deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HP Client Automation Command Injection
Type: exploit
Path: modules/exploits/multi/misc/persistent_hpca_radexec_exec.rb
Platform: unix
Disclosure date: 2014-01-02
References: CVE-2015-1497, ZDI-15-038, URL-https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features
Targets: HP Client Automation 9.0.0 / Linux, HP Client Automation 9.0.0 / Windows

Description:
This module exploits a command injection vulnerability on HP Client Automation, distributed
          actually as Persistent Systems Client Automation. The vulnerability exists in the Notify
          Daemon (radexecd.exe), which doesn't authenticate execution requests by default.

          This module has been tested successfully on HP Client Automation 9.00 on Windows 2003 SP2
          and CentOS 5.

Check method (fingerprinting):
connect
    sock.put("\x00") # port
    sock.put("#{rand_text_alphanumeric(rand(4..6))}\x00") # user ID
    sock.put("#{rand_text_alpha(rand(4..6))}\x00") # password
    sock.put("hide\x00") # command
    res = sock.get_once
    disconnect

    if res && res.unpack('C')[0] == 0
      return Exploit::CheckCode::Detected('HPCA Radexec service detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Eclipse Equinox OSGi Console Command Execution
Type: exploit
Path: modules/exploits/multi/misc/osgi_console_exec.rb
Platform: linux
Disclosure date: 2018-02-13
References: URL-https://www.eclipse.org/equinox/documents/quickstart-framework.php

Description:
Exploit Eclipse Equinox OSGi (Open Service Gateway initiative) console
          'fork' command to execute arbitrary commands on the remote system.

Check method (fingerprinting):
connect
    res = sock.get_once
    if res == TELNET_IAC::IAC + TELNET_IAC::WILL + TELNET_IAC::OPT_ECHO + \
              TELNET_IAC::IAC + TELNET_IAC::WILL + TELNET_IAC::OPT_SGA + \
              TELNET_IAC::IAC + TELNET_IAC::DO + TELNET_IAC::OPT_NAWS + \
              TELNET_IAC::IAC + TELNET_IAC::DO + TELNET_IAC::OPT_TTYPE
      # terminal type 'xterm-256color' = \x78\x74\x65\x72\x6D\x2D\x32\x35\x36\x63\x6F\x6C\x6F\x72
      sock.put(TELNET_IAC::IAC + TELNET_IAC::SB + TELNET_IAC::OPT_TTYPE + \
        "\x00xterm-256color" + TELNET_IAC::IAC + TELNET_IAC::SE)
      res = sock.get_once
    end
    disconnect
    if res && res == 'osgi> '
      return Exploit::CheckCode::Vulnerable('OSGi console prompt detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Hashicorp Consul Remote Command Execution via Rexec
Type: exploit
Path: modules/exploits/multi/misc/consul_rexec_exec.rb
Platform: linux
Disclosure date: 2018-08-11
References: URL-https://www.consul.io/docs/agent/options.html#disable_remote_exec, URL-https://www.consul.io/docs/commands/exec.html, URL-https://github.com/torque59/Garfield

Description:
This module exploits a feature of Hashicorp Consul named rexec.

Check method (fingerprinting):
uri = target_uri.path
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "/v1/agent/self"),
      'headers' => {
        'X-Consul-Token' => datastore['ACL_TOKEN']
      }
    })
    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection failed')
    end
    begin
      agent_info = JSON.parse(res.body)
      if agent_info["Config"]["DisableRemoteExec"] == false || agent_info["DebugConfig"]["DisableRemoteExec"] == false
        return CheckCode::Vulnerable('DisableRemoteExec is false')
      else
        return CheckCode::Safe('The target is not vulnerable')
      end
    rescue JSON::ParserError
      vprint_error 'Failed to parse JSON output.'
      return CheckCode::Unknown('Failed to parse response')
    end
  end
Metasploit Module: Java JMX Server Insecure Configuration Java Code Execution
Type: exploit
Path: modules/exploits/multi/misc/java_jmx_server.rb
Platform: java
Disclosure date: 2013-05-22
References: URL-https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf, URL-https://www.optiv.com/blog/exploiting-jmx-rmi, CVE-2015-2342

Description:
This module takes advantage a Java JMX interface insecure configuration, which would
          allow loading classes from any remote (HTTP) URL. JMX interfaces with authentication
          disabled (com.sun.management.jmxremote.authenticate=false) should be vulnerable, while
          interfaces with authentication enabled will be vulnerable only if a weak configuration
          is deployed (allowing to use javax.management.loading.MLet, having a security manager
          allowing to load a ClassLoader MBean, etc.).

