deardaniel/secdata-raw huggingface dataset:
Metasploit Module: IBM Tivoli Storage Manager Express CAD Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ibm_tsm_cad_ping.rb
Platform: win
Disclosure date: 2009-11-04
References: CVE-2009-3853, OSVDB-59632

Description:
This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service.
          By sending a "ping" packet containing a long string, an attacker can execute arbitrary code.

          NOTE: the dsmcad.exe service must be in a particular state (CadWaitingStatus = 1) in order
          for the vulnerable code to be reached. This state doesn't appear to be reachable when the
          TSM server is not running. This service does not restart.
Metasploit Module: AIS logistics ESEL-Server Unauth SQL Injection RCE
Type: exploit
Path: modules/exploits/windows/misc/ais_esel_server_rce.rb
Platform: win
Disclosure date: 2019-03-27
References: CVE-2019-10123

Description:
This module will execute an arbitrary payload on an "ESEL" server used by the
          AIS logistic software. The server typically listens on port 5099 without TLS.
          There could also be server listening on 5100 with TLS but the port 5099 is
          usually always open.
          The login process is vulnerable to an SQL Injection. Usually a MSSQL Server
          with the 'sa' user is in place.

          This module was verified on version 67 but it should also run on lower versions.
          An fixed version was created by AIS in September 2017. However most systems
          have not been updated.

          In regard to the payload, unless there is a closed port in the web server,
          you dont want to use any "bind" payload. You want a "reverse" payload,
          probably to your port 80 or to any other outbound port allowed on the firewall.

          Currently, one delivery method is supported

          This method takes advantage of the Command Stager subsystem. This allows using
          various techniques, such as using a TFTP server, to send the executable. By default
          the Command Stager uses 'wcsript.exe' to generate the executable on the target.

          NOTE: This module will leave a payload executable on the target system when the
          attack is finished.

Check method (fingerprinting):
int = rand(1..1_000)
    response_bypass = send_login_msg(create_login_msg("#{rand(1_000..9_999)}' OR #{int}=#{int}--"), false)
    if response_bypass.include? 'Zugangsdaten OK'
      CheckCode::Vulnerable('SQL injection authentication bypass successful')
    else
      print_status("Response was: #{response_bypass}")
      CheckCode::Safe('SQL injection authentication bypass failed')
    end
  end
Metasploit Module: TinyIdentD 2.2 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/tiny_identd_overflow.rb
Platform: win
Disclosure date: 2007-05-14
References: BID-23981, CVE-2007-2711, EDB-3925, OSVDB-36053

Description:
This module exploits a stack based buffer overflow in TinyIdentD
          version 2.2.
          If we send a long string to the ident service we can overwrite the
          return address and execute arbitrary code. Credit to Maarten Boone.
Metasploit Module: HP Data Protector Encrypted Communication Remote Command Execution
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_encrypted_comms.rb
Platform: win
Disclosure date: 2016-04-18
References: CVE-2016-2004, URL-http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05085988
Targets: Automatic

Description:
This module exploits a well known remote code execution exploit after establishing encrypted
          control communications with a Data Protector agent. This allows exploitation of Data
          Protector agents that have been configured to only use encrypted control communications.

          This exploit works by executing the payload with Microsoft PowerShell so will only work
          against Windows Vista or newer. Tested against Data Protector 9.0 installed on Windows
          Server 2008 R2.

Check method (fingerprinting):
# For the check command
    connect
    sock.put(rand_text_alpha_upper(64))
    response = sock.get_once(-1)
    disconnect

    if response.nil?
      return Exploit::CheckCode::Safe('Target did not respond to probe')
    end

    service_version = Rex::Text.to_ascii(response).chop.chomp

    if service_version =~ /HP Data Protector/
      vprint_status(service_version)
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end
Metasploit Module: Wireshark packet-dect.c Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/wireshark_packet_dect.rb
Platform: win
Disclosure date: 2011-04-18
References: CVE-2011-1591, OSVDB-71848, URL-https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5838, URL-https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5836, EDB-17185

