deardaniel/secdata-raw huggingface dataset:
Metasploit Module: SpamTitan Unauthenticated RCE
Type: exploit
Path: modules/exploits/freebsd/webapp/spamtitan_unauth_rce.rb
Platform: unix
Disclosure date: 2020-04-17
References: EDB-48856, URL-https://www.titanhq.com/spamtitan/spamtitangateway/, CVE-2020-11698
Targets: Unix In-Memory, FreeBSD Dropper (x64), FreeBSD Dropper (x86)

Description:
TitanHQ SpamTitan Gateway is an anti-spam appliance that protects against
          unwanted emails and malwares. This module exploits an improper input
          sanitization in versions 7.01, 7.02, 7.03 and 7.07 to inject command directives
          into the SNMP configuration file and get remote code execution as root. Note
          that only version 7.03 needs authentication and no authentication is required
          for versions 7.01, 7.02 and 7.07.

          First, it sends an HTTP POST request to the `snmp-x.php` page with an `SNMPD`
          command directives (`extend` + command) passed to the `community` parameter.
          This payload is then added to `snmpd.conf` by the application. Finally, the
          module triggers the execution of this command by querying the SNMP server for
          the correct OID.

          This exploit module has been successfully tested against versions 7.01, 7.02,
          7.03, and 7.07.

Check method (fingerprinting):
snmp_x_uri = normalize_uri(target_uri.path, 'snmp-x.php')
    vprint_status("Check if #{snmp_x_uri} exists")
    res = send_request_cgi(
      'uri' => snmp_x_uri,
      'method' => 'GET'
    )

    if res.nil?
      return Exploit::CheckCode::Unknown.new(
        "Could not connect to SpamTitan vulnerable page (#{snmp_x_uri}) - no response"
      )
    end

    if res.code == 302
      vprint_status(
        'This version of SpamTitan requires authentication. Trying with the '\
        'provided credentials.'
      )
      res = send_request_cgi(
        'uri' => '/index.php',
        'method' => 'POST',
        'vars_post' => {
          'jaction' => 'none',
          'language' => 'en_US',
          'address' => datastore['USERNAME'],
          'passwd' => datastore['PASSWORD']
        }
      )
      if res.nil?
        return Exploit::CheckCode::Safe.new('Unable to authenticate - no response')
      end

      if res.code == 200 && res.body =~ /Invalid username or password/
        return Exploit::CheckCode::Safe.new(
          'Unable to authenticate - Invalid username or password'
        )
      end
      unless res.code == 302
        return Exploit::CheckCode::Unknown.new(
          "Unable to authenticate - Unexpected HTTP response code: #{res.code}"
        )
      end

      # For whatever reason, the web application sometimes returns multiple
      # PHPSESSID cookies and only the last one is valid. So, make sure only
      # the valid one is part of the cookie_
Metasploit Module: FreeBSD Telnet Service Encryption Key ID Buffer Overflow
Type: exploit
Path: modules/exploits/freebsd/telnet/telnet_encrypt_keyid.rb
Platform: bsd
Disclosure date: 2011-12-23
References: CVE-2011-4862, OSVDB-78020, BID-51182, EDB-18280

Description:
This module exploits a buffer overflow in the encryption option handler of the
          FreeBSD telnet service.
Metasploit Module: ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (FreeBSD)
Type: exploit
Path: modules/exploits/freebsd/ftp/proftp_telnet_iac.rb
Disclosure date: 2010-11-01
References: CVE-2010-4221, OSVDB-68985, BID-44562

Description:
This module exploits a stack-based buffer overflow in versions of ProFTPD
          server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a
          large number of Telnet IAC commands, an attacker can corrupt memory and
          execute arbitrary code.

Check method (fingerprinting):
# NOTE: We don't care if the login failed here...
    connect
    banner = sock.get_once || ''

    # We just want the banner to check against our targets..
    vprint_status("FTP Banner: #{banner.strip}")

    status = CheckCode::Safe('ProFTPD version does not appear to be vulnerable')
    if banner =~ /ProFTPD (1\.3\.[23])/i
      banner_array = banner.split('.')

