deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Safari User-Assisted Download and Run Attack
Type: exploit
Path: modules/exploits/osx/browser/safari_user_assisted_download_launch.rb
Platform: osx
Disclosure date: 2014-03-10
Targets: Mac OS X x86 (Native Payload), Mac OS X x64 (Native Payload)

Description:
This module abuses some Safari functionality to force the download of a
          zipped .app OSX application containing our payload. The app is then
          invoked using a custom URL scheme. At this point, the user is presented
          with Gatekeeper's prompt:

          "APP_NAME" is an application downloaded from the internet. Are you sure you
          want to open it?

          If the user clicks "Open", the app and its payload are executed.

          If the user has the "Only allow applications downloaded from Mac App Store
          and identified developers (on by default on OS 10.8+), the user will see
          an error dialog containing "can't be opened because it is from an unidentified
          developer." To work around this issue, you will need to manually build and sign
          an OSX app containing your payload with a custom URL handler called "openurl".

          You can put newlines and unicode in your APP_NAME, although you must be careful not
          to create a prompt that is too tall, or the user will not be able to click
          the buttons, and will have to either logout or kill the CoreServicesUIAgent
          process.
Metasploit Module: Safari Archive Metadata Command Execution
Type: exploit
Path: modules/exploits/osx/browser/safari_metadata_archive.rb
Disclosure date: 2006-02-21
References: CVE-2006-0848, OSVDB-23510, BID-16736
Targets: Automatic

Description:
This module exploits a vulnerability in Safari's "Safe file" feature, which will
          automatically open any file with one of the allowed extensions. This can be abused
          by supplying a zip file, containing a shell script, with a metafile indicating
          that the file should be opened by Terminal.app. This module depends on
          the 'zip' command-line utility.
Metasploit Module: Mac OS X mDNSResponder UPnP Location Overflow
Type: exploit
Path: modules/exploits/osx/mdns/upnp_location.rb
Platform: osx
Disclosure date: 2007-05-25
References: OSVDB-35142, CVE-2007-2386, BID-24144, URL-http://support.apple.com/kb/TA24732
Targets: 10.4.8 x86, 10.4.0 PPC

Description:
This module exploits a buffer overflow that occurs when processing
          specially crafted requests set to mDNSResponder. All Mac OS X systems
          between version 10.4 and 10.4.9 (without the 2007-005 patch) are
          affected.

Check method (fingerprinting):
#
    # TODO: Listen on two service ports, one a single character
    # shorter than the other (i.e 1900 and 19000).  If the copy was
    # truncated by strlcpy, it will connect to the service listening
    # on the shorter port number.
    #
    upnp_port = scan_for_upnp_port()
    if (upnp_port > 0)
      return Exploit::CheckCode::Detected('UPnP service detected via mDNS')
    else
      return Exploit::CheckCode::Unsupported('UPnP service not detected via mDNS')
    end
  end
Metasploit Module: WebSTAR FTP Server USER Overflow
Type: exploit
Path: modules/exploits/osx/ftp/webstar_ftp_user.rb
Platform: osx
Disclosure date: 2004-07-13
References: CVE-2004-0695, OSVDB-7794, BID-10720
Targets: Mac OS X 10.3.4-10.3.6

Description:
This module exploits a stack buffer overflow in the logging routine
          of the WebSTAR FTP server. Reliable code execution is
          obtained by a series of hops through the System library.
Metasploit Module: MacOS X EvoCam HTTP GET Buffer Overflow
Type: exploit
Path: modules/exploits/osx/http/evocam_webserver.rb
Platform: osx
Disclosure date: 2010-06-01
References: CVE-2010-2309, OSVDB-65043, EDB-12835
Targets: Mac OS X 10.5.8 x86, EvoCam 3.6.6, Mac OS X 10.5.8 x86, EvoCam 3.6.7

Description:
This module exploits a stack buffer overflow in the web server provided with the EvoCam
          program for Mac OS X. We use Dino Dai Zovi's exec-from-heap technique to copy the payload
          from the non-executable stack segment to heap memory. Vulnerable versions include 3.6.6,
          3.6.7, and possibly earlier versions as well. EvoCam version 3.6.8 fixes the vulnerability.
Metasploit Module: Remote for Mac Unauthenticated RCE
Type: exploit
Path: modules/exploits/osx/http/remote_for_mac_rce.rb
Platform: unix
Disclosure date: 2025-05-27
Authors: Chokri Hammedi (@blue0x1)
References: CVE-2025-34089

