deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Schneider Modicon Remote START/STOP Command
Type: auxiliary
Path: modules/auxiliary/admin/scada/modicon_command.rb
Disclosure date: 2012-04-05
References: URL-http://www.digitalbond.com/tools/basecamp/metasploit-modules/

Description:
The Schneider Modicon with Unity series of PLCs use Modbus function
          code 90 (0x5a) to perform administrative commands without authentication.
          This module allows a remote user to change the state of the PLC between
          STOP and RUN, allowing an attacker to end process control by the PLC.

          This module is based on the original 'modiconstop.rb' Basecamp module from
          DigitalBond.
Metasploit Module: Unitronics PCOM remote START/STOP/RESET command
Type: auxiliary
Path: modules/auxiliary/admin/scada/pcom_command.rb
References: URL-https://unitronicsplc.com/Download/SoftwareUtilities/Unitronics%20PCOM%20Protocol.pdf

Description:
Unitronics Vision PLCs allow remote administrative functions to control
          the PLC using authenticated PCOM commands.

          This module supports START, STOP and RESET operations.
Metasploit Module: Advantech WebAccess DBVisitor.dll ChartThemeConfig SQL Injection
Type: auxiliary
Path: modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb
Disclosure date: 2014-04-08
References: CVE-2014-0763, ZDI-14-077, OSVDB-105572, BID-66740, URL-https://ics-cert.us-cert.gov/advisories/ICSA-14-079-03

Description:
This module exploits a SQL injection vulnerability found in Advantech WebAccess 7.1. The
          vulnerability exists in the DBVisitor.dll component, and can be abused through malicious
          requests to the ChartThemeConfig web service. This module can be used to extract the site
          and project usernames and hashes.

Check method (fingerprinting):
mark = Rex::Text.rand_text_alpha(8..12)
    injection = "#{Rex::Text.rand_text_alpha(8..12)}' "
    injection << "union all select '#{mark}' from BAThemeSetting where '#{Rex::Text.rand_text_alpha(2)}'='#{Rex::Text.rand_text_alpha(3)}"
    data = do_sqli(injection, mark)

    if data.nil?
      return Msf::Exploit::CheckCode::Safe('Could not retrieve data from Advantech WebAccess')
    end

    Msf::Exploit::CheckCode::Vulnerable('SQL injection via DBVisitor.asp confirmed')
  end
Metasploit Module: Allen-Bradley/Rockwell Automation EtherNet/IP CIP Commands
Type: auxiliary
Path: modules/auxiliary/admin/scada/multi_cip_command.rb
Disclosure date: 2012-01-19
References: URL-http://www.digitalbond.com/tools/basecamp/metasploit-modules/

Description:
The EtherNet/IP CIP protocol allows a number of unauthenticated commands to a PLC which
          implements the protocol.  This module implements the CPU STOP command, as well as
          the ability to crash the Ethernet card in an affected device.

          This module is based on the original 'ethernetip-multi.rb' Basecamp module
          from DigitalBond.
Metasploit Module: GE Proficy Cimplicity WebView substitute.bcl Directory Traversal
Type: auxiliary
Path: modules/auxiliary/admin/scada/ge_proficy_substitute_traversal.rb
Disclosure date: 2013-01-22
References: CVE-2013-0653, OSVDB-89490, BID-57505, URL-http://ics-cert.us-cert.gov/advisories/ICSA-13-022-02

Description:
This module abuses a directory traversal in GE Proficy Cimplicity, specifically on the
          gefebt.exe component used by the WebView, in order to retrieve arbitrary files with SYSTEM
          privileges. This module has been tested successfully on GE Proficy Cimplicity 7.5.
Metasploit Module: mySCADA myPRO Manager Credential Harvester (CVE-2025-24865 and CVE-2025-22896)
Type: auxiliary
Path: modules/auxiliary/admin/scada/mypro_mgr_creds.rb
Platform: win
Disclosure date: 2025-02-13
Authors: Michael Heinzl
References: URL-https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-16, CVE-2025-24865, CVE-2025-22896
Targets: Windows_Fetch

