deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Solaris dtspcd Heap Overflow
Type: exploit
Path: modules/exploits/solaris/dtspcd/heap_noir.rb
Platform: solaris
Disclosure date: 2002-07-10
References: CVE-2001-0803, OSVDB-4503, BID-3517, URL-https://web.archive.org/web/[PII_REDACTED]0106/http://www.cert.org/advisories/CA-2001-31.html, URL-https://media.wiley.com/product_ancillary/83/07645446/DOWNLOAD/Source_Files.zip

Description:
This is a port of noir's dtspcd exploit. This module should
          work against any vulnerable version of Solaris 8 (sparc).
          The original exploit code was published in the book
          Shellcoder's Handbook.

Check method (fingerprinting):
spc_connect
    spc_write(spc_register('root', "\x00"), 4)
    host, os, ver, arch = spc_read.gsub("\x00", '').split(':')

    return CheckCode::Safe('No host information received from dtspcd') unless host

    spc_write('', 2)

    return CheckCode::Safe("Detected dtspcd running #{os} v#{ver} on #{arch} hardware. Target host architecture #{arch} is not sparc.") unless arch =~ /sparc/i

    CheckCode::Detected("Detected dtspcd running #{os} v#{ver} on #{arch} hardware.")
  end
Metasploit Module: Samba trans2open Overflow (Solaris SPARC)
Type: exploit
Path: modules/exploits/solaris/samba/trans2open.rb
Platform: solaris
Disclosure date: 2003-04-07
References: CVE-2003-0201, OSVDB-4469, BID-7294, URL-https://seclists.org/bugtraq/2003/Apr/103

Description:
This exploits the buffer overflow found in Samba versions
          2.2.0 to 2.2.8. This particular module is capable of
          exploiting the flaw on Solaris SPARC systems that do not
          have the noexec stack option set. Big thanks to MC and
          valsmith for resolving a problem with the beta version of
          this module.
Metasploit Module: Samba lsa_io_trans_names Heap Overflow
Type: exploit
Path: modules/exploits/solaris/samba/lsa_transnames_heap.rb
Platform: solaris
Disclosure date: 2007-05-14
References: CVE-2007-2446, OSVDB-34699
Targets: Solaris 8/9/10 x86 Samba 3.0.21-3.0.24, Solaris 8/9/10 SPARC Samba 3.0.21-3.0.24, DEBUG

Description:
This module triggers a heap overflow in the LSA RPC service
          of the Samba daemon. This module uses the TALLOC chunk overwrite
          method (credit Ramon and Adriano), which only works with Samba
          versions 3.0.21-3.0.24. Additionally, this module will not work
          when the Samba "log level" parameter is higher than "2".
Metasploit Module: Solaris LPD Command Execution
Type: exploit
Path: modules/exploits/solaris/lpd/sendmail_exec.rb
Platform: %w[solaris unix
Disclosure date: 2001-08-31
References: CVE-2001-1583, OSVDB-15131, BID-3274

Description:
This module exploits an arbitrary command execution flaw in
          the in.lpd service shipped with all versions of Sun Solaris
          up to and including 8.0. This module uses a technique
          discovered by Dino Dai Zovi to exploit the flaw without
          needing to know the resolved name of the attacking system.
Metasploit Module: Solaris sadmind Command Execution
Type: exploit
Path: modules/exploits/solaris/sunrpc/sadmind_exec.rb
Platform: %w[solaris unix
Disclosure date: 2003-09-13
References: CVE-2003-0722, OSVDB-4585, BID-8615

Description:
This exploit targets a weakness in the default security settings of
          the Sun Solstice AdminSuite distributed system administration daemon
          (sadmind) RPC application. This server is installed and enabled by
          default on most versions of the Solaris operating system.

          Vulnerable systems include Solaris 2.7, 8, and 9.

