deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Plesk/myLittleAdmin ViewState .NET Deserialization
Type: exploit
Path: modules/exploits/windows/http/plesk_mylittleadmin_viewstate.rb
Platform: win
Disclosure date: 2020-05-15
References: CVE-2020-13166, URL-https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/, URL-https://portswigger.net/daily-swig/mylittleadmin-has-a-big-unpatched-security-flaw
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a ViewState .NET deserialization vulnerability in
          web-based MS SQL Server management tool myLittleAdmin, for version 3.8
          and likely older versions, due to hardcoded <machineKey> parameters in
          the web.config file for ASP.NET.

          Popular web hosting control panel Plesk offers myLittleAdmin as an
          optional component that is selected automatically during "full"
          installation. This exploit caters to the Plesk target, though it
          should work fine against a standalone myLittleAdmin setup.

          Successful exploitation results in code execution as the user running
          myLittleAdmin, which is IUSRPLESK_sqladmin for Plesk and described as
          the "SQL Admin MSSQL anonymous account."

          Tested on the latest Plesk Obsidian with optional myLittleAdmin 3.8.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && res.body.include?('myLittleAdmin for SQL Server')
      return CheckCode::Unknown('Target is not running myLittleAdmin.')
    end

    vprint_good("myLittleAdmin is running at #{full_uri}")
    check_viewstate(res.get_html_document)
  end
Metasploit Module: Easy Chat Server User Registeration Buffer Overflow (SEH)
Type: exploit
Path: modules/exploits/windows/http/easychatserver_seh.rb
Platform: win
Disclosure date: 2017-10-09
References: CVE-2017-9544, EDB-42155

Description:
This module exploits a buffer overflow during user registration in Easy Chat Server software.
Metasploit Module: Webster HTTP Server GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/webster_http.rb
Platform: win
Disclosure date: 2002-12-02
References: CVE-2002-2268, OSVDB-44106, BID-6289, URL-http://www.microsoft.com/msj/archive/s25f.aspx, URL-http://www.netdave.com/webster/webster.htm

Description:
This exploits a stack buffer overflow in the Webster HTTP server.
          The server and source code was released within an article from
          the Microsoft Systems Journal in February 1996 titled "Write a
          Simple HTTP-based Server Using MFC and Windows Sockets".
Metasploit Module: HP OpenView NNM 7.53, 7.51 OVAS.EXE Pre-Authentication Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovas.rb
Platform: win
Disclosure date: 2008-04-02
References: CVE-2008-1697, OSVDB-43992, BID-28569

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager versions 7.53 and earlier.
          Specifically this vulnerability is caused by a failure to properly handle user supplied input within the
          HTTP request including headers and the actual URL GET request.

          Exploitation is tricky due to character restrictions. It was necessary to utilize a egghunter shellcode
          which was alphanumeric encoded by muts in the original exploit.

          If you plan on using exploit this for a remote shell, you will likely want to migrate to a different process
          as soon as possible. Any connections get reset after a short period of time. This is probably some timeout
          handling code that causes this.

Check method (fingerprinting):
resp = send_request_raw({ 'uri' => '/topology/home' }, 5)
    if resp.nil?
      vprint_status("No response to request")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if (resp.body =~ /NNM Release B\.07\.53/ || resp.body =~ /NNM Release B\.07\.52/ || resp.body =~ /NNM Release B\.07\.51/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: FlexDotnetCMS Arbitrary ASP File Upload
Type: exploit
Path: modules/exploits/windows/http/flexdotnetcms_upload_exec.rb
Platform: win
Disclosure date: 2020-09-28
References: CVE-2020-27386
Targets: Windows (x86), Windows (x64)

Description:
This module exploits an arbitrary file upload vulnerability in
          FlexDotnetCMS v1.5.8 and prior in order to execute arbitrary
          commands with elevated privileges.