Description:
Credential Harvester in MyPRO Manager <= v1.3 from mySCADA.
          The product suffers from a broken authentication vulnerability (CVE-2025-24865) for certain functions. One of them is the configuration page for notifications, which returns the cleartext credentials (CVE-2025-22896) before correctly veryfing that the associated request is coming from an authenticated and authorized entity.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'assets/index-DBkpc6FO.js')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Failed to connect to the target')
    end

    if res.to_s =~ /const S="([^"]+)"/
      version = ::Regexp.last_match(1)
      vprint_status('Version retrieved: ' + version)
      if Rex::Version.new(version) <= Rex::Version.new('1.3')
        return Exploit::CheckCode::Appears("myPRO Manager version #{version} is vulnerable")
      end

      return Exploit::CheckCode::Safe("myPRO Manager version #{version} is not vulnerable")
    end
    return Exploit::CheckCode::Unknown('Could not determine myPRO Manager version')
  end
Metasploit Module: Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access
Type: auxiliary
Path: modules/auxiliary/admin/webmin/edit_html_fileaccess.rb
Disclosure date: 2012-09-06
References: OSVDB-85247, BID-55446, CVE-2012-2983, URL-http://www.americaninfosec.com/research/dossiers/AISG-12-002.pdf, URL-https://github.com/webmin/webmin/commit/4cd7bad70e23e4e19be8ccf7b9f245445b2b3b80

Description:
This module exploits a directory traversal in Webmin 1.580. The vulnerability
          exists in the edit_html.cgi component and allows an authenticated user with access
          to the File Manager Module to access arbitrary files with root privileges. The
          module has been tested successfully with Webmin 1.580 over Ubuntu 10.04.
Metasploit Module: Webmin File Disclosure
Type: auxiliary
Path: modules/auxiliary/admin/webmin/file_disclosure.rb
Disclosure date: 2006-06-30
References: OSVDB-26772, BID-18744, CVE-2006-3392, US-CERT-VU-999601, URL-https://web.archive.org/web/[PII_REDACTED]2501/http://secunia.com/advisories/20892/

Description:
A vulnerability has been reported in Webmin and Usermin, which can be
          exploited by malicious people to disclose potentially sensitive information.
          The vulnerability is caused due to an unspecified error within the handling
          of an URL. This can be exploited to read the contents of any files on the
          server via a specially crafted URL, without requiring a valid login.
          The vulnerability has been reported in Webmin (versions prior to 1.290) and
          Usermin (versions prior to 1.220).
Metasploit Module: Novell eDirectory eMBox Unauthenticated File Access
Type: auxiliary
Path: modules/auxiliary/admin/edirectory/edirectory_edirutil.rb
References: CVE-2008-0926, BID-28441, OSVDB-43690

Description:
This module will access Novell eDirectory's eMBox service and can run the
          following actions via the SOAP interface: GET_DN, READ_LOGS, LIST_SERVICES,
          STOP_SERVICE, START_SERVICE, SET_LOGFILE.
Metasploit Module: Novell eDirectory DHOST Predictable Session Cookie
Type: auxiliary
Path: modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rb
Authors: hdm
References: CVE-2009-4655, OSVDB-60035

Description:
This module is able to predict the next session cookie value issued
          by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run
          this module, wait until the real administrator logs in, then specify the
          predicted cookie value to hijack their session.
Metasploit Module: IBM DB2 db2rcmd.exe Command Execution Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/db2/db2rcmd.rb
Disclosure date: 2004-03-04
References: CVE-2004-0795, OSVDB-4180, BID-9821

Description:
This module exploits a vulnerability in the Remote Command Server
          component in IBM's DB2 Universal Database 8.1. An authenticated
          attacker can send arbitrary commands to the DB2REMOTECMD named pipe
          which could lead to administrator privileges.
Metasploit Module: NAT-PMP Port Mapper
Type: auxiliary
Path: modules/auxiliary/admin/natpmp/natpmp_map.rb
Authors: Jon Hart <jhart[at]spoofed.org>

Description:
Map (forward) TCP and UDP ports on NAT devices using NAT-PMP
Metasploit Module: Kerberos Ticket Inspecting
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/inspect_ticket.rb

Description:
This module outputs the contents of a ccache/kirbi file and optionally (when provided with the appropriate key)
          decrypts and displays the encrypted content too.
          Can be used for inspecting tickets that aren't working as intended in an effort to debug them.
Metasploit Module: Kerberos keytab utilities
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/keytab.rb

Description:
Utilities for interacting with keytab files, which can store the hashed passwords of one or
          more principals.

          Discovered keytab files can be used to generate Kerberos Ticket Granting Tickets, or bruteforced
          offline.

