deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Samba chain_reply Memory Corruption (Linux x86)
Type: exploit
Path: modules/exploits/linux/samba/chain_reply.rb
Platform: linux
Disclosure date: 2010-06-16
References: CVE-2010-2063, OSVDB-65518, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=873

Description:
This exploits a memory corruption vulnerability present in Samba versions
          prior to 3.3.13. When handling chained response packets, Samba fails to validate
          the offset value used when building the next part. By setting this value to a
          number larger than the destination buffer size, an attacker can corrupt memory.
          Additionally, setting this value to a value smaller than 'smb_wct' (0x24) will
          cause the header of the input buffer chunk to be corrupted.

          After close inspection, it appears that 3.0.x versions of Samba are not
          exploitable. Since they use an "InputBuffer" size of 0x20441, an attacker cannot
          cause memory to be corrupted in an exploitable way. It is possible to corrupt the
          heap header of the "InputBuffer", but it didn't seem possible to get the chunk
          to be processed again prior to process exit.

          In order to gain code execution, this exploit attempts to overwrite a "talloc
          chunk" destructor function pointer.

          This particular module is capable of exploiting the flaw on x86 Linux systems
          that do not have the nx memory protection.

          NOTE: It is possible to make exploitation attempts indefinitely since Samba forks
          for user sessions in the default configuration.
Metasploit Module: Samba lsa_io_trans_names Heap Overflow
Type: exploit
Path: modules/exploits/linux/samba/lsa_transnames_heap.rb
Platform: linux
Disclosure date: 2007-05-14
References: CVE-2007-2446, OSVDB-34699
Targets: Linux vsyscall, Linux Heap Brute Force (Debian/Ubuntu), Linux Heap Brute Force (Gentoo), Linux Heap Brute Force (Mandriva), Linux Heap Brute Force (RHEL/CentOS), Linux Heap Brute Force (SUSE), Linux Heap Brute Force (Slackware), Linux Heap Brute Force (OpenWRT MIPS), DEBUG

Description:
This module triggers a heap overflow in the LSA RPC service
          of the Samba daemon. This module uses the TALLOC chunk overwrite
          method (credit Ramon and Adriano), which only works with Samba
          versions 3.0.21-3.0.24. Additionally, this module will not work
          when the Samba "log level" parameter is higher than "2".

Check method (fingerprinting):
connect(versions: [1])
    smb_login
    disconnect

    if smb_peer_lm =~ /Samba/i
      return CheckCode::Detected
    end

    CheckCode::Safe
  rescue StandardError => e
    return CheckCode::Unknown("Unable to determine: #{e.class} - #{e.message}")
  end
Metasploit Module: UoW IMAP Server LSUB Buffer Overflow
Type: exploit
Path: modules/exploits/linux/imap/imap_uw_lsub.rb
Platform: linux
Disclosure date: 2000-04-16
References: CVE-2000-0284, OSVDB-12037, BID-1110, EDB-284

Description:
This module exploits a buffer overflow in the 'LSUB'
          command of the University of Washington IMAP service.
          This vulnerability can only be exploited with a valid username
          and password.

Check method (fingerprinting):
connect
    disconnect

    if banner =~ /IMAP4rev1 v12\.264/
      return CheckCode::Appears('IMAP4rev1 v12.264')
    end

    CheckCode::Safe
  end
Metasploit Module: PostgreSQL for Linux Payload Execution
Type: exploit
Path: modules/exploits/linux/postgres/postgres_payload.rb
Platform: linux
Disclosure date: 2007-06-05
References: CVE-2007-3280, URL-https://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
Targets: Linux x86, Linux x86_64

Description:
On some default Linux installations of PostgreSQL, the
          postgres service account may write to the /tmp directory, and
          may source UDF Shared Libraries from there as well, allowing
          execution of arbitrary code.

          This module compiles a Linux shared object file, uploads it to
          the target host via the UPDATE pg_largeobject method of binary
          injection, and creates a UDF (user defined function) from that
          shared object. Because the payload is run as the shared object's
          constructor, it does not need to conform to specific Postgres
          API versions.