Check method (fingerprinting):
connect

    unless is_rmi?
      return Exploit::CheckCode::Safe('Target is not an RMI endpoint')
    end

    mbean_server = discover_endpoint
    disconnect
    if mbean_server.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] })
    unless is_rmi?
      disconnect
      return Exploit::CheckCode::Unknown('RMI endpoint not found on discovered MBean server')
    end

    jmx_endpoint = handshake(mbean_server)
    disconnect
    if jmx_endpoint.nil?
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Appears('JMX endpoint discovered on target')
  end
Metasploit Module: Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow (loop)
Type: exploit
Path: modules/exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb
Platform: linux
Disclosure date: 2010-01-27
References: CVE-2010-0304, OSVDB-61987, BID-37985, URL-http://www.wireshark.org/security/wnpa-sec-2010-02.html, URL-http://anonsvn.wireshark.org/viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h
Targets: wireshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86), wireshark 1.2.5 on RHEL 5.4 (x64), wireshark 1.2.5 on Mac OS X 10.5 (x86), wireshark/tshark 1.2.1 and 1.2.5 on Windows (x86)

Description:
The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through
          1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer
          overflow. This bug found and reported by babi.

          This particular exploit targets the dissect_getaddrsbyname_request function. Several
          other functions also contain potentially exploitable stack-based buffer overflows.

          The Windows version (of 1.2.5 at least) is compiled with /GS, which prevents
          exploitation via the return address on the stack. Sending a larger string allows
          exploitation using the SEH bypass method. However, this packet will usually get
          fragmented, which may cause additional complications.

          NOTE: The vulnerable code is reached only when the packet dissection is rendered.
          If the packet is fragmented, all fragments must be captured and reassembled to
          exploit this issue.

          This version loops, sending the packet every X seconds until the job is killed.
Metasploit Module: CUPS IPP Attributes LAN Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
Platform: %w[linux unix
Disclosure date: 2024-09-26
References: CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVE-2024-47176, URL-https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/, URL-https://github.com/RickdeJager/cupshax, URL-https://github.com/h2g2bob/ipp-server/

Description:
This module exploits vulnerabilities in OpenPrinting CUPS, which is running by
          default on most Linux distributions. The vulnerabilities allow an attacker on
          the LAN to advertise a malicious printer that triggers remote code execution
          when a victim sends a print job to the malicious printer. Successful exploitation
          requires user interaction, but no CUPS services need to be reachable via accessible
          ports. Code execution occurs in the context of the lp user. Affected versions
          are cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, and
          cups-filters <= 2.0.1.
Metasploit Module: Legend Perl IRC Bot Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/legend_bot_exec.rb
Platform: %w{unix win}
Disclosure date: 2015-04-27
References: OSVDB-121681, EDB-36836, URL-https://www.damballa.com/perlbotnado/, URL-http://www.csoonline.com/article/2839054/vulnerabilities/report-criminals-use-shellshock-against-mail-servers-to-build-botnet.html

Description:
This module exploits a remote command execution on the Legend Perl IRC Bot.
          This bot has been used as a payload in the Shellshock spam last October 2014.
          This particular bot has functionalities like NMAP scanning, TCP, HTTP, SQL, and
          UDP flooding, the ability to remove system logs, and ability to gain root, and
          VNC scanning.

          Kevin Stevens, a Senior Threat Researcher at Damballa, has uploaded this script
          to VirusTotal with a md5 of 11a9f1589472efa719827079c3d13f76.