Description:
This module exploits an unauthenticated remote code execution vulnerability in
          Remote for Mac versions up to and including 2025.7 via the /api/executeScript endpoint.
          When authentication is disabled on the target system, it allows attackers to execute
          arbitrary AppleScript commands, which can include shell commands via `do shell script`.
          All versions up to 2025.7 (including patch versions) are vulnerable.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'api', 'getVersion'),
      'method' => 'GET'
    )

    return CheckCode::Unknown('No response from target') unless res&.code == 200

    info = res.get_json_document

    if info.empty?
      return CheckCode::Unknown('Unable to parse JSON from /api/getVersion')
    end

    if info['requires.auth'] == true
      return CheckCode::Safe('Target requires authentication on /api/executeScript')
    end

    version = info['version'].to_s
    if version.empty?
      return CheckCode::Unknown('Could not determine target version')
    end

    target_version = Rex::Version.new(version)
    vulnerable_version = Rex::Version.new('2025.7')

    if target_version <= vulnerable_version
      return CheckCode::Appears("Target version #{version} appears vulnerable")
    else
      return CheckCode::Safe("Target version #{version} is not vulnerable")
    end
  end
Metasploit Module: Morris Worm fingerd Stack Buffer Overflow
Type: exploit
Path: modules/exploits/bsd/finger/morris_fingerd_bof.rb
Platform: bsd
Disclosure date: 1988-11-02
References: URL-https://en.wikipedia.org/wiki/Morris_worm, URL-https://spaf.cerias.purdue.edu/tech-reps/823.pdf, URL-http://computerarcheology.com/Virus/MorrisWorm/, URL-https://github.com/arialdomartini/morris-worm, URL-http://gunkies.org/wiki/Installing_4.3_BSD_on_SIMH

Description:
This module exploits a stack buffer overflow in fingerd on 4.3BSD.

          This vulnerability was exploited by the Morris worm in 1988-11-02.
          Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg.

          Currently, only bsd/vax/shell_reverse_tcp is supported.

Check method (fingerprinting):
token = rand_text_alphanumeric(8..42)

    connect
    sock.put("#{token}\n")
    res = sock.get_once

    return CheckCode::Unknown('No response from finger service') unless res

    if res.include?("Login name: #{token}")
      return CheckCode::Detected('Finger service detected and responding')
    end

    CheckCode::Safe('Finger service did not respond as expected')
  rescue EOFError, Rex::ConnectionError => e
    vprint_error(e.message)
    CheckCode::Unknown("Connection error: #{e.message}")
  ensure
    disconnect
  end
Metasploit Module: Apple iOS MobileMail LibTIFF Buffer Overflow
Type: exploit
Path: modules/exploits/apple_ios/email/mobilemail_libtiff.rb
Platform: osx
Disclosure date: 2006-08-01
Authors: hdm
References: CVE-2006-3459, OSVDB-27723, BID-19283

Description:
This module exploits a buffer overflow in the version of
          libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
          1.1.1 of the Apple iPhone. iPhones which have not had the BSD
          tools installed will need to use a special payload.
Metasploit Module: Safari Webkit Proxy Object Type Confusion
Type: exploit
Path: modules/exploits/apple_ios/browser/webkit_createthis.rb
Platform: apple_ios
Disclosure date: 2018-03-15
References: CVE-2018-4233, CVE-2017-13861, URL-https://github.com/saelo/cve-2018-4233, URL-https://github.com/phoenhex/files/tree/master/exploits/ios-11.3.1, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1417, URL-https://github.com/JakeBlair420/totally-not-spyware/blob/master/root/js/spyware.js

Description:
This module exploits a type confusion bug in the Javascript Proxy object in
          WebKit. The DFG JIT does not take into account that, through the use of a Proxy,
          it is possible to run arbitrary JS code during the execution of a CreateThis
          operation. This makes it possible to change the structure of e.g. an argument
          without causing a bailout, leading to a type confusion (CVE-2018-4233).

          The type confusion leads to the ability to allocate fake Javascript objects,
          as well as the ability to find the address in memory of a Javascript object.
          This allows us to construct a fake JSCell object that can be used to read
          and write arbitrary memory from Javascript.  The module then uses a ROP chain
          to write the first stage shellcode into executable memory within the Safari
          process and kick off its execution.