Check method (fingerprinting):
version = postgres_fingerprint

    if version[:auth]
      return CheckCode::Appears
    end

    CheckCode::Safe("Authentication failed. #{version[:preauth] || version[:unknown]}")
  end
Metasploit Module: eScan Web Management Console Command Injection
Type: exploit
Path: modules/exploits/linux/antivirus/escan_password_exec.rb
Platform: linux
Disclosure date: 2014-04-04
References: CVE-2014-125118, URL-http://www.joxeankoret.com/download/breaking_av_software-pdf.tar.gz

Description:
This module exploits a command injection vulnerability found in the eScan Web Management
          Console. The vulnerability exists while processing CheckPass login requests. An attacker
          with a valid username can use a malformed password to execute arbitrary commands. With
          mwconf privileges, the runasroot utility can be abused to get root privileges. This module
          has been tested successfully on eScan 5.5-2 on Ubuntu 12.04.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path.to_s, 'index.php')
    })

    if res && (res.code == 200) && res.body =~ (/eScan WebAdmin/)
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Unknown
  end
Metasploit Module: Snort Back Orifice Pre-Preprocessor Buffer Overflow
Type: exploit
Path: modules/exploits/linux/ids/snortbopre.rb
Platform: linux
Disclosure date: 2005-10-18
Authors: KaiJern Lau <xwings[at]mysec.org>
References: CVE-2005-3252, OSVDB-20034, BID-15131

Description:
This module exploits a stack buffer overflow in the Back Orifice pre-processor module
          included with Snort versions 2.4.0, 2.4.1, 2.4.2, and 2.4.3. This vulnerability could
          be used to completely compromise a Snort sensor, and would typically gain an attacker
          full root or administrative privileges.
Metasploit Module: AlienVault OSSIM av-centerd Command Injection
Type: exploit
Path: modules/exploits/linux/ids/alienvault_centerd_soap_exec.rb
Platform: unix
Disclosure date: 2014-05-05
References: CVE-2014-3804, BID-67999, ZDI-14-202, URL-http://forums.alienvault.com/discussion/2690

Description:
This module exploits a code execution flaw in AlienVault 4.6.1 and
          prior.  The vulnerability exists in the av-centerd SOAP web service,
          where the update_system_info_debian_package method uses perl backticks
          in an insecure way, allowing command injection. This module has been
          tested successfully on AlienVault 4.6.0.

Check method (fingerprinting):
res = send_soap_request('get_dpkg')

    return CheckCode::Unknown('Connection failed') unless res

    version = ''
    if res.code == 200 &&
       res.headers['SOAPServer'] &&
       res.headers['SOAPServer'] =~ /SOAP::Lite/ &&
       res.body.to_s =~ /alienvault-center\s*([\d.]*)-\d/

      version = ::Regexp.last_match(1)
    end

    return CheckCode::Unknown('Could not determine AlienVault version') if version.blank?

    if version >= '4.7.0'
      return CheckCode::Safe("AlienVault version #{version} is not vulnerable")
    end

    CheckCode::Appears("AlienVault version #{version} appears vulnerable")
  end
Metasploit Module: Poptop Negative Read Overflow
Type: exploit
Path: modules/exploits/linux/pptp/poptop_negative_read.rb
Platform: linux
Disclosure date: 2003-04-09
Authors: spoonm
References: CVE-2003-0213, OSVDB-3293, URL-https://web.archive.org/web/[PII_REDACTED]4041/http://securityfocus.com/archive/1/317995, URL-https://web.archive.org/web/[PII_REDACTED]4830/http://www.freewebs.com/blightninjas/

Description:
This is an exploit for the Poptop negative read overflow.  This will
          work against versions prior to 1.1.3-b3 and 1.1.3-20030409, but I
          currently do not have a good way to detect Poptop versions.

          The server will by default only allow 4 concurrent manager processes
          (what we run our code in), so you could have a max of 4 shells at once.

          Using the current method of exploitation, our socket will be closed
          before we have the ability to run code, preventing the use of Findsock.

Check method (fingerprinting):
connect
    sock.put(build_packet(156))
    res = sock.get_once

    if res && res =~ /MoretonBay/
      return CheckCode::Detected
    end

    CheckCode::Safe
  end
Metasploit Module: Netcore Router Udp 53413 Backdoor
Type: exploit
Path: modules/exploits/linux/misc/netcore_udp_53413_backdoor.rb
Platform: linux
Disclosure date: 2014-08-25
References: CVE-2025-34117, URL-https://www.seebug.org/vuldb/ssvid-90227, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/netis-routers-leave-wide-open-backdoor/, URL-https://github.com/h00die/MSF-Testing-Scripts/blob/master/netis_backdoor.py
Targets: MIPS Little Endian, MIPS Big Endian

Description:
Routers manufactured by Netcore, a popular brand for networking
          equipment in China, have a wide-open backdoor that can be fairly
          easily exploited by attackers. These products are also sold under
          the Netis brand name outside of China. This backdoor allows
          cyber criminals to easily run arbitrary code on these routers,
          rendering it vulnerable as a security device.
          Some models include a non-standard echo command which doesn't
          honor -e, and are therefore not currently exploitable with
          Metasploit.  See URLs or module markdown for additional options.