Description:
This module exploits a stack buffer overflow in Wireshark <= 1.4.4
          by sending a malicious packet.
Metasploit Module: SPlayer 3.7 Content-Type Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/splayer_content_type.rb
Platform: win
Disclosure date: 2011-05-04
References: CVE-2011-10022, OSVDB-72181, EDB-17243

Description:
This module exploits a vulnerability in SPlayer v3.7 or prior.  When SPlayer
          requests the URL of a media file (video or audio), it is possible to gain arbitrary
          remote code execution due to a buffer overflow caused by an exceeding length of data
          as the 'Content-Type' parameter.
Metasploit Module: HP Data Protector 8.10 Remote Command Execution
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb
Platform: win
Disclosure date: 2014-11-02
References: CVE-2014-2623, OSVDB-109069, EDB-34066, URL-https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04373818

Description:
This module exploits a remote command execution on HP Data Protector 8.10. Arbitrary
          commands can be executed by sending crafted requests with opcode 28 to the OmniInet
          service listening on the TCP/5555 port. Since there is a strict length limitation on
          the command, rundll32.exe is executed, and the payload is provided through a DLL by a
          fake SMB server. This module has been tested successfully on HP Data Protector 8.1 on
          Windows 7 SP1.

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    print_status("HP Data Protector version #{fingerprint}")

    if fingerprint =~ /HP Data Protector A\.08\.(\d+)/
      minor = $1.to_i
    else
      return Exploit::CheckCode::Safe("#{fingerprint} is not a vulnerable version")
    end

    if minor < 11
      return Exploit::CheckCode::Appears("HP Data Protector A.08.#{minor} appears vulnerable")
    end

    Exploit::CheckCode::Detected("HP Data Protector A.08.#{minor} detected")
  end
Metasploit Module: HP Data Protector Backup Client Service Directory Traversal
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_traversal.rb
Platform: win
Disclosure date: 2014-01-02
References: CVE-2013-6194, OSVDB-101630, BID-64647, ZDI-14-003, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422

Description:
This module exploits a directory traversal vulnerability in the Hewlett-Packard Data
          Protector product. The vulnerability exists in the Backup Client Service (OmniInet.exe)
          and is triggered when parsing packets with opcode 42. This module has been tested
          successfully on HP Data Protector 6.20 on Windows 2003 SP2 and Windows XP SP3.

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    print_status("HP Data Protector version #{fingerprint}")

    if fingerprint =~ /HP Data Protector A\.06\.(\d+)/
      minor = $1.to_i
    else
      return Exploit::CheckCode::Safe("#{fingerprint} is not a vulnerable version")
    end

    if minor < 21
      return Exploit::CheckCode::Vulnerable("HP Data Protector A.06.#{minor} is vulnerable")
    elsif minor == 21
      return Exploit::CheckCode::Detected("HP Data Protector A.06.#{minor} detected")
    else
      return Exploit::CheckCode::Detected("HP Data Protector A.06.#{minor} detected")
    end
  end
Metasploit Module: Delta Electronics InfraSuite Device Master Deserialization
Type: exploit
Path: modules/exploits/windows/misc/delta_electronics_infrasuite_deserialization.rb
Platform: win
Disclosure date: 2023-05-17
References: CVE-2023-1133, URL-https://www.zerodayinitiative.com/advisories/ZDI-23-672/, URL-https://attackerkb.com/topics/owl4Xz8fKW/cve-2023-1133
Targets: Windows EXE Dropper, Windows CMD

Description:
Delta Electronics InfraSuite Device Master versions below v1.0.5 have an
          unauthenticated .NET deserialization vulnerability within the 'ParseUDPPacket()'
          method of the 'Device-Gateway-Status' process.

          The 'ParseUDPPacket()' method reads user-controlled packet data and eventually
          calls 'BinaryFormatter.Deserialize()' on what it determines to be the packet header without appropriate validation,
          leading to unauthenticated code execution as the user running the 'Device-Gateway-Status' process.