          The module first tries to authenticate to FlexDotnetCMS via an HTTP
          POST request to `/login`. It then attempts to upload a random TXT
          file and subsequently uses the FlexDotnetCMS file editor to rename
          the TXT file to an ASP file. If this succeeds, the target is
          vulnerable and the ASP file is generated as a copy of the TXT file,
          which remains on the server.

          Next, the module sends another request to rename the TXT file to an
          ASP file, this time adding the payload. Finally, the module tries
          to execute the ASP payload via a simple HTTP GET request to
          `/media/uploads/asp_payload`

          Valid credentials for a FlexDotnetCMS user with permissions to use
          the FileManager are required. This module has been successfully
          tested against FlexDotnetCMS v1.5.8 running on Windows Server 2012.

Check method (fingerprinting):
# used to ensure cleanup only runs against flexdotnetcms targets
    @skip_cleanup = true

    # visit login the page to get the necessary cookies
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'login/'),
      'keep_cookies' => true
    })

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    # the login page doesn't contain the name of the app or the author, so we're combining a bunch of checks to limit the odds of failing to flag an incorrect target
    unless res.code == 200 && res.body.include?('<title>Login - Home</title>') && res.body.include?('<label>Email</label><br>') && res.body.include?('>Forgot my password</a>')
      return CheckCode::Safe('Target is not a FlexDotnetCMS application.')
    end

    # get cookies and tokens necessary for authentication
    html = res.get_html_document
    viewstate_key = html.at('input[@id="__VIEWSTATEKEY"]')
    event_validation = html.at('input[@id="__EVENTVALIDATION"]')
    if viewstate_key.blank? || event_validation.blank? # check if tokens exist before calling their values
      return CheckCode::Detected('Received unexpected response while trying to obtain tokens necessary for authentication from /login')
    end

    viewstate_key = viewstate_key['value']
    event_validation = event_validation['value']

    # perform login to verify if the target is a FlexDotnetCMS application
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_u
Metasploit Module: CA iTechnology iGateway Debug Mode Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ca_igateway_debug.rb
Platform: win
Disclosure date: 2005-10-06
Authors: aushack
References: CVE-2005-3190, OSVDB-19920, URL-http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=33485, EDB-1243, BID-15025

Description:
This module exploits a vulnerability in the Computer Associates
          iTechnology iGateway component. When <Debug>True</Debug> is enabled
          in igateway.conf (non-default), it is possible to overwrite the stack
          and execute code remotely. This module works best with Ordinal payloads.

Check method (fingerprinting):
connect
    sock.put("HEAD / HTTP/1.0\r\nHost: #{rhost}\r\n\r\n")
    banner = sock.get_once

    if (banner.to_s =~ /GET and POST methods are the only methods supported at this time/) # Unique?
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Dup Scout Enterprise Login Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/dup_scout_enterprise_login_bof.rb
Platform: win
Disclosure date: 2017-11-14
Authors: bcoles, bcoles
References: CVE-2017-13696, EDB-42557, EDB-43145, EDB-40832

Description:
This module exploits a stack buffer overflow in Dup Scout Enterprise
          versions <= 10.0.18. The buffer overflow exists via the web interface
          during login. This gives NT AUTHORITY\SYSTEM access.

          This module has been tested successfully on Dup Scout Enterprise
          versions:

          9.9.14 on Windows 7 SP1 (x64);
          9.9.14 on Windows XP SP0 (x64);
          10.0.18 on Windows 7 SP1 (x64);
          10.0.18 on Windows XP SP0 (x86); and
          10.0.18 on Windows 10 (1909) (x64).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    version = res.body.scan(/>Dup Scout Enterprise v([\d.]+)</).flatten.first

    unless version
      return CheckCode::Safe('Target is not Dup Scout Enterprise.')
    end

    unless target_for_version(version)
      return CheckCode::Detected("No targets for Dup Scout Enterprise version #{version}.")
    end

    CheckCode::Appears("Dup Scout Enterprise version #{version}.")
  end
Metasploit Module: HP OpenView Performance Insight Server Backdoor Account Code Execution
Type: exploit
Path: modules/exploits/windows/http/hp_openview_insight_backdoor.rb
Platform: win
Disclosure date: 2011-01-31
References: CVE-2011-0276, OSVDB-70754
Targets: Universal Windows Target

Description:
This module exploits a hidden account in the com.trinagy.security.XMLUserManager Java
          class. When using this account, an attacker can abuse the
          com.trinagy.servlet.HelpManagerServlet class and write arbitrary files to the system
          allowing the execution of arbitrary code.