Check method (fingerprinting):
connect_udp
    authenticate
    resp = []
    tmp_file = Rex::Text.rand_text_alpha(5)
    # we need to test the echo command to see if it plays nice
    ["echo -en #{tmp_file} > /tmp/#{tmp_file}", "cat /tmp/#{tmp_file}"].each do |command|
      send_command(command)
      resp << udp_sock.get(timeout)
    end
    disconnect_udp
    resp_str = resp.join(',')
    # check if we got a good response back
    if resp.length >= 1 && resp_str.include?("\x00\x00\x00\x05") && resp_str.include?(tmp_file)
      # some routers have a non-standard echo which doesn't support -en, so we need to detect that
      if resp_str.include?('en ')
        print_status('Router backdoor triggered, but non-exploitable echo command detected.  Not currently exploitable with Metasploit.')
        Exploit::CheckCode::Detected
      else
        Exploit::CheckCode::Vulnerable
      end
    else
      Exploit::CheckCode::Safe
    end
  end
Metasploit Module: HP Data Protector 6 EXEC_CMD Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-02-07
References: CVE-2011-0923, OSVDB-72526, ZDI-11-055, URL-http://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux, URL-https://community.rapid7.com/thread/2253

Description:
This exploit abuses a vulnerability in the HP Data Protector service. This
          flaw allows an unauthenticated attacker to take advantage of the EXEC_CMD
          command and traverse back to /bin/sh, this allows arbitrary remote code
          execution under the context of root.
Metasploit Module: HP Jetdirect Path Traversal Arbitrary Code Execution
Type: exploit
Path: modules/exploits/linux/misc/hp_jetdirect_path_traversal.rb
Platform: unix
Disclosure date: 2017-04-05
References: CVE-2017-2741, URL-https://support.hp.com/lt-en/document/c05462914, URL-http://tenable.com/blog/rooting-a-printer-from-security-bulletin-to-remote-code-execution

Description:
The module exploits a path traversal via Jetdirect to gain arbitrary code execution by
          writing a shell script that is loaded on startup to /etc/profile.d. Then, the printer
          is restarted using SNMP. Impacted printers:
          HP PageWide Managed MFP P57750dw
          HP PageWide Managed P55250dw
          HP PageWide Pro MFP 577z
          HP PageWide Pro 552dw
          HP PageWide Pro MFP 577dw
          HP PageWide Pro MFP 477dw
          HP PageWide Pro 452dw
          HP PageWide Pro MFP 477dn
          HP PageWide Pro 452dn
          HP PageWide MFP 377dw
          HP PageWide 352dw
          HP OfficeJet Pro 8730 All-in-One Printer
          HP OfficeJet Pro 8740 All-in-One Printer
          HP OfficeJet Pro 8210 Printer
          HP OfficeJet Pro 8216 Printer
          HP OfficeJet Pro 8218 Printer

          Please read the module documentation regarding the possibility for leaving an
          unauthenticated telnetd service running as a side effect of this exploit.
Metasploit Module: IGEL OS Secure VNC/Terminal Command Injection RCE
Type: exploit
Path: modules/exploits/linux/misc/igel_command_injection.rb
Platform: linux
Disclosure date: 2021-02-25
References: CVE-2025-34082, URL-https://kb.igel.com/securitysafety/en/isn-2021-01-igel-os-remote-command-execution-vulnerability-41449239.html, URL-https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt
Targets: Secure Terminal Service, Secure Shadow Service

Description:
This module exploits a command injection vulnerability in IGEL OS Secure Terminal
          and Secure Shadow services.

          Both Secure Terminal (telnet_ssl_connector - 30022/tcp) and Secure
          Shadow (vnc_ssl_connector - 5900/tcp) services are vulnerable.

Check method (fingerprinting):
probe = '<igel_scan></igel_scan>'

    connect_udp(true, 'RPORT' => 30005)
    udp_sock.put(probe)
    res = udp_sock.recvfrom(65535, 0.5)
    disconnect_udp

    unless res && res[0]
      return Exploit::CheckCode::Unknown
    end

    probe_response = res[0]
    matches = probe_response.match(/firmwareversion=<([0-9.]+)>/)
    unless matches
      return Exploit::CheckCode::Unknown
    end

    version = matches.captures[0]
    vprint_status("IGEL OS Version: #{version}")
    version = Rex::Version.new(version)