Check method (fingerprinting):
print_status('Requesting the login page to determine if target is InfraSuite Device Master...')
    res = send_request_cgi(
      'method' => 'GET',
      'rport' => datastore['INFRASUITE_PORT'],
      'uri' => normalize_uri(target_uri.path, 'login.html')
    )

    return CheckCode::Unknown('No response received from target') unless res

    unless res.body.include?('InfraSuite Manager Login')
      return CheckCode::Safe('Target does not appear to be InfraSuite Device Master.')
    end

    print_status('Target is InfraSuite Device Master. Now attempting to determine version.')
    res = send_request_cgi(
      'method' => 'GET',
      'rport' => datastore['INFRASUITE_PORT'],
      'uri' => normalize_uri(target_uri.path, 'js/webcfg.js')
    )

    unless res&.body&.include?('var devicemasterCfg')
      return CheckCode::Detected('Discovered InfraSuite Device Master, but couldn\'t determine version.')
    end

    version = res.body.match(/version:'(\d+(?:\.\d+)+[a-zA-Z]?)'/)
    unless version && version.length > 1
      return CheckCode::Detected('Failed to find version string')
    end

    version = version[1]
    vprint_status("Found version '#{version}' of InfraSuite Device Master")
    r_vers = Rex::Version.new(version)

    return CheckCode::Appears("InfraSuite Device Master version #{version} is vulnerable") if r_vers < Rex::Version.new('1.0.5')

    CheckCode::Safe("InfraSuite Device Master version #{version} is not vulnerable")
  end
Metasploit Module: Firebird Relational Database SVC_attach() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/fb_svc_attach.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38605, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted service attach request.
Metasploit Module: UFO: Alien Invasion IRC Client Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ufo_ai.rb
Platform: win
Disclosure date: 2009-10-28
References: CVE-2009-10006, OSVDB-65689, EDB-14013

Description:
This module exploits a buffer overflow in the IRC client component of
          UFO: Alien Invasion 2.2.1.
Metasploit Module: Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020000 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/citrix_streamprocess_data_msg.rb
Platform: win
Disclosure date: 2011-11-04
References: OSVDB-75780, BID-49803, ZDI-12-009, URL-http://support.citrix.com/article/CTX130846

Description:
This module exploits a remote buffer overflow in the Citrix Provisioning Services
          5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet to the
          6905/UDP port.  The module has been successfully tested on Windows Server 2003 SP2,
          Windows 7, and Windows XP SP3.
Metasploit Module: Mobile Mouse RCE
Type: exploit
Path: modules/exploits/windows/misc/mobile_mouse_rce.rb
Platform: win
Disclosure date: 2022-09-20
References: CVE-2023-31902, EDB-51010, URL-https://mobilemouse.com/

Description:
This module utilizes the Mobile Mouse Server by RPA Technologies, Inc protocol
          to deploy a payload and run it from the server.  This module will only deploy
          a payload if the server is set without a password (default).
          Tested against 3.6.0.4, current at the time of module writing

Check method (fingerprinting):
if datastore['CLIENTNAME'].blank?
      @client_name = Rex::Text.rand_text_alphanumeric(5..10).to_s
      print_status("Client name set to: #{@client_name}")
    else
      @client_name = datastore['CLIENTNAME']
    end

    connect

    print_status('Connecting')
    connect_command
    res = sock.get_once
    if res.nil?
      return CheckCode::Unknown('No response received from target')
    end

    disconnect

    res = res.split("\x1E")
    if res[1] == 'NO'
      return CheckCode::Safe("Unable to connect, server response: #{res[4]}")
    end

    CheckCode::Appears("Connected to hostname #{res[3]} with MAC address #{res[5]}")
  end
Metasploit Module: BigAnt Server 2.2 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bigant_server.rb
Platform: win
Disclosure date: 2008-04-15
References: CVE-2008-1914, OSVDB-44454, BID-28795

Description:
This module exploits a stack buffer overflow in BigAnt Server 2.2.
          By sending a specially crafted packet, an attacker may be
          able to execute arbitrary code.
Metasploit Module: Remote Mouse RCE
Type: exploit
Path: modules/exploits/windows/misc/remote_mouse_rce.rb
Platform: win
Disclosure date: 2019-04-15
References: EDB-46697, CVE-2022-3365, URL-https://www.remotemouse.net/, URL-https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/remote%20mouse/remote-mouse-rce.py