          Keytab files can be also useful for decrypting Kerberos traffic using Wireshark dissectors,
          including the krbtgt encrypted blobs if the AES password hash is used.
Metasploit Module: MS14-068 Microsoft Kerberos Checksum Validation Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb
Disclosure date: 2014-11-18
References: CVE-2014-6324, MSB-MS14-068, OSVDB-114751, URL-http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx, URL-https://labs.mwrinfosecurity.com/blog/2014/12/16/digging-into-ms14-068-exploitation-and-defence/, URL-http://web.archive.org/web/[PII_REDACTED]3459/https://github.com/bidord/pykek, URL-https://www.rapid7.com/blog/post/2014/12/25/12-days-of-haxmas-ms14-068-now-in-metasploit

Description:
This module exploits a vulnerability in the Microsoft Kerberos implementation. The problem
          exists in the verification of the Privilege Attribute Certificate (PAC) from a Kerberos TGS
          request, where a domain user may forge a PAC with arbitrary privileges, including
          Domain Administrator. This module requests a TGT ticket with a forged PAC and exports it to
          a MIT Kerberos Credential Cache file. It can be loaded on Windows systems with the Mimikatz
          help. It has been tested successfully on Windows 2008.
Metasploit Module: Kerberos TGT/TGS Ticket Requester
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/get_ticket.rb

Description:
This module requests TGT/TGS Kerberos tickets from the KDC
Metasploit Module: Kerberos Silver/Golden/Diamond/Sapphire Ticket Forging
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/forge_ticket.rb
References: URL-https://www.slideshare.net/gentilkiwi/abusing-microsoft-kerberos-sorry-you-guys-dont-get-it

Description:
This module forges a Kerberos ticket. Four different techniques can be used:
          - Silver ticket: Using a service account hash, craft a ticket impersonating any user and privileges to that account.
          - Golden ticket: Using the krbtgt hash, craft a ticket impersonating any user and privileges.
          - Diamond ticket: Authenticate to the domain controller, and using the krbtgt hash, copy the PAC from the authenticated user to a forged ticket.
          - Sapphire ticket: Use the S4U2Self+U2U trick to retrieve the PAC of another user, then use the krbtgt hash to craft a forged ticket.
Metasploit Module: Kerberos ticket converter
Type: auxiliary
Path: modules/auxiliary/admin/kerberos/ticket_converter.rb
References: URL-https://github.com/SecureAuthCorp/impacket/blob/3c6713e309cae871d685fa443d3e21b7026a2155/examples/ticketConverter.py, URL-https://tools.ietf.org/html/rfc4120, URL-http://web.mit.edu/KERBEROS/krb5-devel/doc/formats/ccache_file_format.html, URL-https://github.com/gentilkiwi/kekeo, URL-https://github.com/rvazarkar/KrbCredExport

Description:
This module converts tickets to the ccache format from the kirbi format and vice versa.
Metasploit Module: ESC/POS Printer Command Injector
Type: auxiliary
Path: modules/auxiliary/admin/printer/escpos_tcp_command_injector.rb
Authors: FutileSkills
References: URL-https://github.com/futileskills/Security-Advisory

Description:
This module exploits an unauthenticated ESC/POS command vulnerability in networked Epson-compatible printers.
          You can print a custom message, trigger the attached cash drawer, or cut the paper.
Metasploit Module: Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/oracle/osb_execqr3.rb
Disclosure date: 2010-07-13
References: CVE-2010-0904, OSVDB-66338, ZDI-10-118

Description:
This module exploits an authentication bypass vulnerability
          in login.php in order to execute arbitrary code via a command injection
          vulnerability in property_box.php. This module was tested
          against Oracle Secure Backup version 10.3.0.1.0 (Win32).
Metasploit Module: Oracle Database Enumeration
Type: auxiliary
Path: modules/auxiliary/admin/oracle/oraenum.rb

Description:
This module provides a simple way to scan an Oracle database server
          for configuration parameters that may be useful during a penetration
          test. Valid database credentials must be provided for this module to
          run.
Metasploit Module: Oracle TNS Listener Command Issuer
Type: auxiliary
Path: modules/auxiliary/admin/oracle/tnscmd.rb
Disclosure date: 2009-02-01
Authors: MC

Description:
This module allows for the sending of arbitrary TNS commands in order
          to gather information.
          Inspired from tnscmd.pl from www.jammed.com/~jwa/hacks/security/tnscmd/tnscmd
Metasploit Module: Oracle DB Privilege Escalation via Function-Based Index
Type: auxiliary
Path: modules/auxiliary/admin/oracle/oracle_index_privesc.rb
Disclosure date: 2015-01-21
References: URL-http://www.davidlitchfield.com/Privilege_Escalation_via_Oracle_Indexes.pdf

Description:
This module will escalate an Oracle DB user to DBA by creating a
          function-based index on a table owned by a more-privileged user.
          Credits to David Litchfield for publishing the technique.
Metasploit Module: Oracle SQL Generic Query
Type: auxiliary
Path: modules/auxiliary/admin/oracle/oracle_sql.rb
Disclosure date: 2007-12-07
References: URL-http://web.archive.org/web/[PII_REDACTED]4810/http://www.metasploit.com:80/users/mc/