    if version < Rex::Version.new('10.06.220') && version >= Rex::Version.new('10.0.0')
      return Exploit::CheckCode::Appears
    elsif version < Rex::Version.new('11.04') && version >= Rex::Version.new('11.03.620')
      return Exploit::CheckCode::Safe
    elsif version < Rex::Version.new('11.04.270') && version >= Rex::Version.new('11.0.0')
      return Exploit::CheckCode::Appears
    end

    return Exploit::CheckCode::Safe
  end
Metasploit Module: Zyxel IKE Packet Decoder Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/zyxel_ike_decoder_rce_cve_2023_28771.rb
Platform: %w[unix linux
Disclosure date: 2023-03-31
References: CVE-2023-28771, URL-https://attackerkb.com/topics/N3i8dxpFKS/cve-2023-28771/rapid7-analysis, URL-https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-remote-command-injection-vulnerability-of-firewalls

Description:
This module exploits a remote unauthenticated command injection vulnerability in the Internet Key Exchange
          (IKE) packet decoder over UDP port 500 on the WAN interface of several Zyxel devices. The affected devices are
          as follows: ATP (Firmware version 4.60 to 5.35 inclusive), USG FLEX (Firmware version 4.60 to 5.35 inclusive),
          VPN (Firmware version 4.60 to 5.35 inclusive), and ZyWALL/USG (Firmware version 4.60 to 4.73 inclusive). The
          affected devices are vulnerable in a default configuration and command execution is with root privileges.

Check method (fingerprinting):
connect_udp

    # Check for the Internet Key Exchange (IKE) service by sending an IKEv1 header with no payload. We can
    # expect to receive an IKE reply containing a Notification payload with a PAYLOAD-MALFORMED message.

    # In a default configuration, there appears no known method to identify the platform vendor or version
    # number, so we cannot identify a CheckCode other than CheckCode::Detected or CheckCode::Unknown.
    # If a VPN is configured on the target device, we may receive a Vendor ID corresponding to Zyxel, but we
    # still would not be able to identify the version number of the target service.

    ikev2_header = Rex::Text.rand_text_alpha_upper(8) # Initiator SPI
    ikev2_header << [0, 0, 0, 0, 0, 0, 0, 0].pack('C*') # Responder SPI
    ikev2_header << [0].pack('C') # Next Payload: None - 0
    ikev2_header << [16].pack('C') # Version: 1.0 - 16 (0x10)
    ikev2_header << [2].pack('C') # Exchange Type: Identity Protection - 2
    ikev2_header << [0].pack('C') # Flags: None - 0
    ikev2_header << [0].pack('N') # ID: 0
    ikev2_header << [ikev2_header.length + 4].pack('N') # Length

    udp_sock.put(ikev2_header)

    ikev2_reply = udp_sock.get(udp_sock.def_read_timeout)

    disconnect_udp

    if !ikev2_reply.empty? && (ikev2_reply.length >= 40) &&
       # Ensure the response 'Initiator SPI' field is the same as the original one sent.
       (ikev2_reply[0, 8] == ikev2_header[0, 8]) &&
       # Ensure the 'Next Payload' field is Notification (11)
Metasploit Module: Unitrends UEB bpserverd authentication bypass RCE
Type: exploit
Path: modules/exploits/linux/misc/ueb9_bpserverd.rb
Platform: linux
Disclosure date: 2017-08-08
References: URL-https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcZeAAK/000005755, URL-https://nvd.nist.gov/vuln/detail/CVE-2017-12477, CVE-2017-12477

Description:
It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd,
          has an issue in which its authentication can be bypassed.  A remote attacker could use this
          issue to execute arbitrary commands with root privilege on the target system.

Check method (fingerprinting):
s1 = connect(global = false)
    buf1 = s1.get_once(-1).to_s
    # parse out the bpd port returned
    bpd_port = buf1[-8..-3].to_i

    # check if it's a valid port number (1-65534)
    if bpd_port && bpd_port >= 1 && bpd_port <= 65535
      Exploit::CheckCode::Detected('Target service detected on expected port')
    else
      Exploit::CheckCode::Safe('Target did not return a valid port number')
    end
  ensure
    disconnect(s1) if s1
  end
Metasploit Module: Zabbix Server Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/misc/zabbix_server_exec.rb
Platform: unix
Disclosure date: Sep 10 2009
References: CVE-2009-4498, OSVDB-60965, BID-37989, EDB-10432, URL-https://support.zabbix.com/browse/ZBX-1030

Description:
This module abuses the "Command" trap in Zabbix Server to execute arbitrary
          commands without authentication. By default the Node ID "0" is used, if it doesn't
          work, the Node ID is leaked from the error message and exploitation retried.

