deardaniel/secdata-raw huggingface dataset:
Metasploit Module: SAP Solution Manager remote unauthorized OS commands execution
Type: auxiliary
Path: modules/auxiliary/admin/sap/cve_2020_6207_solman_rce.rb
Disclosure date: 2020-10-03
References: CVE-2020-6207, URL-https://i.blackhat.com/USA-20/Wednesday/us-20-Artuso-An-Unauthenticated-Journey-To-Root-Pwning-Your-Companys-Enterprise-Software-Servers-wp.pdf, URL-https://github.com/chipik/SAP_EEM_CVE-2020-6207

Description:
This module exploits the CVE-2020-6207 vulnerability within the SAP EEM servlet (tc~smd~agent~application~eem) of
          SAP Solution Manager (SolMan) running version 7.2. The vulnerability occurs due to missing authentication
          checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information about connected SMDAgents,
          send HTTP request (SSRF), and execute OS commands on connected SMDAgent. Works stable in connected SMDAgent with Java version 1.8.

          Successful exploitation of the vulnerability enables unauthenticated remote attackers to achieve SSRF and execute OS commands from the agent connected
          to SolMan as a user from which the SMDAgent service starts, usually the daaadm.
Metasploit Module: ThinManager Path Traversal (CVE-2023-2917) Arbitrary File Upload
Type: auxiliary
Path: modules/auxiliary/admin/networking/thinmanager_traversal_upload2.rb
Disclosure date: 2023-08-17
References: CVE-2023-2917, URL-https://www.tenable.com/security/research/tra-2023-28, URL-https://support.rockwellautomation.com/app/answers/answer_view/a_id/1140471

Description:
This module exploits a path traversal vulnerability (CVE-2023-2917) in
          ThinManager <= v13.1.0 to upload arbitrary files to the target system.
          The affected service listens by default on TCP port 2031 and runs in the
          context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      connect
    rescue Rex::ConnectionTimeout
      print_error("Connection to #{datastore['RHOSTS']}:#{datastore['RPORT']} failed.")
      return Exploit::CheckCode::Unknown('Connection timed out')
    end

    vprint_status('Sending handshake...')
    handshake = [0x100].pack('V')
    vprint_status(Rex::Text.to_hex_dump(handshake))
    sock.put(handshake)

    res = sock.get_once(4096, 5)
    expected_header = "\x00\x04\x00\x01\x00\x00\x00\x08".b

    if res&.start_with?(expected_header)
      vprint_status('Received handshake response.')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Detected('ThinManager ThinServer accepted the handshake')
    elsif res
      vprint_status('Received unexpected handshake response:')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Safe('Unexpected handshake response from target')
    else
      disconnect
      return Exploit::CheckCode::Unknown('No handshake response received.')
    end
  end
Metasploit Module: ThinManager Path Traversal (CVE-2023-27855) Arbitrary File Upload
Type: auxiliary
Path: modules/auxiliary/admin/networking/thinmanager_traversal_upload.rb
Disclosure date: 2023-04-05
References: CVE-2023-27855, URL-https://www.tenable.com/security/research/tra-2023-13, URL-https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640

Description:
This module exploits a path traversal vulnerability (CVE-2023-27855) in
          ThinManager <= v13.0.1 to upload arbitrary files to the target system.
          The affected service listens by default on TCP port 2031 and runs in the
          context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      connect
    rescue Rex::ConnectionTimeout => e
      print_error("Connection to #{datastore['RHOSTS']}:#{datastore['RPORT']} failed: #{e.message}")
      return Exploit::CheckCode::Unknown('Connection timed out')
    end

    vprint_status('Sending handshake...')
    handshake = [0x100].pack('V')
    vprint_status(Rex::Text.to_hex_dump(handshake))
    sock.put(handshake)

    res = sock.get_once(4096, 5)
    expected_header = "\x00\x04\x00\x01\x00\x00\x00\x08".b

    if res&.start_with?(expected_header)
      vprint_status('Received handshake response.')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Detected('ThinManager ThinServer accepted the handshake')
    elsif res
      vprint_status('Received unexpected handshake response:')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Safe('Unexpected handshake response from target')
    else
      disconnect
      return Exploit::CheckCode::Unknown('No handshake response received.')
    end
  end
Metasploit Module: Brocade Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/brocade_config.rb
Authors: h00die