Check method (fingerprinting):
port = sunrpc_create('udp', 100232, 10)
    port.nil? ? CheckCode::Safe('SADMIND RPC service not found') : CheckCode::Detected('SADMIND RPC service detected')
  ensure
    sunrpc_destroy unless rpcobj.nil?
  end
Metasploit Module: Sun Solaris sadmind adm_build_path() Buffer Overflow
Type: exploit
Path: modules/exploits/solaris/sunrpc/sadmind_adm_build_path.rb
Platform: solaris
Disclosure date: 2008-10-14
References: CVE-2008-4556, OSVDB-49111, URL-https://web.archive.org/web/[PII_REDACTED]0000*/https://risesecurity.org/advisories/RISE-2008001.txt
Targets: Sun Solaris 9 x86 Brute Force

Description:
This module exploits a buffer overflow vulnerability in adm_build_path()
          function of Sun Solstice AdminSuite sadmind daemon.

          The distributed system administration daemon (sadmind) is the daemon used by
          Solstice AdminSuite applications to perform distributed system administration
          operations.

          The sadmind daemon is started automatically by the inetd daemon whenever a
          request to invoke an operation is received. The sadmind daemon process
          continues to run for 15 minutes after the last request is completed, unless a
          different idle-time is specified with the -i command line option. The sadmind
          daemon may be started independently from the command line, for example, at
          system boot time. In this case, the -i option has no effect; sadmind continues
          to run, even if there are no active requests.

Check method (fingerprinting):
port = sunrpc_create('udp', 100232, 10)
    port.nil? ? CheckCode::Safe('SADMIND RPC service not found') : CheckCode::Detected('SADMIND RPC service detected')
  ensure
    sunrpc_destroy unless rpcobj.nil?
  end
Metasploit Module: Solaris ypupdated Command Execution
Type: exploit
Path: modules/exploits/solaris/sunrpc/ypupdated_exec.rb
Platform: %w[solaris unix
Disclosure date: 1994-12-12
References: CVE-1999-0209, OSVDB-11517, BID-1749

Description:
This exploit targets a weakness in the way the ypupdated RPC
          application uses the command shell when handling a MAP UPDATE
          request.  Extra commands may be launched through this command
          shell, which runs as root on the remote host, by passing
          commands in the format '|<command>'.

          Vulnerable systems include Solaris 2.7, 8, 9, and 10, when
          ypupdated is started with the '-i' command-line option.
Metasploit Module: Sun Solaris Telnet Remote Authentication Bypass Vulnerability
Type: exploit
Path: modules/exploits/solaris/telnet/fuser.rb
Platform: %w[solaris unix
Disclosure date: 2007-02-12
References: CVE-2007-0882, OSVDB-31881, BID-22512

Description:
This module exploits the argument injection vulnerability
          in the telnet daemon (in.telnetd) of Solaris 10 and 11.
Metasploit Module: Solaris in.telnetd TTYPROMPT Buffer Overflow
Type: exploit
Path: modules/exploits/solaris/telnet/ttyprompt.rb
Platform: %w[solaris unix
Disclosure date: 2002-01-18
References: CVE-2001-0797, OSVDB-690, BID-5531

Description:
This module uses a buffer overflow in the Solaris 'login'
          application to bypass authentication in the telnet daemon.
Metasploit Module: Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow
Type: exploit
Path: modules/exploits/solaris/ssh/pam_username_bof.rb
Platform: unix
Disclosure date: 2020-10-20
References: CVE-2020-14871, URL-https://www.oracle.com/security-alerts/cpuoct2020.html, URL-https://www.fireeye.com/blog/threat-research/2020/11/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover.html, URL-https://hacker.house/lab/cve-2020-18471/, URL-https://twitter.com/hackerfantastic/status/[PII_REDACTED]22435841

Description:
This module exploits a stack-based buffer overflow in the Solaris PAM
          library's username parsing code, as used by the SunSSH daemon when the
          keyboard-interactive authentication method is specified.