          According to the vendor versions prior to 1.6.9 are vulnerable. The vulnerability
          has been successfully tested on Zabbix Server 1.6.7 on Ubuntu 10.04.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    node_id = 0
    clue = Rex::Text.rand_text_alpha(rand(5) + 5)
    cmd = "echo #{clue}"

    connect
    vprint_status("Sending 'Command' request...")
    res = send_command(sock, node_id, cmd)
    disconnect

    if res
      vprint_status(res)
      if res =~ /#{clue}/
        return Exploit::CheckCode::Vulnerable
      elsif res =~ /-1/ and res =~ /NODE (\d*)/
        node_id = $1
        vprint_good("Node ID #{node_id} discovered")
      else
        return Exploit::CheckCode::Safe
      end
    else # No response
      return Exploit::CheckCode::Unknown('No response received from the target')
    end

    # Retry with the good node_id
    connect
    vprint_status("Sending 'Command' request with discovered Node ID...")
    res = send_command(sock, node_id, cmd)
    disconnect
    if res and res =~ /#{clue}/
      return Exploit::CheckCode::Vulnerable
    end

    return Exploit::CheckCode::Safe
  end
Metasploit Module: Novell eDirectory 8 Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/novell_edirectory_ncp_bof.rb
Platform: linux
Disclosure date: 2012-12-12
References: CVE-2012-0432, OSVDB-88718, BID-57038, EDB-24205, URL-http://www.novell.com/support/kb/doc.php?id=3426981, URL-https://seclists.org/fulldisclosure/2013/Jan/97

Description:
This exploit abuses a buffer overflow vulnerability in Novell eDirectory. The
          vulnerability exists in the ndsd daemon, specifically in the NCP service, while
          parsing a specially crafted Keyed Object Login request. It allows remote code
          execution with root privileges.

Check method (fingerprinting):
connect
    sock.put(connection_request)
    res = sock.get_once(-1, 10)
    disconnect
    if res.nil? or res[8, 2].unpack("n")[0] != 0x3333 or res[15, 1].unpack("C")[0] != 0
      # res[8,2] => Reply Type
      # res[15,1] => Connection Status
      return Exploit::CheckCode::Safe
    end

    return Exploit::CheckCode::Detected
  end
Metasploit Module: GLD (Greylisting Daemon) Postfix Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/gld_postfix.rb
Platform: linux
Disclosure date: 2005-04-12
References: CVE-2005-1099, OSVDB-15492, BID-13129, EDB-934

Description:
This module exploits a stack buffer overflow in the Salim Gasmi
          GLD <= 1.4 greylisting daemon for Postfix. By sending an
          overly long string the stack can be overwritten.
Metasploit Module: Rocket Software Unidata udadmin_server Stack Buffer Overflow in Password
Type: exploit
Path: modules/exploits/linux/misc/unidata_udadmin_password_stack_overflow.rb
Platform: unix
Disclosure date: 2023-03-30
References: URL-https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed, CVE-2023-28502
Targets: Unix Command, Linux Dropper

Description:
This modlue exploits an authentication bypass vulnerability in the
          Linux version of udadmin_server, which is an RPC service that comes
          with the Rocket Software UniData server, which runs as root.

          This vulnerability affects UniData versions 8.2.4 build 3003 and
          earlier (for Linux), but this module specifically targets UniData
          version 8.2.4 build 3001. Other versions will crash the forked
          process, but will not otherwise affect the RPC server.

          The username and password fields are copied to a stack-based buffer
          using a function that's equivalent to strcpy() (ie, has no bounds
          checking). Additionally, the password field is encoded in such a way
          that we can include NUL bytes.

Check method (fingerprinting):
@version = unirpc_get_version
    vprint_status("Detected UniRPC version #{@version} is running")

    Exploit::CheckCode::Detected
  rescue UniRPCCommunicationError => e
    return CheckCode::Safe("Could not communicate with the UniRPC server: #{e}")
  rescue UniRPCUnexpectedResponseError => e
    return CheckCode::Safe("UniRPC server returned something unexpected: #{e}")
  end
Metasploit Module: NetSupport Manager Agent Remote Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/netsupport_manager_agent.rb
Platform: linux
Disclosure date: 2011-01-08
References: CVE-2011-0404, OSVDB-70408, BID-45728, URL-https://seclists.org/fulldisclosure/2011/Jan/90, EDB-15937

Description:
This module exploits a buffer overflow in NetSupport Manager Agent. It
          uses a similar ROP to the proftpd_iac exploit in order to avoid non executable stack.