first connection is used to leak stack data
          using the buffer overflow to overwrite the nNumberOfBytesToWrite argument. By supplying
          a large value for this argument it is possible to cause Timbuktu to reply to the initial
          request with leaked stack data. Using this data allows for reliable exploitation of the
          buffer overflow vulnerability.

          Props to Infamous41d for helping in finding this exploitation path.

          The second connection utilizes the data from the data leak to accurately exploit
          the stack based buffer overflow vulnerability.

          TODO:
          hdm suggested using meterpreter's migration capability and restarting the process
          for multishot exploitation.
Metasploit Module: MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms04_011_lsass.rb
Platform: win
Disclosure date: 2004-04-13
References: CVE-2003-0533, OSVDB-5248, BID-10108, MSB-MS04-011

Description:
This module exploits a stack buffer overflow in the LSASS service, this vulnerability
          was originally found by eEye. When re-exploiting a Windows XP system, you will need
          need to run this module twice. DCERPC request fragmentation can be performed by setting
          'FragSize' parameter.
Metasploit Module: IPass Control Pipe Remote Command Execution
Type: exploit
Path: modules/exploits/windows/smb/ipass_pipe_exec.rb
Platform: win
Disclosure date: 2015-01-21
References: CVE-2015-0925, OSVDB-117423, BID-72265, URL-http://codewhitesec.blogspot.de/2015/02/how-i-could-ipass-your-client-security.html
Targets: Windows x32, Windows x64

Description:
This module exploits a vulnerability in the IPass Client service. This service provides a
          named pipe which can be accessed by the user group BUILTIN\Users. This pipe can be abused
          to force the service to load a DLL from a SMB share.

Check method (fingerprinting):
echo_value = rand_text_alphanumeric(rand(10) + 10)

    begin
      response = send_command("System.Echo #{echo_value}")
      if response =~ Regexp.new(echo_value)
        return Exploit::CheckCode::Vulnerable('iPass pipe command execution confirmed')
      else
        return Exploit::CheckCode::Unknown('iPass pipe responded but echo test failed')
      end
    rescue Rex::ConnectionError => e
      vprint_error("Connection failed: #{e.class}: #{e}")
      return Msf::Exploit::CheckCode::Unknown('Connection failed')
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
      vprint_error("Error during login: #{e}")
      return Msf::Exploit::CheckCode::Unknown('Login failed')
    rescue Rex::Proto::SMB::Exceptions::ErrorCode, RubySMB::Error::RubySMBError => e
      vprint_error(e.to_s)
      return Msf::Exploit::CheckCode::Unknown('SMB error occurred')
    end
  end
Metasploit Module: MS06-066 Microsoft Services nwapi32.dll Module Exploit
Type: exploit
Path: modules/exploits/windows/smb/ms06_066_nwapi.rb
Platform: win
Disclosure date: 2006-11-14
References: CVE-2006-4688, OSVDB-30260, BID-21023, MSB-MS06-066

Description:
This module exploits a stack buffer overflow in the svchost service when the netware
          client service is running. This specific vulnerability is in the nwapi32.dll module.
Metasploit Module: MS04-031 Microsoft NetDDE Service Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms04_031_netdde.rb
Platform: win
Disclosure date: 2004-10-12
References: CVE-2004-0206, OSVDB-10689, BID-11372, MSB-MS04-031

Description:
This module exploits a stack buffer overflow in the NetDDE service, which is the
          precursor to the DCOM interface.  This exploit effects only operating systems
          released prior to Windows XP SP1 (2000 SP4, XP SP0). Despite Microsoft's claim
          that this vulnerability can be exploited without authentication, the NDDEAPI
          pipe is only accessible after successful authentication.
Metasploit Module: MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Code Execution
Type: exploit
Path: modules/exploits/windows/smb/ms17_010_psexec.rb
Platform: win
Disclosure date: 2017-03-14
References: MSB-MS17-010, CVE-2017-0143, CVE-2017-0146, CVE-2017-0147, URL-https://github.com/worawit/MS17-010, URL-https://hitcon.org/2017/CMT/slide-files/d2_s2_r0.pdf, URL-https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/

Description:
This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where
          primitive. This will then be used to overwrite the connection session information with as an
          Administrator session. From there, the normal psexec payload code execution is done.

          Exploits a type confusion between Transaction and WriteAndX requests and a race condition in
          Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy
          exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a
          named pipe.
Metasploit Module: MS06-025 Microsoft RRAS Service Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms06_025_rras.rb
Platform: win
Disclosure date: 2006-06-13
References: CVE-2006-2370, OSVDB-26437, BID-18325, MSB-MS06-025

Description:
This module exploits a stack buffer overflow in the Windows Routing and Remote
          Access Service. Since the service is hosted inside svchost.exe, a failed
          exploit attempt can cause other system services to fail as well. A valid
          username and password is required to exploit this flaw on Windows 2000.
          When attacking XP SP1, the SMBPIPE option needs to be set to 'SRVSVC'.
Metasploit Module: Microsoft Windows SMB Direct Session Takeover
Type: exploit
Path: modules/exploits/windows/smb/smb_shadow.rb
Platform: win
Disclosure date: 2021-02-16
References: URL-https://strontium.io/blog/introducing-windows-10-smb-shadow-attack

Description:
This module will intercept direct SMB authentication requests to
          another host, gaining access to an authenticated SMB session if
          successful. If the connecting user is an administrator and network
          logins are allowed to the target machine, this module will execute an
          arbitrary payload. To exploit this, the target system must try to
          autheticate to another host on the local area network.