          Tested against SunSSH 1.1.5 on Solaris 10u11 1/13 (x86) in VirtualBox,
          VMware Fusion, and VMware Player. Bare metal untested. Your addresses
          may vary.

Check method (fingerprinting):
# Run auxiliary/scanner/ssh/ssh_version
    checkcode = super

    return checkcode unless checkcode == CheckCode::Detected

    unless target['Ident'] == checkcode.details[:ident]
      return CheckCode::Safe("#{target.name} is an incompatible target.")
    end

    CheckCode::Appears("#{target.name} is a compatible target.")
  end
Metasploit Module: System V Derived /bin/login Extraneous Arguments Buffer Overflow
Type: exploit
Path: modules/exploits/solaris/dialup/manyargs.rb
Platform: unix
Disclosure date: 2001-12-12
References: CVE-2001-0797, OSVDB-690, OSVDB-691, BID-3681, URL-https://web.archive.org/web/[PII_REDACTED]2443/http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html, URL-https://web.archive.org/web/[PII_REDACTED]3100/http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html, URL-https://github.com/0xdea/exploits/blob/master/solaris/raptor_rlogin.c

Description:
This exploit connects to a system's modem over dialup and exploits
          a buffer overflow vulnerability in it's System V derived /bin/login.
          The vulnerability is triggered by providing a large number of arguments.
Metasploit Module: FTP JCL Execution
Type: exploit
Path: modules/exploits/mainframe/ftp/ftp_jcl_creds.rb
Platform: mainframe
Disclosure date: 2013-05-12

Description:
Submit JCL to z/OS via FTP and SITE FILE=JES.
          This exploit requires valid credentials on the target system.

Check method (fingerprinting):
##
    # Connect to get the FTP banner and check target OS
    ##
    fail_with(Failure::Unknown, "#{rhost}:#{rport} - Failed to connect to FTP server") unless connect_login

    print_good('Successfully connected to FTP server.')
    test_jes = send_cmd(['site', 'file=jes'])

    # Disconnect and check cached self.banner
    disconnect

    ##
    # Check if the target system has an FTP server running on z/OS"
    ##
    unless banner =~ /IBM FTP CS V.R./
      return CheckCode::Safe("We could not recognize the server banner: #{banner.strip}")
    end

    if test_jes =~ /200 SITE/
      return CheckCode::Vulnerable('Found IBM z/OS Banner and JES commands accepted')
    end

    CheckCode::Detected('Found IBM z/OS Banner but SITE FILE=JES failed. Try anyway!')
  end

  ##
  # Exploit the target system by submitting a JCL job via FTP
  ##
Metasploit Module: VMware Fusion USB Arbitrator Setuid Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/vmware_fusion_lpe.rb
Disclosure date: 2020-03-17
References: CVE-2020-3950, EDB-48235, URL-https://www.vmware.com/security/advisories/VMSA-2020-0005.html, URL-https://twitter.com/jeffball55/status/[PII_REDACTED]53110785?s=20, URL-https://github.com/grimm-co/NotQuite0DayFriday/blob/master/2020.03.17-vmware-fusion/notes.txt

Description:
This exploits an improper use of setuid binaries within VMware Fusion 10.1.3 - 11.5.3.
          The Open VMware USB Arbitrator Service can be launched outide of its standard path
          which allows loading of an attacker controlled binary.  By creating a payload in the
          user home directory in a specific folder, and creating a hard link to the 'Open VMware
          USB Arbitrator Service' binary, we're able to launch it temporarily to start our payload
          with an effective UID of 0.
          @jeffball55 discovered an incomplete patch in 11.5.3 with a TOCTOU race.
          Successfully tested against 10.1.6, 11.5.1, 11.5.2, and 11.5.3.