Description:
This module imports a Brocade device configuration.
Metasploit Module: Cisco VPN Concentrator 3000 FTP Unauthorized Administrative Access
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_vpn_3000_ftp_bypass.rb
Disclosure date: 2006-08-23
References: BID-19680, CVE-2006-4313, OSVDB-28139, OSVDB-28138

Description:
This module tests for a logic vulnerability in the Cisco VPN Concentrator
          3000 series. It is possible to execute some FTP statements without authentication
          (CWD, RNFR, MKD, RMD, SIZE, CDUP). It also appears to have some memory leak bugs
          when working with CWD commands. This module simply creates an arbitrary directory,
          verifies that the directory has been created, then deletes it and verifies deletion
          to confirm the bug.
Metasploit Module: Juniper Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/juniper_config.rb
Authors: h00die

Description:
This module imports a Juniper ScreenOS or JunOS device configuration.
Metasploit Module: Cisco Secure ACS Unauthorized Password Change
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_secure_acs_bypass.rb
References: BID-47093, CVE-2011-0951, URL-http://www.cisco.com/en/US/products/csa/cisco-sa-20110330-acs.html

Description:
This module exploits an authentication bypass issue which allows arbitrary
          password change requests to be issued for any user in the local store.
          Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well
          as version 5.2 with either no patches or patches 1 and 2 are vulnerable.
Metasploit Module: Cisco ASA Authentication Bypass (EXTRABACON)
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_asa_extrabacon.rb
References: CVE-2016-6366, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp, URL-https://github.com/RiskSense-Ops/CVE-2016-6366

Description:
This module patches the authentication functions of a Cisco ASA
          to allow uncredentialed logins. Uses improved shellcode for payload.

Check method (fingerprinting):
begin
      vers_string = retrieve_asa_version
    rescue ::StandardError
      print_error('Error: Unable to retrieve version information')
      return Exploit::CheckCode::Unknown('Unable to retrieve version information')
    end

    if @offsets[vers_string]
      print_good("Payload for Cisco ASA version #{vers_string} available!")
      return Exploit::CheckCode::Appears("Cisco ASA version #{vers_string} has an available payload")
    end

    print_warning("Received Cisco ASA version #{vers_string}, but no payload available")
    return Exploit::CheckCode::Detected("Cisco ASA version #{vers_string} detected but no payload available")
  end
Metasploit Module: Cisco Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_config.rb
Authors: h00die

Description:
This module imports a Cisco IOS or NXOS device configuration.
Metasploit Module: Arista Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/arista_config.rb

Description:
This module imports an Arista device configuration.
Metasploit Module: Cisco Catalyst SD-WAN Controller Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_sdwan_auth_bypass.rb
Disclosure date: 2026-02-25
Authors: sfewer-r7
References: CVE-2026-20127, URL-https://github.com/sfewer-r7/CVE-2026-20127, URL-https://attackerkb.com/topics/bP3FMvHe7z/cve-2026-20127/rapid7-analysis, URL-https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa-EHchtZk, URL-https://blog.talosintelligence.com/uat-8616-sd-wan/

Description:
This module exploits an authentication bypass vulnerability (CVE-2026-20127)
          in the Cisco Catalyst SD-WAN Controller (vSmart). The vdaemon DTLS control-plane
          service fails to properly validate the verify_status byte in CHALLENGE_ACK_ACK
          (msg_type=10) messages. The vbond_proc_challenge_ack_ack() handler reads an
          attacker-controlled verify_status byte from the message body and, if non-zero,
          sets the peer's authenticated flag to 1. Furthermore, the authentication gate in
          vbond_proc_msg() exempts msg_type=10 from authentication checks, allowing an
          unauthenticated peer to send this message.