      if banner_array.count > 0 && !banner_array[3].nil?
        # gets 1 char on the third part of version number.
        relnum = banner_array[2][0..0]
        tmp = banner_array[2].split(' ')
        # gets extra string info of version number.
        # example: 1.2.3rc ('rc' string)
        extra = tmp[0][1..(tmp[0].length - 1)]
        if relnum == '2'
          if !extra.empty?
            if extra[0..1] == 'rc'
              v = extra[2..extra.length].to_i
              if v && v > 2
                status = CheckCode::Appears("ProFTPD #{banner.strip} appears vulnerable")
              end
            else
              status = CheckCode::Appears("ProFTPD #{banner.strip} appears vulnerable")
            end
          end
        elsif relnum == '3'
          if [ '', 'a', 'b', ].include?(extra)
            status = CheckCode::Appears("ProFTPD #{banner.strip} appears vulnerable")
          end
        end
      end
    end

    disconnect
    return status
  end
Metasploit Module: Watchguard XCS Remote Command Execution
Type: exploit
Path: modules/exploits/freebsd/http/watchguard_cmd_exec.rb
Platform: bsd
Disclosure date: 2015-06-29
References: CVE-2015-5453, URL-http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf

Description:
This module exploits two separate vulnerabilities found in the Watchguard XCS virtual
          appliance to gain command execution. By exploiting an unauthenticated SQL injection, a
          remote attacker may insert a valid web user into the appliance database, and get access
          to the web interface. On the other hand, a vulnerability in the web interface allows the
          attacker to inject operating system commands as the 'nobody' user.

Check method (fingerprinting):
# Check to see if the SQLi is present
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'),
      'cookie' => "sid=1'"
    })

    if res && res.body && res.body.include?('unterminated quoted string')
      return Exploit::CheckCode::Vulnerable('SQL injection confirmed in borderpost')
    end

    Exploit::CheckCode::Safe('SQL injection not detected')
  end
Metasploit Module: Citrix ADC (NetScaler) Forms SSO Target RCE
Type: exploit
Path: modules/exploits/freebsd/http/citrix_formssso_target_rce.rb
Platform: unix
Disclosure date: 2023-07-18
References: CVE-2023-3519, URL-https://attackerkb.com/topics/si09VNJhHh/cve-2023-3519, URL-https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467

Description:
A vulnerability exists within Citrix ADC that allows an unauthenticated attacker to trigger a stack buffer
          overflow of the nsppe process by making a specially crafted HTTP GET request. Successful exploitation results in
          remote code execution as root.

Check method (fingerprinting):
# version 13.x resource path
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'logon', 'LogonPoint', 'index.html')
    })
    return CheckCode::Unknown('No response received from 13.x resource path') if res.nil?

    if res.code == 200 && res.body =~ /<title class="_ctxstxt_NetscalerGateway">/
      mytarget = get_target
      return CheckCode::Appears("Detected #{mytarget.name}.") if mytarget

      return CheckCode::Detected('Citrix Gateway 13.x detected but could not determine specific target')
    end

    # version 12.x resource path
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'vpn', 'index.html')
    })
    return CheckCode::Unknown('No response received from 12.x resource path') if res.nil?

    if res.code == 200 && res.body =~ /Citrix Gateway/ && res.body =~ /AccessGateway\.ico/
      mytarget = get_target
      return CheckCode::Appears("Detected #{mytarget.name}.") if mytarget

      return CheckCode::Detected('Citrix Gateway 12.x detected but could not determine specific target')
    end

    CheckCode::Safe('Citrix Gateway not detected')
  end
Metasploit Module: Junos OS PHPRC Environment Variable Manipulation RCE
Type: exploit
Path: modules/exploits/freebsd/http/junos_phprc_auto_prepend_file.rb
Platform: php
Disclosure date: 2023-08-17
References: URL-https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/, URL-https://vulncheck.com/blog/juniper-cve-2023-36845, URL-https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US, CVE-2023-36845
Targets: PHP In-Memory, Interactive SSH with jail break

Description:
This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls
          and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin
          by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being
          'auto_prepend_file' which causes the provided file to be added using the 'require' function. The second PHP
          function is 'allow_url_include' which allows the use of URL-aware fopen wrappers. By enabling
          allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses
          data:// to provide a file inline which includes the base64 encoded PHP payload.

          By default this exploit returns a session confined to a FreeBSD jail with limited functionality. There is a
          datastore option 'JAIL_BREAK', that when set to true, will steal the necessary tokens from a user authenticated
          to the J-Web application, in order to overwrite the root password hash. If there is no user authenticated
          to the J-Web application this exploit will try to create one. If unsuccesfull this method will not work.
          The module then authenticates with the new root password over SSH and then rewrites the original root password
          hash to /etc/master.passwd. There is an option to set allow ssh root login, if disabled.