Check method (fingerprinting):
connect

    res = register(sock)
    if res =~ /463/ || res =~ /464/
      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
      return Exploit::CheckCode::Unknown('Connection to the IRC server not allowed')
    end

    res = join(sock)
    if res !~ /353/ && res !~ /366/
      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    quit(sock)
    disconnect

    if res =~ /auth/ && res =~ /logged in/
      Exploit::CheckCode::Vulnerable('Bot responded with auth and logged in confirmation')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Java Debug Wire Protocol Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/java_jdwp_debugger.rb
Platform: linux
Disclosure date: Mar 12 2010
References: OSVDB-96066, EDB-27179, URL-http://docs.oracle.com/javase/1.5.0/docs/guide/jpda/jdwp-spec.html, URL-https://seclists.org/nmap-dev/2010/q1/867, URL-https://github.com/schierlm/JavaPayload/blob/master/JavaPayload/src/javapayload/builder/JDWPInjector.java, URL-https://svn.nmap.org/nmap/scripts/jdwp-exec.nse, URL-http://blog.ioactive.com/2014/04/hacking-java-debug-wire-protocol-or-how.html

Description:
This module abuses exposed Java Debug Wire Protocol services in order
        to execute arbitrary Java code remotely. It just abuses the protocol
        features, since no authentication is required if the service is enabled.

Check method (fingerprinting):
connect
    res = handshake
    disconnect

    if res.nil?
      return Exploit::CheckCode::Unknown('JDWP handshake returned nil')
    elsif res == HANDSHAKE
      return Exploit::CheckCode::Appears('JDWP handshake successful')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Java RMI Server Insecure Default Configuration Java Code Execution
Type: exploit
Path: modules/exploits/multi/misc/java_rmi_server.rb
Platform: java
Disclosure date: 2011-10-15
References: URL-http://web.archive.org/web/[PII_REDACTED]0234/http://download.oracle.com:80/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html, URL-http://www.securitytracker.com/id?1026215, CVE-2011-3556
Targets: Generic (Java Payload), Windows x86 (Native Payload), Linux x86 (Native Payload), Mac OS X PPC (Native Payload), Mac OS X x86 (Native Payload)

Description:
This module takes advantage of the default configuration of the RMI Registry and
          RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it
          invokes a method in the RMI Distributed Garbage Collector which is available via every
          RMI endpoint, it can be used against both rmiregistry and rmid,  and against most other
          (custom) RMI endpoints as well.

          Note that it does not work against Java Management Extension (JMX) ports since those do
          not support remote class loading, unless another RMI endpoint is active in the same
          Java process.

          RMI method calls do not support or require any sort of authentication.
Metasploit Module: Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/xdh_x_exec.rb
Platform: %w{unix win}
Disclosure date: 2015-12-04
References: URL-https://conorpp.com/blog/a-close-look-at-an-operating-botnet/, URL-https://twitter.com/MrMookie/status/[PII_REDACTED]76965889, URL-https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities

Description:
This module allows remote command execution on an IRC Bot developed by xdh.
          This perl bot was caught by Conor Patrick with his shellshock honeypot server
          and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). Matt
          Thayer also found this script which has a description of LinuxNet perlbot.

          The bot answers only based on the servername and nickname in the IRC message
          which is configured on the perl script thus you need to be an operator on the IRC
          network to spoof it and in order to exploit this bot or have at least the same ip
          to the config.

Check method (fingerprinting):
connect

    res = register(sock)
    if res =~ /463/ || res =~ /464/
      vprint_error("#{rhost}:#{rport}  - Connection to the IRC Server not allowed")
      return Exploit::CheckCode::Unknown('Connection to the IRC server not allowed')
    end

    res = join(sock)
    if res !~ /353/ && res !~ /366/
      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    quit(sock)
    disconnect

    if res =~ /auth/ && res =~ /logged in/
      Exploit::CheckCode::Vulnerable('Bot responded with auth and logged in confirmation')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Hashicorp Consul Remote Command Execution via Services API
Type: exploit
Path: modules/exploits/multi/misc/consul_service_exec.rb
Platform: linux
Disclosure date: 2018-08-11
References: URL-https://www.consul.io/api/agent/service.html, URL-https://github.com/torque59/Garfield

