deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Ghostscript Failed Restore Command Execution
Type: exploit
Path: modules/exploits/multi/fileformat/ghostscript_failed_restore.rb
Platform: unix
Disclosure date: 2018-08-21
References: CVE-2018-16509, URL-https://seclists.org/oss-sec/2018/q3/142, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1640
Targets: Unix (In-Memory), PowerShell (In-Memory), Linux (Dropper)

Description:
This module exploits a -dSAFER bypass in Ghostscript to execute
          arbitrary commands by handling a failed restore (grestore) in
          PostScript to disable LockSafetyParams and avoid invalidaccess.

          This vulnerability is reachable via libraries such as ImageMagick.
Metasploit Module: Malicious XDG Desktop File
Type: exploit
Path: modules/exploits/multi/fileformat/xdg_desktop.rb
Platform: %w[linux unix solaris freebsd
Disclosure date: 2007-02-06
References: URL-https://specifications.freedesktop.org/desktop-entry-spec/latest/, URL-https://specifications.freedesktop.org/desktop-entry-spec/latest/exec-variables.html, URL-https://wiki.archlinux.org/title/Desktop_entries

Description:
This module creates a malicious XDG Desktop (.desktop) file.

          On most modern systems, desktop files are not trusted by default.
          The user will receive a warning prompt that the file is not trusted
          when running the file, but may choose to run the file anyway.

          The default file manager applications in some desktop environments
          may impose more strict execution requirements by prompting the user
          to set the file as executable and/or marking the file as trusted
          before the file can be executed.
Metasploit Module: PeaZip Zip Processing Command Injection
Type: exploit
Path: modules/exploits/multi/fileformat/peazip_command_injection.rb
Platform: %w{linux unix win}
Disclosure date: 2009-06-05
References: CVE-2009-2261, OSVDB-54966, URL-http://peazip.sourceforge.net/, EDB-8881

Description:
This module exploits a command injection vulnerability in PeaZip. All
          versions prior to 2.6.2 are suspected vulnerable. Testing was conducted with
          version 2.6.1 on Windows.

          In order for the command to be executed, an attacker must convince someone to
          open a specially crafted zip file with PeaZip, and access the specially file via
          double-clicking it. By doing so, an attacker can execute arbitrary commands
          as the victim user.
Metasploit Module: Javascript Injection for Eval-based Unpackers
Type: exploit
Path: modules/exploits/multi/fileformat/js_unpacker_eval_injection.rb
Platform: nodejs
Disclosure date: 2015-02-18

Description:
This module generates a Javascript file that executes arbitrary code
          when an eval-based unpacker is run on it. Works against js-beautify's
          P_A_C_K_E_R unpacker.
Metasploit Module: LibreOffice Macro Python Code Execution
Type: exploit
Path: modules/exploits/multi/fileformat/libreoffice_logo_exec.rb
Platform: python
Disclosure date: 2019-07-16
References: CVE-2019-9851, URL-https://www.libreoffice.org/about-us/security/advisories/cve-2019-9848/, URL-https://www.libreoffice.org/about-us/security/advisories/cve-2019-9851/, URL-https://insinuator.net/2019/07/libreoffice-a-python-interpreter-code-execution-vulnerability-cve-2019-9848/

Description:
LibreOffice comes bundled with sample macros written in Python and
          allows the ability to bind program events to them.

          LibreLogo is a macro that allows a program event to execute text as Python code, allowing RCE.