Check method (fingerprinting):
non_existent_file = rand_text_alphanumeric(8..16)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'POST',
      'ctype' => 'application/x-www-form-urlencoded',
      'data' => "LD_PRELOAD=/tmp/#{non_existent_file}"
    )

    return CheckCode::Appears('Environment variable manipulation succeeded indicating this target is vulnerable.') if res && res.body.include?("Cannot open \"/tmp/#{non_existent_file}\"")

    CheckCode::Safe('Environment variable manipulation failed indicating this target is not vulnerable.')
  end
Metasploit Module: Citrix ADC (NetScaler) Directory Traversal RCE
Type: exploit
Path: modules/exploits/freebsd/http/citrix_dir_traversal_rce.rb
Platform: python
Disclosure date: 2019-12-17
References: CVE-2019-19781, EDB-47901, EDB-47902, URL-http://web.archive.org/web/[PII_REDACTED]1448/https://support.citrix.com/article/CTX267027, URL-http://web.archive.org/web/[PII_REDACTED]2522/https://www.mdsec.co.uk/2020/01/deep-dive-to-citrix-adc-remote-code-execution-cve-2019-19781/, URL-https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/
Targets: Python, Unix Command

Description:
This module exploits a directory traversal in Citrix Application Delivery Controller (ADC), aka
          NetScaler, and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0, to execute an arbitrary command payload.
Metasploit Module: XTACACSD report() Buffer Overflow
Type: exploit
Path: modules/exploits/freebsd/tacacs/xtacacsd_report.rb
Platform: bsd
Disclosure date: 2008-01-08
Authors: MC
References: CVE-2008-7232, OSVDB-58140, URL-http://aluigi.altervista.org/adv/xtacacsdz-adv.txt

Description:
This module exploits a stack buffer overflow in XTACACSD <= 4.1.2. By
          sending a specially crafted XTACACS packet with an overly long
          username, an attacker may be able to execute arbitrary code.
Metasploit Module: Amazon Web Services EC2 SSM enumeration
Type: auxiliary
Path: modules/auxiliary/cloud/aws/enum_ssm.rb
References: URL-https://www.sempervictus.com/single-post/once-upon-a-cloudy-air-i-crossed-a-gap-which-wasn-t-there

Description:
Provided AWS credentials, this module will call the authenticated
          API of Amazon Web Services to list all SSM-enabled EC2 instances
          accessible to the account. Once enumerated as SSM-enabled, the
          instances can be controlled using out-of-band WebSocket sessions
          provided by the AWS API (nominally, privileged out of the box).
          This module provides not only the API enumeration identifying EC2
          instances accessible via SSM with given credentials, but enables
          session initiation for all identified targets (without requiring
          target-level credentials) using the CreateSession datastore option.
          The module also provides an EC2 ID filter and a limiting throttle
          to prevent session stampedes or expensive messes.
Metasploit Module: Amazon Web Services IAM credential enumeration
Type: auxiliary
Path: modules/auxiliary/cloud/aws/enum_iam.rb
Authors: Aaron Soto <aaron.soto@rapid7.com>

Description:
Provided AWS credentials, this module will call the authenticated
          API of Amazon Web Services to list all IAM credentials associated
          with the account
Metasploit Module: Amazon Web Services S3 instance enumeration
Type: auxiliary
Path: modules/auxiliary/cloud/aws/enum_s3.rb
Authors: Aaron Soto <aaron.soto@rapid7.com>

Description:
Provided AWS credentials, this module will call the authenticated
          API of Amazon Web Services to list all S3 buckets associated
          with the account
Metasploit Module: Amazon Web Services EC2 instance enumeration
Type: auxiliary
Path: modules/auxiliary/cloud/aws/enum_ec2.rb

Description:
Provided AWS credentials, this module will call the authenticated
          API of Amazon Web Services to list all EC2 instances associated
          with the account
Metasploit Module: Kubernetes Enumeration
Type: auxiliary
Path: modules/auxiliary/cloud/kubernetes/enum_kubernetes.rb
Platform: linux

Description:
Enumerate a Kubernetes API to report useful resources such as available namespaces,
          pods, secrets, etc.