Description:
This module exploits Hashicorp Consul's services API to gain remote command
          execution on Consul nodes.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/v1/agent/self'),
      'headers' => {
        'X-Consul-Token' => datastore['ACL_TOKEN']
      }
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 200
      vprint_error 'Unexpected reply'
      return CheckCode::Unknown('Unexpected HTTP reply')
    end

    agent_info = JSON.parse(res.body)

    if agent_info['Config']['EnableScriptChecks'] == true || agent_info['DebugConfig']['EnableScriptChecks'] == true || agent_info['DebugConfig']['EnableRemoteScriptChecks'] == true
      return CheckCode::Vulnerable('EnableScriptChecks or EnableRemoteScriptChecks is true')
    end

    CheckCode::Safe('The target is not vulnerable')
  rescue JSON::ParserError
    vprint_error 'Failed to parse JSON output.'
    return CheckCode::Unknown('Failed to parse response')
  end
Metasploit Module: HashiCorp Nomad Remote Command Execution
Type: exploit
Path: modules/exploits/multi/misc/nomad_exec.rb
Platform: linux
Disclosure date: 2021-05-17
References: URL-https://www.nomadproject.io/

Description:
Create a batch job on HashiCorp's Nomad service to spawn a shell. The default option
          is to use the 'raw_exec' driver, which runs with high privileges. Development servers
          and client's explicitly enabling the 'raw_exec' plugin can spawn these type of jobs.
          Regular 'exec' jobs can be created in a similar fashion at a lower privilege level.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/v1/agent/self'),
      'headers' => {
        'X-Nomad-Token' => datastore['ACL_TOKEN']
      }
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 200
      vprint_error 'Unexpected reply'
      return CheckCode::Unknown('Unexpected HTTP reply')
    end

    agent_info = JSON.parse(res.body)

    if agent_info['config']['Plugins']
      agent_info['config']['Plugins'].each do |plugin|
        if plugin['Name'] == 'raw_exec' && plugin['Config']['enabled'] == true
          return CheckCode::Vulnerable('raw_exec plugin is enabled')
        end
      end
    end

    if agent_info['config']['Client']['Options']['driver.raw_exec.enable'] == 'true' || agent_info['config']['Client']['Options']['driver.raw_exec.enable'] == '1'
      return CheckCode::Vulnerable('driver.raw_exec.enable is set to true')
    end

    if datastore['JOB_TYPE'] == 'raw_exec' && agent_info['config']['Client']['DisableRemoteExec'] == false
      print_status 'raw_exec doesn\'t appear to be supported. Try setting JOB_TYPE to exec instead.'
      return CheckCode::Appears('DisableRemoteExec is false but raw_exec may not be supported')
    elsif datastore['JOB_TYPE'] == 'exec' && agent_info['config']['Client']['DisableRemoteExec'] == false
      return CheckCode::Vulnerable('DisableRemoteExec is false and exec driver is
Metasploit Module: JBOSS EAP/AS Remoting Unified Invoker RCE
Type: exploit
Path: modules/exploits/multi/misc/jboss_remoting_unified_invoker_rce.rb
Platform: unix
Disclosure date: 2019-12-11
References: URL-https://s3.amazonaws.com/files.joaomatosf.com/slides/alligator_slides.pdf
Targets: Unix Command, Linux Dropper

Description:
An unauthenticated attacker with network access to the JBOSS
          EAP/AS <= 6.x Remoting Unified Invoker interface can send a
          serialized object to the interface to execute code on vulnerable hosts.