          This module generates an ODT file with a dom loaded event that,
          when triggered, will execute arbitrary python code and the metasploit payload.
Metasploit Module: Evince CBT File Command Injection
Type: exploit
Path: modules/exploits/multi/fileformat/evince_cbt_cmd_injection.rb
Platform: unix
Disclosure date: 2017-07-13
References: BID-99597, CVE-2[PII_REDACTED], EDB-45824, URL-https://seclists.org/oss-sec/2017/q3/128, URL-https://bugzilla.gnome.org/show_bug.cgi?id=784630, URL-https://bugzilla.suse.com/show_bug.cgi?id=1046856, URL-https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1735418, URL-https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1800662, URL-https://access.redhat.com/security/cve/cve-2[PII_REDACTED], URL-https://security-tracker.debian.org/tracker/CVE-2[PII_REDACTED]

Description:
This module exploits a command injection vulnerability in Evince
          before version 3.24.1 when opening comic book `.cbt` files.

          Some file manager software, such as Nautilus and Atril, may allow
          automatic exploitation without user interaction due to thumbnailer
          preview functionality.

          Note that limited space is available for the payload (<256 bytes).
          Reverse Bash and Reverse Netcat payloads should be sufficiently small.

          This module has been tested successfully on evince versions:

          3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6;
          3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04.
Metasploit Module: Ghostscript Command Execution via Format String
Type: exploit
Path: modules/exploits/multi/fileformat/ghostscript_format_string_cve_2024_29510.rb
Disclosure date: 2024-03-14
References: CVE-2024-29510, URL-https://bugs.ghostscript.com/show_bug.cgi?id=707662, URL-https://codeanlabs.com/blog/research/cve-2024-29510-ghostscript-format-string-exploitation/
Targets: Linux Command

Description:
This module exploits a format string vulnerability in Ghostscript
          versions before 10.03.1 to achieve a SAFER sandbox bypass and execute
          arbitrary commands. This vulnerability is reachable via libraries such as
          ImageMagick.

          This exploit only works against Ghostscript versions 10.03.0 and
          10.01.2. Some offsets adjustement will probably be needed to make it
          work with other versions.
Metasploit Module: JSON Swagger CodeGen Parameter Injector
Type: exploit
Path: modules/exploits/multi/fileformat/swagger_param_inject.rb
Platform: nodejs
Disclosure date: 2016-06-23
References: CVE-2016-5641, URL-http://github.com/swagger-api/swagger-codegen, URL-https://www.rapid7.com/blog/post/2016/06/23/r7-2016-06-remote-code-execution-via-swagger-parameter-injection-cve-2016-5641
Targets: NodeJS, PHP, Java JSP, Ruby

Description:
This module generates an Open API Specification 2.0 (Swagger) compliant
          json document that includes payload insertion points in parameters.

          In order for the payload to be executed, an attacker must convince
          someone to generate code from a specially modified swagger.json file
          within a vulnerable swagger-codgen appliance/container/api/service,
          and then to execute that generated code (or include it into software
          which will later be executed by another victim). By doing so, an
          attacker can execute arbitrary code as the victim user. The same
          vulnerability exists in the YAML format.
Metasploit Module: GitLens Git Local Configuration Exec
Type: exploit
Path: modules/exploits/multi/fileformat/gitlens_local_config_exec.rb
Disclosure date: 2023-11-14
References: URL-https://www.sonarsource.com/blog/vscode-security-markdown-vulnerabilities-in-extensions/, URL-https://www.sonarsource.com/blog/securing-developer-tools-git-integrations/, URL-https://github.com/gitkraken/vscode-gitlens/commit/ee2a0c42a92d33059a39fd15fbbd5dd3d5ab6440, CVE-2023-46944

Description:
GitKraken GitLens before v.14.0.0 allows an untrusted workspace to execute git
          commands. A repo may include its own .git folder including a malicious config file to
          execute arbitrary code.

          Tested against VSCode 1.87.2 with GitLens 13.6.0 on Ubuntu 22.04 and Windows 10
Metasploit Module: Maple Maplet File Creation and Command Execution
Type: exploit
Path: modules/exploits/multi/fileformat/maple_maplet.rb
Platform: win
Disclosure date: 2010-04-26
References: CVE-2010-20120, OSVDB-64541, URL-http://www.maplesoft.com/products/maple/
Targets: Windows, Windows X64, Linux, Linux X64, Universal CMD

Description:
This module harnesses Maple's ability to create files and execute commands
          automatically when opening a Maplet. All versions up to 13 are suspected
          vulnerable. Testing was conducted with version 13 on Windows. Standard security
          settings prevent code from running in a normal maple worksheet without user
          interaction, but those setting do not prevent code in a Maplet from running.