Description:
This module utilizes the Remote Mouse Server by Emote Interactive protocol
          to deploy a payload and run it from the server on versions < 4.200 (500 server response).
          This module will only deploy
          a payload if the server is set without a password (default).
          Tested against 4.110, current at the time of module writing

Check method (fingerprinting):
connect
    response = sock.get_once
    disconnect
    if response.include?('SIN 15win nop nop')
      splits = response.split(' ')
      return CheckCode::Appears("Received handshake with version: #{splits.last}") if splits.last.to_i < 500

      return CheckCode::Safe("Received handshake with version: #{splits.last}, which is not exploitable")
    end

    CheckCode::Unknown('Invalid response from target')
  end
Metasploit Module: HP Operations Agent Opcode coda.exe 0x34 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_operations_agent_coda_34.rb
Platform: win
Disclosure date: Jul 09 2012
References: CVE-2012-2019, OSVDB-83673, BID-54362, ZDI-12-114

Description:
This module exploits a buffer overflow vulnerability in HP Operations Agent for
        Windows. The vulnerability exists in the HP Software Performance Core Program
        component (coda.exe) when parsing requests for the 0x34 opcode. This module has
        been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and
        Windows 2003 SP2 (DEP bypass).

        The coda.exe components runs only for localhost by default, network access must be
        granted through its configuration to be remotely exploitable. On the other hand it
        runs on a random TCP port, to make easier reconnaissance a check function is
        provided.

Check method (fingerprinting):
res = ping

    if not res
      vprint_error("No response from target")
      return Exploit::CheckCode::Unknown('No response from target')
    end

    if res !~ /HTTP\/1\.1 200 OK/
      return Exploit::CheckCode::Unknown('Failed to determine the target state')
    end

    if res =~ /server:.*coda 11.(\d+)/
      minor = $1.to_i
      if minor < 2
        return Exploit::CheckCode::Appears("HP Operations Agent CODA 11.#{minor} appears vulnerable")
      end
    end

    if res =~ /server:.*coda/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Asus Dpcproxy Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/asus_dpcproxy_overflow.rb
Platform: win
Disclosure date: 2008-03-21
Authors: Jacopo Cervini
References: CVE-2008-1491, OSVDB-43638, BID-28394

Description:
This module exploits a stack buffer overflow in Asus Dpcroxy version 2.0.0.19.
          It should be vulnerable until version 2.0.0.24.
          Credit to Luigi Auriemma
Metasploit Module: HP LoadRunner magentproc.exe Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_loadrunner_magentproc.rb
Platform: win
Disclosure date: 2013-07-27
References: CVE-2013-4800, OSVDB-95644, ZDI-13-169

Description:
This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The
          vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending
          a specially crafted packet, an attacker may be able to execute arbitrary code.
Metasploit Module: Anviz CrossChex Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/crosschex_device_bof.rb
Platform: win
Disclosure date: 2019-11-28
References: CVE-2019-12518, URL-https://www.0x90.zone/multiple/reverse/2019/11/28/Anviz-pwn.html, EDB-47734

Description:
Waits for broadcasts from Ainz CrossChex looking for new devices, and returns a custom broadcast,
          triggering a stack buffer overflow.
Metasploit Module: MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ms07_064_sami.rb
Platform: win
Disclosure date: 2007-12-11
Authors: MC
References: CVE-2007-3901, OSVDB-39126, MSB-MS07-064, BID-26789

Description:
This module exploits a stack buffer overflow in the DirectShow Synchronized
          Accessible Media Interchanged (SAMI) parser in quartz.dll. This module
          has only been tested with Windows Media Player (6.4.09.1129) and
          DirectX 8.0.
Metasploit Module: Firebird Relational Database isc_attach_database() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/fb_isc_attach_database.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38607, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted create request.
Metasploit Module: Borland InterBase SVC_attach() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ib_svc_attach.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38605, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted service attach request.
Metasploit Module: mIRC PRIVMSG Handling Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/mirc_privmsg_server.rb
Platform: win
Disclosure date: 2008-10-02
References: CVE-2008-4449, OSVDB-48752, BID-31552, EDB-6666