Check method (fingerprinting):
connect
    sock.put(handshake_data)
    data = sock.get_once(16)
    disconnect
    return Exploit::CheckCode::Appears('Target responded with Java serialization handshake') if data == handshake_data

    return Exploit::CheckCode::Safe('Target did not respond with expected Java serialization handshake')
  rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError => e
    print_error("Error to connect #{rhost}:#{rport} : '#{e.class}' '#{e}'")
    return Exploit::CheckCode::Unknown('Connection error')
  end

  # def exploit
Metasploit Module: PHP IRC Bot pbot eval() Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/pbot_exec.rb
Platform: %w{unix win}
Disclosure date: 2009-11-02
References: OSVDB-84913, EDB-20168, URL-http://resources.infosecinstitute.com/pbot-analysis/

Description:
This module allows remote command execution on the PHP IRC bot pbot by abusing
          the usage of eval() in the implementation of the .php command. In order to work,
          the data to connect to the IRC server and channel where find pbot must be provided.
          The module has been successfully tested on the version of pbot analyzed by Jay
          Turla, and published on Infosec Institute, running over Ubuntu 10.04 and Windows XP
          SP3.

Check method (fingerprinting):
connect

    response = register(sock)
    if response =~ /463/ or response =~ /464/
      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
      return Exploit::CheckCode::Unknown('Connection to the IRC server not allowed')
    end

    response = join(sock)
    if not response =~ /353/ and not response =~ /366/
      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
      return Exploit::CheckCode::Unknown('Connection failed')
    end
    response = pbot_login(sock)
    quit(sock)
    disconnect

    if response =~ /auth/ and response =~ /logged in/
      return Exploit::CheckCode::Vulnerable('Bot responded with auth and logged in confirmation')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Western Digital Arkeia Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/arkeia_agent_exec.rb
Platform: win
Disclosure date: 2015-07-10
References: CVE-2015-7709, EDB-37600, URL-https://seclists.org/fulldisclosure/2015/Jul/54
Targets: Windows, Linux

Description:
This module exploits a code execution flaw in Western Digital Arkeia version 11.0.12 and below.
          The vulnerability exists in the 'arkeiad' daemon listening on TCP port 617. Because there are
          insufficient checks on the authentication of all clients, this can be bypassed.
          Using the ARKFS_EXEC_CMD operation it's possible to execute arbitrary commands with root or
          SYSTEM privileges.
          The daemon is installed on both the Arkeia server as well on all the backup clients. The module
          has been successfully tested on Windows, Linux, OSX, FreeBSD and OpenBSD.

Check method (fingerprinting):
connect

    req = "\x00\x41"
    req << "\x00" * 5
    req << "\x73"
    req << "\x00" * 12
    req << "\xc0\xa8\x02\x74"
    req << "\x00" * 56
    req << "\x74\x02\xa8\xc0"
    req << 'ARKADMIN'
    req << "\x00"
    req << 'root'
    req << "\x00"
    req << 'root'
    req << "\x00" * 3
    req << '4.3.0-1' # version?
    req << "\x00" * 11

    sock.put(req)

    header = sock.get_once(6)
    unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"
      disconnect
      return Exploit::CheckCode::Unknown('Unexpected response from Arkeia agent')
    end

    data_length = sock.get_once(2)

    unless data_length && data_length.length == 2
      disconnect
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    data_length = data_length.unpack('n')[0]

    data = sock.get_once(data_length)
    unless data && data.length == data_length
      disconnect
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    req = "\x00\x73"
    req << "\x00" * 5
    req << "\x0c\x32"
    req << "\x00" * 11

    sock.put(req)
    header = sock.get_once(6)
    unless header && header.length == 6 && header[0, 4] == "\x00\x60\x00\x04"
      disconnect
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    data_length = sock.get_once(2)

    unless data_length && data_length.length == 2
      disconnect
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    data_length = data_length.unpack('n')[0]
Metasploit Module: w3tw0rk / Pitbul IRC Bot  Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/w3tw0rk_exec.rb
Platform: %w{unix win}
Disclosure date: 2015-06-04
References: OSVDB-120384, EDB-36652

Description:
This module allows remote command execution on the w3tw0rk / Pitbul IRC Bot.

Check method (fingerprinting):
connect

    res = register(sock)
    if res =~ /463/ || res =~ /464/
      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
      return Exploit::CheckCode::Unknown('Connection to the IRC server not allowed')
    end

    res = join(sock)
    if res !~ /353/ && res !~ /366/
      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    quit(sock)
    disconnect

    if res =~ /auth/ && res =~ /logged in/
      Exploit::CheckCode::Vulnerable('Bot responded with auth and logged in confirmation')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end