          NOTE: This module has only been tested against HP OpenView Performance Insight Server 5.41.0
Metasploit Module: Apache Tika Header Command Injection
Type: exploit
Path: modules/exploits/windows/http/apache_tika_jp2_jscript.rb
Platform: win
Disclosure date: 2018-04-25
References: EDB-46540, URL-https://rhinosecuritylabs.com/application-security/exploiting-cve-2018-1335-apache-tika/, URL-https://lists.apache.org/thread.html/b3ed4432380af767effd4c6f27665cc7b2686acccbefeb9f55851dca@%3Cdev.tika.apache.org%3E, CVE-2018-1335
Targets: Windows

Description:
This module exploits a command injection vulnerability in Apache
          Tika 1.15 - 1.17 on Windows.  A file with the image/jp2 content-type is
          used to bypass magic bytes checking.  When OCR is specified in the
          request, parameters can be passed to change the parameters passed
          at command line to allow for arbitrary JScript to execute. A
          JScript stub is passed to execute arbitrary code. This module was
          verified against version 1.15 - 1.17 on Windows 2012.
          While the CVE and finding show more versions vulnerable, during
          testing it was determined only > 1.14 was exploitable due to
          jp2 support being added.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri),
    })
    if res.nil?
      vprint_error('No server response, check configuration')
      return CheckCode::Safe('No server response')
    elsif res.code != 200
      vprint_error('No server response, check configuration')
      return CheckCode::Safe('Unexpected response code from target')
    end

    if res.body =~ /Apache Tika (\d.[\d]+)/
      version = Rex::Version.new($1)
      vprint_status("Apache Tika Version Detected: #{version}")
      if version.between?(Rex::Version.new('1.15'), Rex::Version.new('1.17'))
        return CheckCode::Vulnerable("Target is vulnerable based on version: #{version}")
      end
    end
    CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Telerik Report Server Auth Bypass and Deserialization RCE
Type: exploit
Path: modules/exploits/windows/http/telerik_report_server_deserialization.rb
Platform: win
Disclosure date: 2024-06-04
References: CVE-2024-1800, CVE-2024-4358, URL-https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/

Description:
This module chains an authentication bypass vulnerability (CVE-2024-4358) with a deserialization vulnerability
          (CVE-2024-1800) to obtain remote code execution against Telerik Report Server version 10.0.24.130 and prior.
          The authentication bypass flaw allows an unauthenticated user to create a new user with administrative privileges.
          The USERNAME datastore option can be used to authenticate with an existing account to prevent the creation of a
          new one. The deserialization flaw works by uploading a specially crafted report that when loaded will execute an
          OS command as NT AUTHORITY\SYSTEM. The module will automatically delete the created report but not the account
          because users are unable to delete themselves.

Check method (fingerprinting):
check_code = super

    if check_code == CheckCode::Appears
      # The auth bypass affects later versions than the RCE, so just filter those out
      version = check_code.details[:version]
      if version > Rex::Version.new('10.0.24.130')
        return CheckCode::Safe("Telerik Report Server #{version} is not affected by CVE-2024-1800.", details: check_code.details)
      end
    end

    check_code
  end
Metasploit Module: HP OpenView Network Node Manager OvWebHelp.exe CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovwebhelp.rb
Platform: win
Disclosure date: 2009-12-09
References: CVE-2009-4178, OSVDB-60929, BID-37340