Description:
This module exploits a buffer overflow in the mIRC IRC Client v6.34 and earlier.
          By enticing a mIRC user to connect to this server module, an excessively long PRIVMSG
          command can be sent, overwriting the stack. Due to size restrictions, ordinal payloads
          may be necessary. This module is based on the code by SkD.
Metasploit Module: HP OmniInet.exe Opcode 20 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_omniinet_4.rb
Platform: win
Disclosure date: 2011-06-29
References: CVE-2011-1865, OSVDB-73571, EDB-17468, URL-http://www.coresecurity.com/content/HP-Data-Protector-multiple-vulnerabilities, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02872182

Description:
This module exploits a vulnerability found in HP Data Protector's OmniInet
          process.  By supplying a long string of data as the file path with opcode '20',
          a buffer overflow can occur when this data is being written on the stack where
          no proper bounds checking is done beforehand, which results arbitrary code
          execution under the context of SYSTEM.  This module is also made against systems
          such as Windows Server 2003 or Windows Server 2008 that have DEP and/or ASLR
          enabled by default.
Metasploit Module: SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write
Type: exploit
Path: modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb
Platform: win
Disclosure date: 2014-02-22
References: CVE-2014-100015, EDB-31831, OSVDB-103671

Description:
This module exploits a remote arbitrary file write vulnerability in
          SolidWorks Workgroup PDM 2014 SP2 and prior.

          For targets running Windows Vista or newer the payload is written to the
          startup folder for all users and executed upon next user logon.

          For targets before Windows Vista code execution can be achieved by first
          uploading the payload as an exe file, and then upload another mof file,
          which schedules WMI to execute the uploaded payload.

          This module has been tested successfully on SolidWorks Workgroup PDM
          2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).

Check method (fingerprinting):
# op code
    req = "\xD0\x07\x00\x00"
    # filename length
    req << "\x00\x00\x00\x00"
    # data length
    req << "\x00\x00\x00\x00"
    connect
    sock.put req
    res = sock.get_once
    disconnect
    if !res
      vprint_error "Connection failed"
      Exploit::CheckCode::Unknown('Connection failed')
    elsif res == "\x00\x00\x00\x00"
      vprint_status "Received reply (#{res.length} bytes)"
      Exploit::CheckCode::Detected('SolidWorks Workgroup PDM service detected')
    else
      vprint_warning "Unexpected reply (#{res.length} bytes)"
      Exploit::CheckCode::Safe('Unexpected reply from target')
    end
  end

  #
  # Send a file
  #
Metasploit Module: ManageEngine EventLog Analyzer Remote Code Execution
Type: exploit
Path: modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb
Platform: win
Disclosure date: 2015-07-11
References: EDB-38173, CVE-2015-7387, URL-https://seclists.org/fulldisclosure/2015/Sep/59

Description:
This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6
          build 10060 and previous versions. Every authenticated user, including the default "guest"
          account can execute SQL queries directly on the underlying Postgres database server. The
          queries are executed as the "postgres" user which has full privileges and thus is able to
          write files to disk. This way a JSP payload can be uploaded and executed with SYSTEM
          privileges on the web server. This module has been tested successfully on ManageEngine
          EventLog Analyzer 10.0 (build 10003) over Windows 7 SP1.

Check method (fingerprinting):
# Check version
    vprint_status("Trying to detect ManageEngine EventLog Analyzer")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'event', 'index3.do')
    })

    if res && res.code == 200 && res.body && res.body.include?('ManageEngine EventLog Analyzer')
      return Exploit::CheckCode::Detected('ManageEngine EventLog Analyzer detected')
    else
      return Exploit::CheckCode::Safe('ManageEngine EventLog Analyzer not detected')
    end
  end