          In order for the payload to be executed, an attacker must convince someone to
          open a specially modified .maplet file with Maple. By doing so, an attacker can
          execute arbitrary code as the victim user.
Metasploit Module: Generic Zip Slip Traversal Vulnerability
Type: exploit
Path: modules/exploits/multi/fileformat/zip_slip.rb
Platform: linux
Disclosure date: 2018-06-05
References: URL-https://snyk.io/research/zip-slip-vulnerability

Description:
This is a generic arbitrary file overwrite technique, which typically results in remote
          command execution. This targets a simple yet widespread vulnerability that has been
          seen affecting a variety of popular products including HP, Amazon, Apache, Cisco, etc.
          The idea is that often archive extraction libraries have no mitigations against
          directory traversal attacks. If an application uses it, there is a risk when opening an
          archive that is maliciously modified, and result in the embedded payload to be written
          to an arbitrary location (such as a web root), and result in remote code execution.
Metasploit Module: Adobe U3D CLODProgressiveMeshDeclaration Array Overrun
Type: exploit
Path: modules/exploits/multi/fileformat/adobe_u3d_meshcont.rb
Platform: win
Disclosure date: 2009-10-13
References: CVE-2009-2990, OSVDB-58920, BID-36665, URL-http://sites.google.com/site/felipeandresmanzano/, URL-http://www.adobe.com/support/security/bulletins/apsb09-15.html
Targets: Adobe Reader Windows Universal (JS Heap Spray), Adobe Reader Linux Universal (JS Heap Spray)

Description:
This module exploits an array overflow in Adobe Reader and Adobe Acrobat.
          Affected versions include < 7.1.4, < 8.1.7, and < 9.2. By creating a
          specially crafted pdf that a contains malformed U3D data, an attacker may
          be able to execute arbitrary code.
Metasploit Module: Microsoft Office Word Malicious Macro Execution
Type: exploit
Path: modules/exploits/multi/fileformat/office_word_macro.rb
Platform: win
Disclosure date: 2012-01-10
References: URL-https://en.wikipedia.org/wiki/Macro_virus
Targets: Microsoft Office Word on Mac OS X (Python)

Description:
This module injects a malicious macro into a Microsoft Office Word document (docx). The
          comments field in the metadata is injected with a Base64 encoded payload, which will be
          decoded by the macro and execute as a Windows executable.

          For a successful attack, the victim is required to manually enable macro execution.
Metasploit Module: Visual Studio vsix Extension Exec
Type: exploit
Path: modules/exploits/multi/fileformat/visual_studio_vsix_exec.rb
Platform: nodejs
Disclosure date: 2024-03-22
References: URL-https://medium.com/@VakninHai/the-hidden-risks-of-visual-studio-extensions-a-new-avenue-for-persistence-attacks-e56722c048f1, URL-https://code.visualstudio.com/api/get-started/your-first-extension, URL-https://code.visualstudio.com/api/references/activation-events

Description:
Creates a vsix file which can be installed in Visual Studio Code as an extension.
          At activation/install, the extension will execute a shell or two.

          Tested against VSCode 1.87.2 on Ubuntu 22.04
Metasploit Module: LibreOffice Macro Code Execution
Type: exploit
Path: modules/exploits/multi/fileformat/libreoffice_macro_exec.rb
Platform: win
Disclosure date: 2018-10-18
References: CVE-2018-16858, URL-https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html
Targets: Windows, Linux

Description:
LibreOffice comes bundled with sample macros written in Python and
          allows the ability to bind program events to them. A macro can be tied
          to a program event by including the script that contains the macro and
          the function name to be executed. Additionally, a directory traversal
          vulnerability exists in the component that references the Python script
          to be executed. This allows a program event to execute functions from Python
          scripts relative to the path of the samples macros folder. The pydoc.py script
          included with LibreOffice contains the tempfilepager function that passes
          arguments to os.system, allowing RCE.