Description:
This module allows for simple SQL statements to be executed
          against an Oracle instance given the appropriate credentials
          and sid.
Metasploit Module: Oracle Secure Backup exec_qr() Command Injection Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/oracle/osb_execqr.rb
Disclosure date: 2009-01-14
References: CVE-2008-5448, OSVDB-51342, URL-http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html, ZDI-09-003

Description:
This module exploits a command injection vulnerability in Oracle Secure Backup version 10.1.0.3 to 10.2.0.2.
Metasploit Module: Oracle SMB Relay Code Execution
Type: auxiliary
Path: modules/auxiliary/admin/oracle/ora_ntlm_stealer.rb
Disclosure date: 2009-04-07
References: URL-http://dsecrg.com/pages/pub/show.php?id=17

Description:
This module will help you to get Administrator access to OS using an unprivileged
          Oracle database user (you need only CONNECT and RESOURCE privileges).
          To do this you must firstly run smb_sniffer or smb_relay module on your server.
          Then you must connect to Oracle database and run this module Ora_NTLM_stealer.rb
          which will connect to your SMB server with credentials of Oracle RDBMS.
          So if smb_relay is working, you will get Administrator access to server which
          runs Oracle. If not than you can decrypt HALFLM hash.
Metasploit Module: Oracle TNS Listener SID Brute Forcer
Type: auxiliary
Path: modules/auxiliary/admin/oracle/sid_brute.rb
Disclosure date: 2009-01-07
References: URL-http://web.archive.org/web/[PII_REDACTED]4810/http://www.metasploit.com:80/users/mc/, URL-http://www.red-database-security.com/scripts/sid.txt

Description:
This module simply attempts to discover the protected SID.
Metasploit Module: Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/oracle/osb_execqr2.rb
Disclosure date: 2009-08-18
References: CVE-2009-1977, OSVDB-55903, CVE-2009-1978, OSVDB-55904, ZDI-09-058, ZDI-09-059

Description:
This module exploits an authentication bypass vulnerability
          in login.php in order to execute arbitrary code via a command injection
          vulnerability in property_box.php. This module was tested
          against Oracle Secure Backup version 10.3.0.1.0 (Win32).
Metasploit Module: Oracle Account Discovery
Type: auxiliary
Path: modules/auxiliary/admin/oracle/oracle_login.rb
Disclosure date: 2008-11-20
References: URL-http://www.petefinnigan.com/default/oracle_default_passwords.csv, URL-https://seclists.org/fulldisclosure/2009/Oct/261

Description:
This module uses a list of well known default authentication credentials
          to discover easily guessed accounts.
Metasploit Module: Oracle URL Download
Type: auxiliary
Path: modules/auxiliary/admin/oracle/post_exploitation/win32upload.rb
Disclosure date: 2005-02-10
References: URL-http://www.argeniss.com/research/oraclesqlinj.zip

Description:
This module will create a Java class which enables the download
          of a binary from a webserver to the Oracle filesystem.
Metasploit Module: Oracle Java execCommand (Win32)
Type: auxiliary
Path: modules/auxiliary/admin/oracle/post_exploitation/win32exec.rb
Disclosure date: 2007-12-07
References: URL-http://web.archive.org/web/[PII_REDACTED]4810/http://www.metasploit.com:80/users/mc/

Description:
This module will create a java class which enables the execution of OS commands.
Metasploit Module: TFTP File Transfer Utility
Type: auxiliary
Path: modules/auxiliary/admin/tftp/tftp_transfer_util.rb
References: URL-http://www.faqs.org/rfcs/rfc1350.html, URL-http://www.networksorcery.com/enp/protocol/tftp.htm

Description:
This module will transfer a file to or from a remote TFTP server.
          Note that the target must be able to connect back to the Metasploit system,
          and NAT traversal for TFTP is often unsupported.

          Two actions are supported: "Upload" and "Download," which behave as one might
          expect -- use 'set action Actionname' to use either mode of operation.