          Useful resources will be highlighted using the HIGHLIGHT_NAME_PATTERN option.
Metasploit Module: Windows Registry Security Descriptor Utility
Type: auxiliary
Path: modules/auxiliary/admin/registry_security_descriptor.rb

Description:
Read or write a Windows registry security descriptor remotely.

          In READ mode, the `FILE` option can be set to specify where the
          security descriptor should be written to.

          The following format is used:
          ```
          key: <registry key>
          security_info: <security information>
          sd: <security descriptor as a hex string>
          ```

          In WRITE mode, the `FILE` option can be used to specify the information
          needed to write the security descriptor to the remote registry. The file must
          follow the same format as described above.
Metasploit Module: Motorola WR850G v4.03 Credentials
Type: auxiliary
Path: modules/auxiliary/admin/motorola/wr850g_cred.rb
Disclosure date: 2004-09-24
Authors: kris katterjohn
References: CVE-2004-1550, OSVDB-10232, URL-https://seclists.org/bugtraq/2004/Sep/0339.html

Description:
Login credentials to the Motorola WR850G router with
          firmware v4.03 can be obtained via a simple GET request
          if issued while the administrator is logged in.  A lot
          more information is available through this request, but
          you can get it all and more after logging in.
Metasploit Module: ICPR Certificate Management
Type: auxiliary
Path: modules/auxiliary/admin/dcerpc/icpr_cert.rb
References: URL-https://posts.specterops.io/certified-pre-owned-d95910965cd2, URL-https://github.com/GhostPack/Certify, URL-https://github.com/ly4k/Certipy

Description:
Request certificates via MS-ICPR (Active Directory Certificate Services). Depending on the certificate
          template's configuration the resulting certificate can be used for various operations such as authentication.
          PFX certificate files that are saved are encrypted with a blank password.

          This module is capable of exploiting ESC1, ESC2, ESC3, ESC13 and ESC15.
Metasploit Module: Active Directory Certificate Services (ADCS) privilege escalation (Certifried)
Type: auxiliary
Path: modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb
References: URL-https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4, URL-https://cravaterouge.github.io/ad/privesc/2022/05/11/bloodyad-and-CVE-2022-26923.html, CVE-2022-26923

Description:
This module exploits a privilege escalation vulnerability in Active
          Directory Certificate Services (ADCS) to generate a valid certificate
          impersonating the Domain Controller (DC) computer account. This
          certificate is then used to authenticate to the target as the DC
          account using PKINIT preauthentication mechanism. The module will get
          and cache the Ticket-Granting-Ticket (TGT) for this account along
          with its NTLM hash. Finally, it requests a TGS impersonating a
          privileged user (Administrator by default). This TGS can then be used
          by other modules or external tools.
Metasploit Module: Exploits AD CS Template misconfigurations which involve updating an LDAP object: ESC9, ESC10, and ESC16
Type: auxiliary
Path: modules/auxiliary/admin/dcerpc/esc_update_ldap_object.rb
References: URL-https://github.com/GhostPack/Certify, URL-https://github.com/ly4k/Certipy, URL-https://medium.com/@offsecdeer/adcs-exploitation-series-part-2-certificate-mapping-esc15-6e19a6037760, URL-https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc16-a-compatibility-mode

Description:
This module exploits Active Directory Certificate Services (AD CS) template misconfigurations, specifically
          ESC9, ESC10, and ESC16, by updating an LDAP object and requesting a certificate on behalf of a target user.
          The module leverages the auxiliary/admin/ldap/ldap_object_attribute module to update the LDAP object and the
          admin/ldap/shadow_credentials module to add shadow credentials for the target user if the target password is
          not provided. It then uses the admin/kerberos/get_ticket module to retrieve the NTLM hash of the target user
          and requests a certificate via MS-ICPR. The resulting certificate can be used for various operations, such as
          authentication.