          This module generates an ODT file with a mouse over event that
          when triggered, will execute arbitrary code.
Metasploit Module: Firefox Exec Shellcode from Privileged Javascript Shell
Type: exploit
Path: modules/exploits/firefox/local/exec_shellcode.rb
Platform: %w[linux osx win unix
Disclosure date: 2014-03-10
Targets: Native Payload

Description:
This module allows execution of native payloads from a privileged Firefox Javascript shell.
          It places the specified payload into memory, adds the necessary protection flags,
          and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter
          session without touching the disk.
Metasploit Module: ToolTalk rpc.ttdbserverd _tt_internal_realpath Buffer Overflow (AIX)
Type: exploit
Path: modules/exploits/aix/rpc_ttdbserverd_realpath.rb
Platform: aix
Disclosure date: 2009-06-17
References: CVE-2009-2727, OSVDB-55151
Targets: IBM AIX Version 6.1.4, IBM AIX Version 6.1.3, IBM AIX Version 6.1.2, IBM AIX Version 6.1.1, IBM AIX Version 6.1.0, IBM AIX Version 5.3.10 5.3.9 5.3.8 5.3.7, IBM AIX Version 5.3.10, IBM AIX Version 5.3.9, IBM AIX Version 5.3.8, IBM AIX Version 5.3.7

Description:
This module exploits a buffer overflow vulnerability in _tt_internal_realpath
          function of the ToolTalk database server (rpc.ttdbserverd).
Metasploit Module: AIX Calendar Manager Service Daemon (rpc.cmsd) Opcode 21 Buffer Overflow
Type: exploit
Path: modules/exploits/aix/rpc_cmsd_opcode21.rb
Platform: aix
Disclosure date: 2009-10-07
References: CVE-2009-3699, OSVDB-58726, BID-36615, URL-https://web.archive.org/web/[PII_REDACTED]5835/http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=825, URL-https://web.archive.org/web/[PII_REDACTED]5746/http://aix.software.ibm.com/aix/efixes/security/cmsd_advisory.asc
Targets: IBM AIX Version 5.1

Description:
This module exploits a buffer overflow vulnerability in opcode 21 handled by
          rpc.cmsd on AIX. By making a request with a long string passed to the first
          argument of the "rtable_create" RPC, a stack based buffer overflow occurs. This
          leads to arbitrary code execution.

          NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where
          further attempts are not possible.
Metasploit Module: Xorg X11 Server Local Privilege Escalation
Type: exploit
Path: modules/exploits/aix/local/xorg_x11_server.rb
Platform: unix
Disclosure date: 2018-10-25
References: CVE-2018-14665, URL-https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html, URL-https://aix.software.ibm.com/aix/efixes/security/xorg_advisory3.asc, URL-https://github.com/dzflack/exploits/blob/master/aix/aixxorg.pl, EDB-45938

Description:
WARNING: Successful execution of this module results in /etc/passwd being overwritten.

          This module is a port of the OpenBSD X11 Xorg exploit to run on AIX.

          A permission check flaw exists for -modulepath and -logfile options when
          starting Xorg.  This allows unprivileged users that can start the server
          the ability to elevate privileges and run arbitrary code under root
          privileges.

          This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1.
          Due to permission restrictions of the crontab in AIX, this module does not use cron,
          and instead overwrites /etc/passwd in order to create a new user with root privileges.
          All currently logged in users need to be included when /etc/passwd is overwritten,
          else AIX will throw 'Cannot get "LOGNAME" variable' when attempting to change user.
          The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX,
          and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when
          overwriting /etc/passwd.