          An attacker can connect via DTLS 1.2 using a self-signed certificate (the server
          performs no certificate validation at the handshake stage), skip the CHALLENGE_ACK
          step, and send a forged CHALLENGE_ACK_ACK with verify_status=1 to become a trusted
          peer without any legitimate credentials.

          This module leverages the auth bypass to inject an SSH public key into the
          vmanage-admin authorized_keys file via a VMANAGE_TO_PEER message, providing
          persistent SSH access to the controller.

Check method (fingerprinting):
result = perform_auth_bypass(ssh_key_inject: false, silent: !datastore['VERBOSE'])
    if result == :vulnerable
      Msf::Exploit::CheckCode::Vulnerable('Authentication bypass succeeded - server accepted forged CHALLENGE_ACK_ACK')
    elsif result == :detected
      Msf::Exploit::CheckCode::Detected('DTLS service detected but bypass could not be confirmed')
    else
      Msf::Exploit::CheckCode::Unknown('Could not determine vulnerability status')
    end
  rescue ::StandardError => e
    vprint_error("Check failed: #{e.message}")
    Msf::Exploit::CheckCode::Unknown('Check failed due to an error')
  end
Metasploit Module: Cisco Data Center Network Manager Unauthenticated File Download
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_dcnm_download.rb
Disclosure date: 2019-06-26
References: CVE-2019-1619, CVE-2019-1621, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-bypass, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190626-dcnm-file-dwnld, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-dcnm-rce.txt, URL-https://seclists.org/fulldisclosure/2019/Jul/7

Description:
DCNM exposes a servlet to download files on /fm/downloadServlet.
          An authenticated user can abuse this servlet to download arbitrary files as root by specifying
          the full path of the file.
          This module was tested on the DCNM Linux virtual appliance 10.4(2), 11.0(1) and 11.1(1), and should
          work on a few versions below 10.4(2). Only version 11.0(1) requires authentication to exploit
          (see References to understand why).
Metasploit Module: Ubiquiti Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/ubiquiti_config.rb
Authors: h00die

Description:
This module imports an Ubiquiti device configuration.
          The db file within the .unf backup is the data file for
          Unifi. This module can take either the db file or .unf.
Metasploit Module: Mikrotik Configuration Importer
Type: auxiliary
Path: modules/auxiliary/admin/networking/mikrotik_config.rb
Authors: h00die

Description:
This module imports a Mikrotik device configuration.
Metasploit Module: Cisco DCNM auth bypass
Type: auxiliary
Path: modules/auxiliary/admin/networking/cisco_dcnm_auth_bypass.rb
Disclosure date: 2020-06-01
References: CVE-2019-15975, EDB-48018

Description:
This exploit is able to add an admin account to a Cisco DCNM with credentials you can choose.
          After that, you can login to the web interface with those credentials.
          The only necessary condition is the more or less recent connection of an admin as this exploit
          uses a kind of session stealing.

Check method (fingerprinting):
res = add_admin_account('test', 'test')

    if res == :success || res == :user_already_exists || res == :weak_password
      Exploit::CheckCode::Vulnerable('Authentication bypass succeeded on DCNM REST API')
    elsif res == :failed_to_connect
      Exploit::CheckCode::Unknown('Failed to connect to the target or determine vulnerability status')
    else
      Exploit::CheckCode::Unknown('Could not determine vulnerability status')
    end
  end
Metasploit Module: ThinManager Path Traversal (CVE-2023-2915) Arbitrary File Delete
Type: auxiliary
Path: modules/auxiliary/admin/networking/thinmanager_traversal_delete.rb
Disclosure date: 2023-08-17
References: CVE-2023-2915, URL-https://www.tenable.com/security/research/tra-2023-28, URL-https://support.rockwellautomation.com/app/answers/answer_view/a_id/1140471