          The first stage maps the second stage macho (containing CVE-2017-13861) into
          executable memory, and jumps to its entrypoint. The CVE-2017-13861 async_wake
          exploit leads to a kernel task port (TFP0) that can read and write arbitrary
          kernel memory. The processes credential and sandbox structure in the kernel
          is overwritten and the meterpreter payloads code signature hash is added to
          the kernels trust cache, allowing Safari to load and execute the (self-signed)
          meterpreter payload.
Metasploit Module: Safari Webkit JIT Exploit for iOS 7.1.2
Type: exploit
Path: modules/exploits/apple_ios/browser/safari_jit.rb
Platform: apple_ios
Disclosure date: 2016-08-25
References: CVE-2016-4669, CVE-2018-4162, URL-https://github.com/kudima/exploit_playground/tree/master/iPhone3_1_shell, URL-https://www.thezdi.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=882

Description:
This module exploits a JIT optimization bug in Safari Webkit. This allows us to
          write shellcode to an RWX memory section in JavaScriptCore and execute it. The
          shellcode contains a kernel exploit (CVE-2016-4669) that obtains kernel rw,
          obtains root and disables code signing. Finally we download and execute the
          meterpreter payload.
          This module has been tested against iOS 7.1.2 on an iPhone 4.
Metasploit Module: WebKit not_number defineProperties UAF
Type: exploit
Path: modules/exploits/apple_ios/browser/webkit_trident.rb
Platform: apple_ios
Disclosure date: 2016-08-25
References: CVE-2016-4655, CVE-2016-4656, CVE-2016-4657, BID-92651, BID-92652, BID-92653, URL-https://blog.lookout.com/trident-pegasus, URL-https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/, URL-https://www.blackhat.com/docs/eu-16/materials/eu-16-Bazaliy-Mobile-Espionage-in-the-Wild-Pegasus-and-Nation-State-Level-Attacks.pdf, URL-https://github.com/Siguza/PhoenixNonce

Description:
This module exploits a UAF vulnerability in WebKit's JavaScriptCore library.
Metasploit Module: Apple iOS MobileSafari LibTIFF Buffer Overflow
Type: exploit
Path: modules/exploits/apple_ios/browser/safari_libtiff.rb
Platform: osx
Disclosure date: 2006-08-01
Authors: hdm
References: CVE-2006-3459, OSVDB-27723, BID-19283

Description:
This module exploits a buffer overflow in the version of
          libtiff shipped with firmware versions 1.00, 1.01, 1.02, and
          1.1.1 of the Apple iPhone. iPhones which have not had the BSD
          tools installed will need to use a special payload.
Metasploit Module: Apple iOS Default SSH Password Vulnerability
Type: exploit
Path: modules/exploits/apple_ios/ssh/cydia_default_ssh.rb
Platform: unix
Disclosure date: 2007-07-02
References: OSVDB-61284

Description:
This module exploits the default credentials of Apple iOS when it
          has been jailbroken and the passwords for the 'root' and 'mobile'
          users have not been changed.
Metasploit Module: HP-UX LPD Command Execution
Type: exploit
Path: modules/exploits/hpux/lpd/cleanup_exec.rb
Platform: %w[hpux unix
Disclosure date: 2002-08-28
References: CVE-2002-1473, OSVDB-9638, URL-https://web.archive.org/web/[PII_REDACTED]3521/http://archives.neohapsis.com/archives/hp/2002-q3/0064.html

Description:
This exploit abuses an unpublished vulnerability in the
          HP-UX LPD service. This flaw allows an unauthenticated
          attacker to execute arbitrary commands with the privileges
          of the root user. The LPD service is only exploitable when
          the address of the attacking system can be resolved by the
          target. This vulnerability was silently patched with the
          buffer overflow flaws addressed in HP Security Bulletin
          HPSBUX0208-213.
Metasploit Module: Timbuktu Pro Directory Traversal/File Upload
Type: exploit
Path: modules/exploits/windows/motorola/timbuktu_fileupload.rb
Platform: win
Disclosure date: 2008-05-10
References: CVE-2008-1117, OSVDB-43544

Description:
This module exploits a directory traversal vulnerability in Motorola's
          Timbuktu Pro for Windows 8.6.5.
Metasploit Module: Windows Media Services ConnectFunnel Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/mmsp/ms10_025_wmss_connect_funnel.rb
Platform: win
Disclosure date: 2010-04-13
Authors: jduck
References: CVE-2010-0478, OSVDB-63726, MSB-MS10-025, URL-https://www.lexsi.com/abonnes/labs/adviso-cve-2010-0478.txt

Description:
This module exploits a stack buffer overflow in the Windows Media
          Unicast Service version 4.1.0.3930 (NUMS.exe). By sending a specially
          crafted FunnelConnect request, an attacker can execute arbitrary code
          under the "NetShowServices" user account. Windows Media Services 4.1 ships
          with Windows 2000 Server, but is not installed by default.