          SMB Direct Session takeover is a combination of previous attacks.

          This module is dependent on an external ARP spoofer. The builtin ARP
          spoofer was not providing sufficient host discovery. Bettercap v1.6.2
          was used during the development of this module.

          The original SMB relay attack was first reported by Sir Dystic on March
          31st, 2001 at @lanta.con in Atlanta, Georgia.
Metasploit Module: Microsoft Windows Authenticated User Code Execution
Type: exploit
Path: modules/exploits/windows/smb/psexec.rb
Platform: win
Disclosure date: 1999-01-01
References: CVE-1999-0504, OSVDB-3106, URL-http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx, URL-https://www.optiv.com/blog/owning-computers-without-shell-access, URL-http://sourceforge.net/projects/smbexec/
Targets: Automatic, PowerShell, Native upload, MOF upload, Command

Description:
This module uses a valid administrator username and password (or
          password hash) to execute an arbitrary payload. This module is similar
          to the "psexec" utility provided by SysInternals. This module is now able
          to clean up after itself. The service created by this tool uses a randomly
          chosen name and description.
Metasploit Module: MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption
Type: exploit
Path: modules/exploits/windows/smb/ms17_010_eternalblue.rb
Platform: win
Disclosure date: 2017-03-14
References: MSB-MS17-010, CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148, URL-https://github.com/RiskSense-Ops/MS17-010, URL-https://risksense.com/wp-content/uploads/2018/05/White-Paper_Eternal-Blue.pdf, EDB-42030

Description:
This module is a port of the Equation Group ETERNALBLUE exploit, part of
          the FuzzBunch toolkit released by Shadow Brokers.

          There is a buffer overflow memmove operation in Srv!SrvOs2FeaToNt. The size
          is calculated in Srv!SrvOs2FeaListSizeToNt, with mathematical error where a
          DWORD is subtracted into a WORD. The kernel pool is groomed so that overflow
          is well laid-out to overwrite an SMBv1 buffer. Actual RIP hijack is later
          completed in srvnet!SrvNetWskReceiveComplete.

          This exploit, like the original may not trigger 100% of the time, and should be
          run continuously until triggered. It seems like the pool will get hot streaks
          and need a cool down period before the shells rain in again.

          The module will attempt to use Anonymous login, by default, to authenticate to perform the
          exploit. If the user supplies credentials in the SMBUser, SMBPass, and SMBDomain options it will use
          those instead.

          On some systems, this module may cause system instability and crashes, such as a BSOD or
          a reboot. This may be more likely with some payloads.
Metasploit Module: Outlook ATTACH_BY_REF_ONLY File Execution
Type: exploit
Path: modules/exploits/windows/email/ms10_045_outlook_ref_only.rb
Platform: win
Disclosure date: 2010-06-01
Authors: Yorick Koster <yorick[at]akitasecurity.nl>
References: MSB-MS10-045, CVE-2010-0266, OSVDB-66296, BID-41446, URL-http://www.akitasecurity.nl/advisory.php?id=AK20091001

Description:
It has been discovered that certain e-mail message cause Outlook to create Windows
          shortcut-like attachments or messages within Outlook. Through specially crafted TNEF
          streams with certain MAPI attachment properties, it is possible to set a path name
          to files to be executed. When a user double clicks on such an attachment or message,
          Outlook will proceed to execute the file that is set by the path name value. These
          files can be local files, but also files stored remotely (on a file share, for example)
          can be used. Exploitation is limited by the fact that it is not possible for attackers
          to supply command line options.
Metasploit Module: Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
Type: exploit
Path: modules/exploits/windows/email/ms07_017_ani_loadimage_chunksize.rb
Platform: win
Disclosure date: 2007-03-28
References: MSB-MS07-017, CVE-2007-0038, CVE-2007-1765, OSVDB-33629, BID-23194

Description:
This module exploits a buffer overflow vulnerability in the
          LoadAniIcon() function of USER32.dll. The flaw is triggered
          through Outlook Express by using the CURSOR style sheet
          directive to load a malicious .ANI file.

          This vulnerability was discovered by Alexander Sotirov of Determina
          and was rediscovered, in the wild, by McAfee.
Metasploit Module: Outlook ATTACH_BY_REF_RESOLVE File Execution
Type: exploit
Path: modules/exploits/windows/email/ms10_045_outlook_ref_resolve.rb
Platform: win
Disclosure date: 2010-06-01
Authors: Yorick Koster <yorick[at]akitasecurity.nl>
References: MSB-MS10-045, CVE-2010-0266, OSVDB-66296, BID-41446, URL-http://www.akitasecurity.nl/advisory.php?id=AK20091001

Description:
It has been discovered that certain e-mail message cause Outlook to create Windows
          shortcut-like attachments or messages within Outlook. Through specially crafted TNEF
          streams with certain MAPI attachment properties, it is possible to set a path name
          to files to be executed. When a user double clicks on such an attachment or message,
          Outlook will proceed to execute the file that is set by the path name value. These
          files can be local files, but also file stored remotely for example on a file share.
          Exploitation is limited by the fact that its is not possible for attackers to supply
          command line options.