Check method (fingerprinting):
xorg_path = cmd_exec('command -v Xorg')
    if !xorg_path.include?('Xorg')
      print_error('Could not find Xorg executable')
      return Exploit::CheckCode::Safe('Xorg executable not found')
    end

    ksh93_path = cmd_exec('command -v ksh93')
    if !ksh93_path.include?('ksh')
      print_error('Could not find Ksh93 executable')
      return Exploit::CheckCode::Safe('Ksh93 executable not found')
    end

    if !xorg_vulnerable?
      print_error('Xorg version is not vulnerable')
      return Exploit::CheckCode::Safe('Xorg version is not vulnerable')
    end

    return Exploit::CheckCode::Appears('Xorg appears vulnerable')
  end
Metasploit Module: invscout RPM Privilege Escalation
Type: exploit
Path: modules/exploits/aix/local/invscout_rpm_priv_esc.rb
Platform: %w[unix aix
Disclosure date: 2023-04-24
References: CVE-2023-28528, URL-http://web.archive.org/web/[PII_REDACTED]3943/https://talosintelligence.com/vulnerability_reports/TALOS-2023-1691

Description:
This module exploits a command injection vulnerability in IBM AIX
          invscout set-uid root utility present in AIX 7.2 and earlier.

          The undocumented -rpm argument can be used to install an RPM file;
          and the undocumented -o argument passes arguments to the rpm utility
          without validation, leading to command injection with effective-uid
          root privileges.

          This module has been tested successfully on AIX 7.2.

Check method (fingerprinting):
return CheckCode::Safe("#{invscout_path} is not executable") unless executable?(invscout_path)

    res = execute_command('id')
    id = res.to_s.scan(/^(.*?uid=.*?)$/).flatten.first.to_s

    return CheckCode::Safe("#{invscout_path} is not vulnerable.") unless id.include?('euid=0')

    CheckCode::Vulnerable("Output: #{id}")
  end
Metasploit Module: ibstat $PATH Privilege Escalation
Type: exploit
Path: modules/exploits/aix/local/ibstat_path.rb
Platform: %w[unix aix
Disclosure date: 2013-09-24
References: CVE-2013-4011, OSVDB-95420, BID-61287, URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827, URL-http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756

Description:
This module exploits the trusted $PATH environment variable of the SUID binary "ibstat".

Check method (fingerprinting):
find_output = cmd_exec('find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null')

    return CheckCode::Safe("#{ibstat_path} is not set-uid root") unless find_output.to_s.include?('ibstat')

    CheckCode::Appears("#{ibstat_path} is set-uid root")
  end
Metasploit Module: UnrealIRCD 3.2.8.1 Backdoor Command Execution
Type: exploit
Path: modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb
Disclosure date: 2010-06-12
References: CVE-2010-2075, OSVDB-65445, URL-http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt

Description:
This module exploits a malicious backdoor that was added to the
          Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the
          Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010.

Check method (fingerprinting):
vprint_status("Connecting to IRC service")
    connect
    print_status("Connected to #{rhost}:#{rport}")

    vprint_status("Checking IRC banner")
    return Exploit::CheckCode::Appears('UnrealIRCd detected in banner') if unreal_version?(send_irc_command)

    irc_user = Faker::Internet.username(specifier: 3..9)
    print_status("Trying to register a new IRC user: #{irc_user}")
    send_irc_command("NICK #{irc_user}")
    # Not checking for PING/PONG
    response = send_irc_command("USER #{irc_user} 0 * #{irc_user}")
    return Exploit::CheckCode::Appears('UnrealIRCd detected after registration') if unreal_version?(response)

    commands = %w[VERSION INFO CREDITS MOTD BOTMOTD HELP LICENSE]
    return Exploit::CheckCode::Appears('UnrealIRCd detected via IRC commands') if
      commands.any? { |cmd| unreal_version?(send_irc_command(cmd)) }

    return Exploit::CheckCode::Safe('UnrealIRCd 3.2.8.1 not detected')
  end
Metasploit Module: Exim "perl_startup" Privilege Escalation
Type: exploit
Path: modules/exploits/unix/local/exim_perl_startup.rb
Platform: unix
Disclosure date: 2016-03-10

Description:
This module exploits a Perl injection vulnerability in Exim < 4.86.2
          given the presence of the "perl_startup" configuration parameter.