          NOTE: This service does NOT restart automatically. Successful, as well as
          unsuccessful exploitation attempts will kill the service which prevents
          additional attempts.
Metasploit Module: MS05-017 Microsoft Message Queueing Service Path Overflow
Type: exploit
Path: modules/exploits/windows/dcerpc/ms05_017_msmq.rb
Platform: win
Disclosure date: 2005-04-12
References: CVE-2005-0059, OSVDB-15458, MSB-MS05-017, BID-13112

Description:
This module exploits a stack buffer overflow in the RPC interface
          to the Microsoft Message Queueing service. The offset to the
          return address changes based on the length of the system
          hostname, so this must be provided via the 'HNAME' option.
          Much thanks to snort.org and Jean-Baptiste Marchand's
          excellent MSRPC website.
Metasploit Module: Print Spooler Remote DLL Injection
Type: exploit
Path: modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb
Platform: win
Disclosure date: 2021-06-08
References: CVE-2021-1675, CVE-2021-34527, URL-https://github.com/cube0x0/CVE-2021-1675, URL-https://web.archive.org/web/[PII_REDACTED]2336/https://github.com/afwu/PrintNightmare, URL-https://github.com/calebstewart/CVE-2021-1675/blob/main/CVE-2021-1675.ps1, URL-https://github.com/byt3bl33d3r/ItWasAllADream
Targets: Windows

Description:
The print spooler service can be abused by an authenticated remote attacker to load a DLL through a crafted
          DCERPC request, resulting in remote code execution as NT AUTHORITY\SYSTEM. This module uses the MS-RPRN
          vector which requires the Print Spooler service to be running.

Check method (fingerprinting):
begin
      connect(backend: :ruby_smb)
    rescue Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Failed to connect to the remote service.')
    end

    begin
      smb_login
    rescue Rex::Proto::SMB::Exceptions::LoginError
      return Exploit::CheckCode::Unknown('Failed to authenticate to the remote service.')
    end

    begin
      dcerpc_bind_spoolss
    rescue RubySMB::Error::UnexpectedStatusCode => e
      nt_status = ::WindowsError::NTStatus.find_by_retval(e.status_code.value).first
      if nt_status == ::WindowsError::NTStatus::STATUS_OBJECT_NAME_NOT_FOUND
        print_error("The 'Print Spooler' service is disabled.")
      end
      return Exploit::CheckCode::Safe("The DCERPC bind failed with error #{nt_status.name} (#{nt_status.description}).")
    end

    @target_arch = dcerpc_getarch
    # see: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/e81cbc09-ab05-4a32-ae4a-8ec57b436c43
    if @target_arch == ARCH_X64
      @environment = 'Windows x64'
    elsif @target_arch == ARCH_X86
      @environment = 'Windows NT x86'
    else
      return Exploit::CheckCode::Detected('Successfully bound to the remote service.')
    end

    print_status("Target environment: Windows v#{simple.client.os_version} (#{@target_arch})")

    print_status('Enumerating the installed printer drivers...')
    drivers = enum_printer_drivers(@environment)
    @driver_path = "#{drivers.driver_path.rpartition('\\').first}\\UNIDRV.DLL"
    vprint_status(
Metasploit Module: MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow
Type: exploit
Path: modules/exploits/windows/dcerpc/ms07_065_msmq.rb
Platform: win
Disclosure date: 2007-12-11
References: CVE-2007-3039, OSVDB-39123, MSB-MS07-065

Description:
This module exploits a stack buffer overflow in the RPC interface
          to the Microsoft Message Queueing service. This exploit requires
          the target system to have been configured with a DNS name and
          for that name to be supplied in the 'DNAME' option. This name does
          not need to be served by a valid DNS server, only configured on
          the target machine.
Metasploit Module: MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)
Type: exploit
Path: modules/exploits/windows/dcerpc/ms07_029_msdns_zonename.rb
Platform: win
Disclosure date: 2007-04-12
References: CVE-2007-1748, OSVDB-34100, MSB-MS07-029

Description:
This module exploits a stack buffer overflow in the RPC interface
          of the Microsoft DNS service. The vulnerability is triggered
          when a long zone name parameter is supplied that contains
          escaped octal strings. This module is capable of bypassing NX/DEP
          protection on Windows 2003 SP1/SP2.
Metasploit Module: MS03-026 Microsoft RPC DCOM Interface Overflow
Type: exploit
Path: modules/exploits/windows/dcerpc/ms03_026_dcom.rb
Platform: win
Disclosure date: 2003-07-16
References: CVE-2003-0352, OSVDB-2100, MSB-MS03-026, BID-8205