          The module ensures that any changes made by the ldap_object_attribute or shadow_credentials module are
          reverted after execution to maintain system integrity.
Metasploit Module: Netlogon Weak Cryptographic Authentication
Type: auxiliary
Path: modules/auxiliary/admin/dcerpc/cve_2020_1472_zerologon.rb
References: CVE-2020-1472, URL-https://www.secura.com/blog/zero-logon, URL-https://github.com/SecuraBV/CVE-2020-1472/blob/master/zerologon_tester.py, URL-https://github.com/dirkjanm/CVE-2020-1472/blob/master/restorepassword.py

Description:
A vulnerability exists within the Netlogon authentication process where the security properties granted by AES
          are lost due to an implementation flaw related to the use of a static initialization vector (IV). An attacker
          can leverage this flaw to target an Active Directory Domain Controller and make repeated authentication attempts
          using NULL data fields which will succeed every 1 in 256 tries (~0.4%). This module leverages the vulnerability
          to reset the machine account password to an empty string, which will then allow the attacker to authenticate as
          the machine account. After exploitation, it's important to restore this password to it's original value. Failure
          to do so can result in service instability.

Check method (fingerprinting):
bind_to_netlogon_service

    status = nil
    2000.times do
      netr_server_req_challenge
      response = netr_server_authenticate3

      break if (status = response.error_status) == 0

      windows_error = ::WindowsError::NTStatus.find_by_retval(response.error_status.to_i).first
      # Try again if the Failure is STATUS_ACCESS_DENIED, otherwise something has gone wrong
      next if windows_error == ::WindowsError::NTStatus::STATUS_ACCESS_DENIED

      fail_with(Failure::UnexpectedReply, windows_error)
    end

    return Exploit::CheckCode::Detected('Target responded but Zerologon exploit did not succeed') unless status == 0

    Exploit::CheckCode::Vulnerable('Zerologon authentication bypass succeeded')
  end
Metasploit Module: SAMR Account Management
Type: auxiliary
Path: modules/auxiliary/admin/dcerpc/samr_account.rb
References: URL-https://github.com/SecureAuthCorp/impacket/blob/master/examples/addcomputer.py

Description:
Add, lookup and delete user / machine accounts via MS-SAMR. By default
          standard active directory users can add up to 10 new computers to the
          domain (MachineAccountQuota). Administrative privileges however are required
          to delete the created accounts, or to create/delete user accounts.
Metasploit Module: TikiWiki Information Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/tikiwiki/tikidblib.rb
Disclosure date: 2006-11-01
References: OSVDB-30172, BID-20858, CVE-2006-5702, URL-https://web.archive.org/web/[PII_REDACTED]5557/http://secunia.com/advisories/22678/

Description:
A vulnerability has been reported in Tikiwiki, which can be exploited by
          an anonymous user to dump the MySQL user & passwd just by creating a mysql
          error with the "sort_mode" var.

          The vulnerability was reported in Tikiwiki version 1.9.5.
Metasploit Module: RealVNC NULL Authentication Mode Bypass
Type: auxiliary
Path: modules/auxiliary/admin/vnc/realvnc_41_bypass.rb
Disclosure date: 2006-05-15
References: BID-17978, OSVDB-25479, URL-https://web.archive.org/web/[PII_REDACTED]3013/http://secunia.com/advisories/20107/, CVE-2006-2369

Description:
This module exploits an Authentication bypass vulnerability
          in RealVNC Server version 4.1.0 and 4.1.1. It sets up a proxy
          listener on LPORT and proxies to the target server.

          The AUTOVNC option requires that vncviewer be installed on
          the attacking machine.
Metasploit Module: Veritas Backup Exec Server Registry Access
Type: auxiliary
Path: modules/auxiliary/admin/backupexec/registry.rb
References: OSVDB-17627, CVE-2005-0771, URL-https://web.archive.org/web/[PII_REDACTED]2138/http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=269

Description:
This modules exploits a remote registry access flaw in the BackupExec Windows
          Server RPC service. This vulnerability was discovered by Pedram Amini and is based
          on the NDR stub information posted to openrce.org.
          Please see the action list for the different attack modes.
Metasploit Module: Veritas Backup Exec Windows Remote File Access
Type: auxiliary
Path: modules/auxiliary/admin/backupexec/dump.rb
References: CVE-2005-2611, OSVDB-18695, BID-14551, URL-https://web.archive.org/web/[PII_REDACTED]4337/http://www.fpns.net/willy/msbksrc.lzh

Description:
This module abuses a logic flaw in the Backup Exec Windows Agent to download
          arbitrary files from the system. This flaw was found by someone who wishes to
          remain anonymous and affects all known versions of the Backup Exec Windows Agent. The
          output file is in 'MTF' format, which can be extracted by the 'NTKBUp' program
          listed in the references section. To transfer an entire directory, specify a
          path that includes a trailing backslash.