Check method (fingerprinting):
if exploit('whoami') == 'root'
      CheckCode::Vulnerable('Exim Perl startup exploit confirmed command execution as root')
    else
      CheckCode::Safe('Could not confirm command execution as root')
    end
  end
Metasploit Module: Emacs movemail Privilege Escalation
Type: exploit
Path: modules/exploits/unix/local/emacs_movemail.rb
Platform: unix
Disclosure date: 1986-08-01

Description:
This module exploits a SUID installation of the Emacs movemail utility
          to run a command as root by writing to 4.3BSD's /usr/lib/crontab.local.

          The vulnerability is documented in Cliff Stoll's book The Cuckoo's Egg.

Check method (fingerprinting):
unless is_43bsd?
      vprint_warning('System does not appear to be 4.3BSD')
    end

    unless file?(movemail)
      vprint_bad("#{movemail} not found")
      return CheckCode::Safe("#{movemail} not found")
    end

    unless movemail.end_with?('movemail')
      vprint_warning("#{movemail} has an unexpected name")
    end

    unless setuid_root?(movemail)
      vprint_status("Non-SUID-root #{movemail} found")
      return CheckCode::Detected("Non-SUID-root #{movemail} found")
    end

    vprint_good("SUID-root #{movemail} found")
    CheckCode::Appears("SUID-root #{movemail} found")
  end
Metasploit Module: Setuid Nmap Exploit
Type: exploit
Path: modules/exploits/unix/local/setuid_nmap.rb
Platform: %w[bsd linux unix
Disclosure date: 2012-07-19
Targets: Command payload, Linux x86, BSD x86

Description:
Nmap's man page mentions that "Nmap should never be installed with
          special privileges (e.g. suid root) for security reasons.." and
          specifically avoids making any of its binaries setuid during
          installation.  Nevertheless, administrators sometimes feel the need
          to do insecure things.  This module abuses a setuid nmap binary by
          writing out a lua nse script containing a call to os.execute().

          Note that modern interpreters will refuse to run scripts on the
          command line when EUID != UID, so the cmd/unix/reverse_{perl,ruby

Check method (fingerprinting):
return CheckCode::Safe("#{nmap} file not found") unless file? nmap
    return CheckCode::Safe("#{nmap} is not setuid") unless setuid? nmap

    CheckCode::Vulnerable("#{nmap} is setuid")
  end
Metasploit Module: Chkrootkit Local Privilege Escalation
Type: exploit
Path: modules/exploits/unix/local/chkrootkit.rb
Platform: unix
Disclosure date: 2014-06-04
References: CVE-2014-0476, OSVDB-107710, EDB-33899, BID-67813, URL-https://seclists.org/oss-sec/2014/q2/430

Description:
Chkrootkit before 0.50 will run any executable file named /tmp/update
          as root, allowing a trivial privilege escalation.

          WfsDelay is set to 24h, since this is how often a chkrootkit scan is
          scheduled by default.

Check method (fingerprinting):
version = cmd_exec("#{datastore['CHKROOTKIT']} -V 2>&1")

    if version =~ /chkrootkit version 0\.[1-4]/
      CheckCode::Appears("Chkrootkit #{version.strip} appears vulnerable")
    else
      CheckCode::Safe('Chkrootkit version does not appear to be vulnerable')
    end
  end