Description:
This module exploits a stack buffer overflow in the RPCSS service, this vulnerability
          was originally found by the Last Stage of Delirium research group and has been
          widely exploited ever since. This module can exploit the English versions of
          Windows NT 4.0 SP3-6a, Windows 2000, Windows XP, and Windows 2003 all in one request :)

Check method (fingerprinting):
begin
      connect
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
      return CheckCode::Safe("SMB error: #{e.message}")
    end

    handle = dcerpc_handle('4d9f4ab8-7d1c-11cf-861e-0020af6e7c57', '0.0', 'ncacn_ip_tcp', [rport])

    begin
      dcerpc_bind(handle)
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
      return CheckCode::Safe("SMB error: #{e.message}")
    end

    CheckCode::Detected('DCOM service detected via DCE/RPC bind')
  end
Metasploit Module: UltraVNC 1.0.1 Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/vnc/ultravnc_client.rb
Platform: win
Disclosure date: 2006-04-04
Authors: MC
References: CVE-2006-1652, OSVDB-24456, BID-17378

Description:
This module exploits a buffer overflow in UltraVNC Win32
          Viewer 1.0.1 Release.
Metasploit Module: RealVNC 3.3.7 Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/vnc/realvnc_client.rb
Platform: win
Disclosure date: 2001-01-29
Authors: MC
References: CVE-2001-0167, OSVDB-6281, BID-2305

Description:
This module exploits a buffer overflow in RealVNC 3.3.7 (vncviewer.exe).
Metasploit Module: WinVNC Web Server GET Overflow
Type: exploit
Path: modules/exploits/windows/vnc/winvnc_http_get.rb
Platform: win
Disclosure date: 2001-01-29
Authors: aushack
References: BID-2306, OSVDB-6280, CVE-2001-0168

Description:
This module exploits a buffer overflow in the AT&T WinVNC version
          <= v3.3.3r7 web server. When debugging mode with logging is
          enabled (non-default), an overly long GET request can overwrite
          the stack. This exploit does not work well with VNC payloads!
Metasploit Module: UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow
Type: exploit
Path: modules/exploits/windows/vnc/ultravnc_viewer_bof.rb
Platform: win
Disclosure date: 2008-02-06
Authors: noperand
References: CVE-2008-0610, OSVDB-42840, BID-27561

Description:
This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release.

          If a malicious server responds to a client connection indicating a minor
          protocol version of 14 or 16, a 32-bit integer is subsequently read from
          the TCP stream by the client and directly provided as the trusted size for
          further reading from the TCP stream into a 1024-byte character array on
          the stack.
Metasploit Module: Veritas Backup Exec Windows Remote Agent Overflow
Type: exploit
Path: modules/exploits/windows/backupexec/remote_agent.rb
Platform: win
Disclosure date: 2005-06-22
References: CVE-2005-0773, OSVDB-17624, BID-14022, URL-http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities

Description:
This module exploits a stack buffer overflow in the Veritas
          BackupExec Windows Agent software. This vulnerability occurs
          when a client authentication request is received with type
          '3' and a long password argument. Reliable execution is
          obtained by abusing the stack buffer overflow to smash a SEH
          pointer.

Check method (fingerprinting):
info = ndmp_info
    if (info and info['Version'])
      vprint_status(" Vendor: #{info['Vendor']}")
      vprint_status("Product: #{info['Product']}")
      vprint_status("Version: #{info['Version']}")

      if (info['Vendor'] =~ /VERITAS/i and info['Version'] =~ /^(4\.2|5\.1)$/)
        return Exploit::CheckCode::Appears("VERITAS Backup Exec version #{info['Version']} detected")
      end
    end
    return Exploit::CheckCode::Safe('VERITAS Backup Exec vulnerable version not detected')
  end
Metasploit Module: Veritas Backup Exec Name Service Overflow
Type: exploit
Path: modules/exploits/windows/backupexec/name_service.rb
Platform: win
Disclosure date: 2004-12-16
References: CVE-2004-1172, OSVDB-12418, BID-11974, URL-http://www.idefense.com/application/poi/display?id=169&type=vulnerabilities

Description:
This module exploits a vulnerability in the Veritas Backup
          Exec Agent Browser service. This vulnerability occurs when a
          recv() call has a length value too long for the	destination
          stack buffer. By sending an agent name value of 63 bytes or
          more, we can overwrite the return address of the recv
          function. Since we only have ~60 bytes of contiguous space
          for shellcode, a tiny findsock payload is sent which uses a
          hardcoded IAT address for the recv() function. This payload
          will then roll the stack back to the beginning of the page,
          recv() the real shellcode into it, and jump to it. This
          module has been tested against Veritas 9.1 SP0, 9.1 SP1, and
          8.6.