Description:
This module exploits a path traversal vulnerability (CVE-2023-2915) in
          ThinManager <= v13.1.0 to delete arbitrary files from the system.
          The affected service listens by default on TCP port 2031 and runs in the
          context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      connect
    rescue Rex::ConnectionTimeout
      print_error("Connection to #{datastore['RHOSTS']}:#{datastore['RPORT']} failed.")
      return Exploit::CheckCode::Unknown('Connection timed out')
    end

    vprint_status('Sending handshake...')
    handshake = [0x100].pack('V')
    vprint_status(Rex::Text.to_hex_dump(handshake))
    sock.put(handshake)

    res = sock.get_once(4096, 5)
    expected_header = "\x00\x04\x00\x01\x00\x00\x00\x08".b

    if res&.start_with?(expected_header)
      vprint_status('Received handshake response.')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Detected('ThinManager ThinServer accepted the handshake')
    elsif res
      vprint_status('Received unexpected handshake response:')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Safe('Unexpected handshake response from target')
    else
      disconnect
      return Exploit::CheckCode::Unknown('No handshake response received.')
    end
  end
Metasploit Module: Apache Tapestry HMAC secret key leak
Type: auxiliary
Path: modules/auxiliary/gather/cve_2021_27850_apache_tapestry_hmac_key.rb
Disclosure date: 2021-04-15
References: CVE-2021-27850

Description:
This exploit finds the HMAC secret key used in Java serialization by Apache Tapestry. This key
          is located in the file AppModule.class by default and looks like the standard representation of UUID in hex digits (hd) :
          6hd-4hd-4hd-4hd-12hd
          If the HMAC key has been changed to look differently, this module won't find the key because it tries to download the file
          and then uses a specific regex to find the key.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/assets/app/something/services/', class_file, '/')
    })

    if res.nil?
      Exploit::CheckCode::Unknown('No response received from the target')
    elsif res.code == 302

      id_url = res.redirection.to_s[%r{assets/app/(\w+)/services/#{class_file}}, 1]
      normalized_url = normalize_uri(target_uri.path, '/assets/app/', id_url, '/services/', class_file, '/')
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalized_url
      })

      if res.code == 200 && res.headers['Content-Type'] =~ %r{application/java.*}
        print_good("Java file leak at #{rhost}:#{rport}#{normalized_url}")
        Exploit::CheckCode::Vulnerable("Java class file leaked at #{normalized_url}")
      else
        Exploit::CheckCode::Safe('Redirected but class file not accessible')
      end
    else
      Exploit::CheckCode::Safe("Unexpected HTTP response code: #{res.code}")
    end
  end
Metasploit Module: Apache Rave User Information Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/apache_rave_creds.rb
References: CVE-2013-1814, OSVDB-91235, BID-58455, EDB-24744

Description:
This module exploits an information disclosure in Apache Rave 0.20 and prior. The
          vulnerability exists in the RPC API, which allows any authenticated user to
          disclose information about all the users, including their password hashes. In order
          to authenticate, the user can provide his own credentials. Also the default users
          installed with Apache Rave 0.20 will be tried automatically. This module has been
          successfully tested on Apache Rave 0.20.
Metasploit Module: Nuuo Central Management Server User Session Token Bruteforce
Type: auxiliary
Path: modules/auxiliary/gather/nuuo_cms_bruteforce.rb
Platform: win
Disclosure date: 2018-10-11
References: CVE-2018-17888, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-18-284-02, URL-https://seclists.org/fulldisclosure/2019/Jan/51, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-cms-ownage.txt