Check method (fingerprinting):
unless exists? "/Applications/VMware Fusion.app/Contents/Library/services/#{open_usb_service}"
      print_bad "'#{open_usb_service}' binary missing"
      return CheckCode::Safe("#{open_usb_service} binary missing")
    end
    version = get_version
    if version.between?(Rex::Version.new('10.1.3'), Rex::Version.new('11.5.3'))
      vprint_good "Vmware Fusion #{version} is exploitable"
    else
      print_bad "VMware Fusion #{version} is NOT exploitable"
      return CheckCode::Safe("VMware Fusion #{version} is not in the vulnerable range")
    end
    CheckCode::Appears("VMware Fusion #{version} appears vulnerable")
  end
Metasploit Module: Apple OS X Entitlements Rootpipe Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/rootpipe_entitlements.rb
Platform: osx
Disclosure date: 2015-07-01
References: CVE-2015-3673, URL-https://truesecdev.wordpress.com/2015/07/01/exploiting-rootpipe-again/

Description:
This module exploits the rootpipe vulnerability and bypasses Apple's initial
          fix for the issue by injecting code into a process with the 'admin.writeconfig'
          entitlement.

Check method (fingerprinting):
if ver? && is_admin?
      vprint_status("Version is between 10.9 and 10.10.3, and is admin.")
      return CheckCode::Appears('Version is between 10.9 and 10.10.3 and user is admin')
    else
      return CheckCode::Safe('Version is not vulnerable or user is not admin')
    end
  end
Metasploit Module: Mac OS X NFS Mount Privilege Escalation Exploit
Type: exploit
Path: modules/exploits/osx/local/nfs_mount_root.rb
Platform: osx
Disclosure date: 2014-04-11
References: EDB-32813
Targets: Mac OS X 10.7 Lion x64 (Native Payload)

Description:
This exploit leverages a stack buffer overflow vulnerability to escalate privileges.
          The vulnerable function nfs_convert_old_nfs_args does not verify the size
          of a user-provided argument before copying it to the stack. As a result, by
          passing a large size as an argument, a local user can overwrite the stack with arbitrary
          content.

          Mac OS X Lion Kernel <= xnu-1699.32.7 except xnu-1699.24.8 are affected.

Check method (fingerprinting):
if ver_lt(xnu_ver, '1699.32.7') and xnu_ver.strip != '1699.24.8'
      CheckCode::Appears("XNU version #{xnu_ver} appears vulnerable")
    else
      CheckCode::Safe("XNU version #{xnu_ver} is not vulnerable")
    end
  end
Metasploit Module: macOS Dirty Cow Arbitrary File Write Local Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/mac_dirty_cow.rb
Platform: osx
Disclosure date: 2022-12-17
References: CVE-2022-46689, URL-https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/tests/vm/vm_unaligned_copy_switch_race.c, URL-https://github.com/zhuowei/MacDirtyCowDemo

Description:
An app may be able to execute arbitrary code with kernel privileges

Check method (fingerprinting):
version = Rex::Version.new(get_system_version)
    if version > Rex::Version.new('13.0.1')
      CheckCode::Safe("macOS version #{version} is patched")
    elsif version < Rex::Version.new('13.0') && version > Rex::Version.new('12.6.1')
      CheckCode::Safe("macOS version #{version} is patched")
    elsif version < Rex::Version.new('10.15')
      CheckCode::Safe("macOS version #{version} is not in the vulnerable range")
    else
      CheckCode::Appears("macOS version #{version} appears vulnerable")
    end
  end
Metasploit Module: Acronis TrueImage XPC Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/acronis_trueimage_xpc_privesc.rb
Disclosure date: 2020-11-11
References: CVE-2020-25736, URL-https://kb.acronis.com/content/68061, URL-https://attackerkb.com/topics/a1Yrvagxt5/cve-2020-25736

Description:
Acronis TrueImage versions 2019 update 1 through 2021 update 1
          are vulnerable to privilege escalation. The `com.acronis.trueimagehelper`
          helper tool does not perform any validation on connecting clients,
          which gives arbitrary clients the ability to execute functions provided
          by the helper tool with `root` privileges.