          If "Download" is selected, at least one of FILENAME or REMOTE_FILENAME
          must be set. If "Upload" is selected, either FILENAME must be set to a valid path to
          a source file, or FILEDATA must be populated. FILENAME may be a fully qualified path,
          or the name of a file in the Msf::Config.local_directory or Msf::Config.data_directory.
Metasploit Module: PostgreSQL Server Generic Query
Type: auxiliary
Path: modules/auxiliary/admin/postgres/postgres_readfile.rb

Description:
This module imports a file local on the PostgreSQL Server into a
          temporary table, reads it, and then drops the temporary table.
          It requires PostgreSQL credentials with table CREATE privileges
          as well as read privileges to the target file.
Metasploit Module: PostgreSQL Server Generic Query
Type: auxiliary
Path: modules/auxiliary/admin/postgres/postgres_sql.rb
References: URL-https://www.postgresql.org

Description:
This module will allow for simple SQL statements to be executed against a
          PostgreSQL instance given the appropriate credentials.
Metasploit Module: TrendMicro ServerProtect File Access
Type: auxiliary
Path: modules/auxiliary/admin/serverprotect/file.rb
References: CVE-2007-6507, OSVDB-44318, ZDI-07-077

Description:
This modules exploits a remote file access flaw in the ServerProtect Windows
          Server RPC service. Please see the action list (or the help output) for more
          information.
Metasploit Module: Android Browser RCE Through Google Play Store XFO
Type: auxiliary
Path: modules/auxiliary/admin/android/google_play_store_uxss_xframe_rce.rb
References: URL-http://web.archive.org/web/[PII_REDACTED]4739/https://www.rapid7.com/blog/post/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041/, URL-https://web.archive.org/web/[PII_REDACTED]1817/http://1337day.com/exploit/description/22581, OSVDB-110664, CVE-2014-6041

Description:
This module combines two vulnerabilities to achieve remote code
          execution on affected Android devices. First, the module exploits
          CVE-2014-6041, a Universal Cross-Site Scripting (UXSS) vulnerability present in
          versions of Android's open source stock browser (the AOSP Browser) prior to
          4.4. Second, the Google Play store's web interface fails to enforce a
          X-Frame-Options: DENY header (XFO) on some error pages, and therefore, can be
          targeted for script injection. As a result, this leads to remote code execution
          through Google Play's remote installation feature, as any application available
          on the Google Play store can be installed and launched on the user's device.

          This module requires that the user is logged into Google with a vulnerable browser.

          To list the activities in an APK, you can use `aapt dump badging /path/to/app.apk`.
Metasploit Module: Amazon Fire TV YouTube Remote Control
Type: auxiliary
Path: modules/auxiliary/admin/firetv/firetv_youtube.rb
Authors: wvu
References: URL-http://http://web.archive.org/web/[PII_REDACTED]1536/http://www.amazon.com/dp/B00CX5P8FC/?_encoding=UTF8, URL-https://www.amazon.com/dp/B00GDQ0RMG/ref=fs_ftvs

Description:
This module acts as a simple remote control for the Amazon Fire TV's
          YouTube app.

          Tested on the Amazon Fire TV Stick.
Metasploit Module: Veeder-Root Automatic Tank Gauge (ATG) Administrative Client
Type: auxiliary
Path: modules/auxiliary/admin/atg/atg_client.rb
References: URL-https://www.rapid7.com/blog/post/2015/01/22/the-internet-of-gas-station-tank-gauges/, URL-https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-gaspot-experiment, URL-https://github.com/sjhilt/GasPot, URL-https://github.com/mushorg/conpot, URL-https://www.veeder.com/us/automatic-tank-gauge-atg-consoles, URL-https://cdn.chipkin.com/files/liz/576013-635.pdf, URL-https://docs.veeder.com/gold/download.cfm?doc_id=6227

Description:
This module acts as a simplistic administrative client for interfacing
        with Veeder-Root Automatic Tank Gauges (ATGs) or other devices speaking
        the TLS-250 and TLS-350 protocols.  This has been tested against
        GasPot and Conpot, both honeypots meant to simulate ATGs; it has not
        been tested against anything else, so use at your own risk.
Metasploit Module: PsExec NTDS.dit And SYSTEM Hive Download Utility
Type: auxiliary
Path: modules/auxiliary/admin/smb/psexec_ntdsgrab.rb
References: URL-http://sourceforge.net/projects/smbexec, URL-https://www.optiv.com/blog/owning-computers-without-shell-access

Description:
This module authenticates to an Active Directory Domain Controller and creates
          a volume shadow copy of the %SYSTEMDRIVE%. It then pulls down copies of the
          ntds.dit file as well as the SYSTEM hive and stores them. The ntds.dit and SYSTEM
          hive copy can be used in combination with other tools for offline extraction of AD
          password hashes. All of this is done without uploading a single binary to the
          target host.
Metasploit Module: WebEx Remote Command Execution Utility
Type: auxiliary
Path: modules/auxiliary/admin/smb/webexec_command.rb
References: URL-https://webexec.org, CVE-2018-15442

Description:
This module enables the execution of a single command as System by exploiting a remote
          code execution vulnerability in Cisco's WebEx client software.