Description:
Nuuo Central Management Server below version 2.4 has a flaw where it sends the
          heap address of the user object instead of a real session number when a user logs
          in. This can be used to reduce the keyspace for the session number from 10 million
          to 1.2 million, and with a bit of analysis it can be guessed in less than 500k tries.
          This module does exactly that - it uses a computed occurrence table to try the most common
          combinations up to 1.2 million to try to guess a valid user session.
          This session number can then be used to achieve code execution or download files - see
          the other Nuuo CMS auxiliary and exploit modules.
          Note that for this to work a user has to be logged into the system.
Metasploit Module: Nuuo Central Management Server Authenticated Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/gather/nuuo_cms_file_download.rb
Platform: win
Disclosure date: 2018-10-11
References: CVE-2018-17934, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-18-284-02, URL-https://seclists.org/fulldisclosure/2019/Jan/51, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-cms-ownage.txt

Description:
The Nuuo Central Management Server allows an authenticated user to download files from the
          installation folder. This functionality can be abused to obtain administrative credentials,
          the SQL Server database password and arbitrary files off the system with directory traversal.
          The module will attempt to download CMServer.cfg (the user configuration file with all the user
          passwords including the admin one), ServerConfig.cfg (the server configuration file with the
          SQL Server password) and a third file if the FILE argument is provided by the user.
          The two .cfg files are zip-encrypted files, but due to limitations of the Ruby ZIP modules
          included in Metasploit, these files cannot be decrypted programmatically. The user will
          have to open them with zip or a similar program and provide the default password "NUCMS2007!".
          This module will either use a provided session number (which can be guessed with an auxiliary
          module) or attempt to login using a provided username and password - it will also try the
          default credentials if nothing is provided.
          All versions of CMS server up to and including 3.5 are vulnerable to this attack.
Metasploit Module: FortiOS Path Traversal Credential Gatherer
Type: auxiliary
Path: modules/auxiliary/gather/fortios_vpnssl_traversal_creds_leak.rb
References: URL-https://www.fortiguard.com/psirt/FG-IR-18-384, URL-https://i.blackhat.com/USA-19/Wednesday/us-19-Tsai-Infiltrating-Corporate-Intranet-Like-NSA.pdf, URL-https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/

Description:
Fortinet FortiOS versions 5.4.6 to 5.4.12, 5.6.3 to 5.6.7 and 6.0.0 to
          6.0.4 are vulnerable to a path traversal vulnerability within the SSL VPN
          web portal which allows unauthenticated attackers to download FortiOS system
          files through specially crafted HTTP requests.

          This module exploits this vulnerability to read the usernames and passwords
          of users currently logged into the FortiOS SSL VPN, which are stored in
          plaintext in the "/dev/cmdb/sslvpn_websession" file on the VPN server.
Metasploit Module: AlienVault Authenticated SQL Injection Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/alienvault_iso27001_sqli.rb
Platform: linux
Disclosure date: 2014-03-30
References: CVE-2013-5967, EDB-32644

Description:
AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG
          generation PHP file. This module exploits this to read an arbitrary file from
          the file system. Any authenticated user is able to exploit it, as administrator
          privileges aren't required.
Metasploit Module: CheckPoint Firewall-1 SecuRemote Topology Service Hostname Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/checkpoint_hostname.rb
Disclosure date: 2011-12-14
References: URL-https://web.archive.org/web/[PII_REDACTED]2715/http://www.osisecurity.com.au/advisories/checkpoint-firewall-securemote-hostname-information-disclosure, URL-https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk69360

Description:
This module sends a query to the port 264/TCP on CheckPoint Firewall-1
          firewalls to obtain the firewall name and management station
          (such as SmartCenter) name via a pre-authentication request. The string
          returned is the CheckPoint Internal CA CN for SmartCenter and the firewall
          host. Whilst considered "public" information, the majority of installations
          use detailed hostnames which may aid an attacker in focusing on compromising
          the SmartCenter host, or useful for government, intelligence and military
          networks where the hostname reveals the physical location and rack number
          of the device, which may be unintentionally published to the world.