Check method (fingerprinting):
helper_location = '/Library/PrivilegedHelperTools'
    helper_svc_names = [ 'com.acronis.trueimagehelper', 'com.acronis.helpertool' ]
    plist = '/Applications/Acronis True Image.app/Contents/Info.plist'

    unless helper_svc_names.any? { |svc_name| file?("#{helper_location}/#{svc_name}") }
      return CheckCode::Safe('Acronis True Image helper service not found')
    end

    return CheckCode::Detected('Service found, but cannot determine version via plist') unless file?(plist)

    plutil_cmd = "plutil -extract CFBundleVersion raw \'#{plist}\'"
    build_no = cmd_exec(plutil_cmd)
    return CheckCode::Detected('Could not retrieve build number from plist') if build_no.blank?

    build_no = build_no.to_i
    vprint_status("Found build #{build_no}")
    return CheckCode::Appears('Vulnerable build found') if build_no > 14170 && build_no < 33610

    CheckCode::Safe('Acronis version found is not vulnerable')
  end
Metasploit Module: Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/rsh_libmalloc.rb
Platform: osx
Disclosure date: 2015-10-01
References: EDB-38371, CVE-2015-5889

Description:
This module writes to the sudoers file without root access by exploiting rsh and malloc log files.
          Makes sudo require no password, giving access to su even if root is disabled.
          Works on OS X 10.9.5 to 10.10.5 (patched on 10.11).
Metasploit Module: Apple OS X Rootpipe Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/rootpipe.rb
Platform: osx
Disclosure date: 2015-04-09
References: CVE-2015-1130, OSVDB-114114, EDB-36692, URL-https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/

Description:
This module exploits a hidden backdoor API in Apple's Admin framework on
          Mac OS X to escalate privileges to root, dubbed "Rootpipe."

          This module was tested on Yosemite 10.10.2 and should work on previous versions.

          The patch for this issue was not backported to older releases.

          Note: you must run this exploit as an admin user to escalate to root.

Check method (fingerprinting):
(ver? && is_admin?) ? CheckCode::Appears('Target version appears vulnerable') : CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Mac OS X IOKit Keyboard Driver Root Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/iokit_keyboard_root.rb
Platform: osx
Disclosure date: 2014-09-24
References: CVE-2014-4404, URL-http://googleprojectzero.blogspot.com/2014/11/pwn4fun-spring-2014-safari-part-ii.html, URL-https://code.google.com/p/google-security-research/issues/detail?id=40, URL-https://code.google.com/p/google-security-research/issues/detail?id=126

Description:
A heap overflow in IOHIKeyboardMapper::parseKeyMapping allows kernel memory
          corruption in Mac OS X before 10.10. By abusing a bug in the IORegistry, kernel
          pointers can also be leaked, allowing a full kASLR bypass.

          Tested on Mavericks 10.9.5, and should work on previous versions.

          The issue was patched silently in Yosemite.

Check method (fingerprinting):
if ver_lt(osx_ver, "10.10")
      CheckCode::Appears("OS X version #{osx_ver} appears vulnerable")
    else
      CheckCode::Safe("OS X version #{osx_ver} is not vulnerable")
    end
  end
Metasploit Module: Mac OS X TimeMachine (tmdiagnose) Command Injection Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/timemachine_cmd_injection.rb
Disclosure date: 2019-04-13
References: CVE-2019-8513, URL-http://web.archive.org/web/[PII_REDACTED]2302/https://medium.com/0xcc/rootpipe-reborn-part-i-cve-2019-8513-timemachine-root-command-injection-47e056b3cb43, URL-https://support.apple.com/en-in/HT209600, URL-https://github.com/ChiChou/sploits
Targets: Mac OS X x64 (Native Payload), Python payload, Command payload

Description:
This module exploits a command injection in TimeMachine on macOS <= 10.14.3 in
          order to run a payload as root. The tmdiagnose binary on OSX <= 10.14.3 suffers
          from a command injection vulnerability that can be exploited by creating a
          specially crafted disk label.