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
          By sending a specially crafted CGI request to OvWebHelp.exe, an attacker may be able to execute
          arbitrary code.
Metasploit Module: HP AutoPass License Server File Upload
Type: exploit
Path: modules/exploits/windows/http/hp_autopass_license_traversal.rb
Platform: %w{java}
Disclosure date: 2014-01-10
References: CVE-2013-6221, ZDI-14-195, BID-67989, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04333125

Description:
This module exploits a code execution flaw in HP AutoPass License Server. It abuses two
          weaknesses in order to get its objective. First, the AutoPass application doesn't enforce
          authentication in the CommunicationServlet component. Second, it's possible to abuse a
          directory traversal when uploading files thorough the same component, allowing to upload
          an arbitrary payload embedded in a JSP. The module has been tested successfully on
          HP AutoPass License Server 8.01 as installed with HP Service Virtualization 3.50.

Check method (fingerprinting):
check_code = Exploit::CheckCode::Safe('Target is not vulnerable')

    res = send_request_cgi(
      {
        'uri' => normalize_uri(target_uri.path.to_s, "cs", "pdfupload"),
        'method' => 'POST'
      }
    )

    unless res
      check_code = Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res && res.code == 500 &&
       res.body.to_s.include?("HP AutoPass License Server") &&
       res.body.to_s.include?("java.lang.NullPointerException") &&
       res.body.to_s.include?("com.hp.autopass")

      check_code = Exploit::CheckCode::Detected('Target service detected')
    end

    check_code
  end
Metasploit Module: Rhinosoft Serv-U Session Cookie Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/servu_session_cookie.rb
Platform: win
Disclosure date: 2009-11-01
References: CVE-2009-4006, OSVDB-59772, URL-http://rangos.de/ServU-ADV.txt

Description:
This module exploits a buffer overflow in Rhinosoft Serv-U 9.0.0.5.
          Sending a specially crafted POST request with an overly long session cookie
          string, an attacker may be able to execute arbitrary code.

Check method (fingerprinting):
connect
    sock.put("\r\n\r\n") # works
    res = sock.get_once
    disconnect

    if (res.to_s =~ /Server: Serv-U\/9\.0\.0\.5/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    elsif (res.to_s =~ /Server: Serv-U/)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Serviio Media Server checkStreamUrl Command Execution
Type: exploit
Path: modules/exploits/windows/http/serviio_checkstreamurl_cmd_exec.rb
Platform: win
Disclosure date: 2017-05-03
References: CVE-2025-34101, OSVDB-41961, URL-http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php, URL-https://blogs.securiteam.com/index.php/archives/3094

Description:
This module exploits an unauthenticated remote command execution vulnerability
          in the console component of Serviio Media Server versions 1.4 to 1.8 on
          Windows operating systems.

          The console service (on port 23423 by default) exposes a REST API which
          which does not require authentication.

          The 'action' API endpoint does not sufficiently sanitize user-supplied data
          in the 'VIDEO' parameter of the 'checkStreamUrl' method. This parameter is
          used in a call to cmd.exe resulting in execution of arbitrary commands.

          This module has been tested successfully on Serviio Media Server versions
          1.4.0, 1.5.0, 1.6.0 and 1.8.0 on Windows 7.

Check method (fingerprinting):
res = execute_command('')

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.headers['Server'] !~ /Serviio/
      vprint_status 'Target is not a Serviio Media Server'
      return CheckCode::Safe('Target is not vulnerable')
    end

    if res.headers['Server'] !~ /Windows/
      vprint_status 'Target operating system is not vulnerable'
      return CheckCode::Safe('Target is not vulnerable')
    end

    if res.code != 200 || res.body !~ %r{<errorCode>603</errorCode>}
      vprint_status 'Unexpected reply'
      return CheckCode::Safe('Target is not vulnerable')
    end

    if res.headers['Server'] =~ %r{Serviio/(1\.[4-8])}
      vprint_status "#{peer} Serviio Media Server version #{$1}"
      return CheckCode::Appears('Target appears to be vulnerable')
    end

    CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: HP OpenView Network Node Manager Toolbar.exe CGI Cookie Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_toolbar_02.rb
Platform: win
Disclosure date: 2009-01-21
Authors: sinn3r
References: CVE-2009-0920, OSVDB-53242, BID-34294, URL-http://www.coresecurity.com/content/openview-buffer-overflows

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.0
          and 7.53.  By sending a CGI request with a specially OvOSLocale cookie to Toolbar.exe, an
          attacker may be able to execute arbitrary code.  Please note that this module only works
          against a specific build (i.e. NNM 7.53_01195)
Metasploit Module: McAfee ePolicy Orchestrator / ProtectionPilot Overflow
Type: exploit
Path: modules/exploits/windows/http/mcafee_epolicy_source.rb
Platform: win
Disclosure date: 2006-07-17
References: CVE-2006-5156, OSVDB-29421, EDB-2467, BID-20288

Description:
This is an exploit for the McAfee HTTP Server (NAISERV.exe).
          McAfee ePolicy Orchestrator 2.5.1 <= 3.5.0 and ProtectionPilot 1.1.0 are
          known to be vulnerable. By sending a large 'Source' header, the stack can
          be overwritten. This module is based on the exploit by xbxice and muts.
          Due to size constraints, this module uses the Egghunter technique.

Check method (fingerprinting):
connect

    req = "GET /SITEINFO.INI HTTP/1.0\r\n"
    req << "User-Agent: Mozilla/5.0\r\n\r\n"
    sock.put(req)

    banner = sock.get_once

    if banner.to_s =~ /Spipe\/1\.0/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: PHP apache_request_headers Function Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/php_apache_request_headers_bof.rb
Platform: win
Disclosure date: 2012-05-08
References: CVE-2012-2329, OSVDB-82215, BID-53455, URL-http://www.php.net/archive/2012.php#id2012-05-08-1, URL-http://www.php.net/ChangeLog-5.php#5.4.3, URL-https://bugzilla.redhat.com/show_bug.cgi?id=820000

Description:
This module exploits a stack based buffer overflow in the CGI version of PHP
          5.4.x before 5.4.3. The vulnerability is due to the insecure handling of the
          HTTP headers.

          This module has been tested against the thread safe version of PHP 5.4.2,
          from "windows.php.net", running with Apache 2.2.22 from "apachelounge.com".
Metasploit Module: ManageEngine Applications Manager Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/manageengine_appmanager_exec.rb
Platform: win
Disclosure date: 2018-03-07
References: CVE-2018-7890, BID-103358, URL-https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/, URL-https://pitstop.manageengine.com/portal/community/topic/security-vulnerability-issues-fixed-upgrade-to-the-latest-version-of-applications-manager

Description:
This module exploits command injection vulnerability in the ManageEngine Application Manager product.
          An unauthenticated user can execute a operating system command under the context of privileged user.

          Publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials
          by accessing given system. This endpoint calls a several internal classes and then executes powershell script
          without validating user supplied parameter when the given system is OfficeSharePointServer.

Check method (fingerprinting):
res = trigger_endpoint(Rex::Text.rand_text_alpha(3))
    if res && res.body.include?('Kindly check the credentials and try again')
      Exploit::CheckCode::Vulnerable('Target is vulnerable')
    else
      Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Windows Server Update Service Deserialization Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/wsus_deserialization_rce.rb
Platform: win
Disclosure date: 2025-10-14
References: URL-https://code-white.com/blog/wsus-cve-2025-59287-analysis/, CVE-2025-59287

Description:
This module exploits deserialization vulnerability in legacy serialization mechanism in Windows Server Update Services (WSUS). The vulnerability allows unauthenticated attacker to create specially crafted event, which triggers unsafe deserialization upon server synchronization. The module does not require any other options and upon successful exploitation, the payload is executed in context of administrator.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET'
    })
    return CheckCode::Safe('Target does not run WSUS') unless res&.code == 200 && res.headers['Server'] == 'Microsoft-IIS/10.0'

    CheckCode::Detected('Target is probably running WSUS')
  end