          The tmdiagnose binary uses awk to list every mounted volume, and composes
          shell commands based on the volume labels. By creating a volume label with the
          backtick character, we can have our own binary executed with root priviledges.

Check method (fingerprinting):
version = Rex::Version.new(get_system_version)
    if version >= Rex::Version.new('10.14.4')
      CheckCode::Safe("macOS version #{version} is patched")
    else
      CheckCode::Appears("macOS version #{version} appears vulnerable")
    end
  end
Metasploit Module: macOS cfprefsd Arbitrary File Write Local Privilege Escalation
Type: exploit
Path: modules/exploits/osx/local/cfprefsd_race_condition.rb
Platform: osx
Disclosure date: 2020-03-18
References: CVE-2020-9839, URL-https://github.com/sslab-gatech/pwn2own2020

Description:
This module exploits an arbitrary file write in cfprefsd on macOS <= 10.15.4 in
          order to run a payload as root. The CFPreferencesSetAppValue function, which is
          reachable from most unsandboxed processes, can be exploited with a race condition
          in order to overwrite an arbitrary file as root. By overwriting /etc/pam.d/login
          a user can then login as root with the `login root` command without a password.

Check method (fingerprinting):
version = Rex::Version.new(get_system_version)
    if version > Rex::Version.new('10.15.4')
      CheckCode::Safe("macOS version #{version} is patched")
    elsif version < Rex::Version.new('10.15')
      CheckCode::Safe("macOS version #{version} is not in the vulnerable range")
    else
      CheckCode::Appears("macOS version #{version} appears vulnerable")
    end
  end
Metasploit Module: Mac OS X Sudo Password Bypass
Type: exploit
Path: modules/exploits/osx/local/sudo_password_bypass.rb
Platform: osx
Disclosure date: 2013-02-28
References: CVE-2013-1775, OSVDB-90677, BID-58203, URL-http://www.sudo.ws/sudo/alerts/epoch_ticket.html
Targets: Mac OS X x86 (Native Payload), Mac OS X x64 (Native Payload), CMD

Description:
This module gains a session with root permissions on versions of OS X with
          sudo binary vulnerable to CVE-2013-1775. Tested working on Mac OS 10.7-10.8.4,
          and possibly lower versions.

          If your session belongs to a user with Administrative Privileges
          (the user is in the sudoers file and is in the "admin group"), and the
          user has ever run the "sudo" command, it is possible to become the super
          user by running `sudo -k` and then resetting the system clock to 01-01-1970.

          This module will fail silently if the user is not an admin, if the user has never
          run the sudo command, or if the admin has locked the Date/Time preferences.

          Note: If the user has locked the Date/Time preferences, requests to overwrite
          the system clock will be ignored, and the module will silently fail. However,
          if the "Require an administrator password to access locked preferences" setting
          is not enabled, the Date/Time preferences are often unlocked every time the admin
          logs in, so you can install persistence and wait for a chance later.

Check method (fingerprinting):
if cmd_exec('sudo -V') =~ /version\s+([^\s]*)\s*$/
      sudo_vn = ::Regexp.last_match(1)
      sudo_vn.split(/[.p]/).map(&:to_i)
      # check vn between 1.6.0 through 1.7.10p6
      # and 1.8.0 through 1.8.6p6
      if !vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES)
        vprint_error "sudo version #{sudo_vn} not vulnerable."
        return CheckCode::Safe("sudo version #{sudo_vn} is not vulnerable")
      end
    else
      vprint_error 'sudo not detected on the system.'
      return CheckCode::Safe('sudo not detected on the system')
    end

    # check that the user is in OSX's admin group, necessary to change sys clock
    unless is_admin?
      vprint_error 'sudo version is vulnerable, but user is not in the admin group (necessary to change the date).'
      return CheckCode::Safe('User is not in the admin group')
    end

    # one root for you sir
    CheckCode::Vulnerable("sudo version #{sudo_vn} is vulnerable and user is in admin group")
  end