deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Optergy Proton and Enterprise BMS Command Injection using a backdoor
Type: exploit
Path: modules/exploits/linux/http/optergy_bms_backdoor_rce_cve_2019_7276.rb
Platform: unix
Disclosure date: 2019-11-05
References: CVE-2019-7276, URL-https://applied-risk.com/resources/ar-2019-008, URL-https://optergy.com/products/proton/, URL-https://optergy.com/products/optergy-enterprise/, URL-https://attackerkb.com/topics/QrYFIjnd3J/cve-2019-7276, EDB-47641
Targets: Unix Command, Linux Dropper

Description:
This module exploits an undocumented backdoor vulnerability in the Optergy Proton and Enterprise
          Building Management System (BMS) applications. Versions `2.0.3a` and below are vulnerable.
          Attackers can exploit this issue by directly navigating to an undocumented backdoor script
          called Console.jsp in the tools directory and gain full system access.
          Successful exploitation results in `root` command execution using `sudo` as user `optergy`.

Check method (fingerprinting):
res = execute_command('whoami')
    return Exploit::CheckCode::Safe('The target is not vulnerable') unless res && (res.chomp == 'root' || res.chomp == 'optergy')

    Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: LibreNMS Authenticated RCE (CVE-2024-51092)
Type: exploit
Path: modules/exploits/linux/http/librenms_authenticated_rce_cve_2024_51092.rb
Disclosure date: 2024-11-15
References: CVE-2024-51092
Targets: Linux Command

Description:
An authenticated attacker can create dangerous directory names on the system and
          alter sensitive configuration parameters through the web portal.
          Those two defects combined then allows to inject arbitrary OS commands inside shell_exec() calls,
          thus achieving arbitrary code execution.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login')
    })
    return Exploit::CheckCode::Unknown('LibreNMS is not detected.') unless res&.code == 200 && res&.body&.include?('<title>LibreNMS</title>')

    token = get_csrf_token(res)
    return Exploit::CheckCode::Unknown('LibreNMS detected. Failed to extract csrf token.') unless token

    begin
      login
    rescue StandardError => e
      return Exploit::CheckCode::Unknown(e)
    end

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'about')
    })
    return Exploit::CheckCode::Unknown('LibreNMS detected. Cannot find libreNMS version.') unless res&.code == 200

    html_body = res&.get_html_document
    version_node = html_body&.at("a[@href='https://www.librenms.org/changelog.html']")
    return Exploit::CheckCode::Unknown('LibreNMS detected. Cannot find libreNMS version.') if version_node.nil?

    version_node&.at('span')&.content = ''
    version = Rex::Version.new(version_node.text)
    return Exploit::CheckCode::Safe("LibreNMS version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('24.9.0'), Rex::Version.new('24.9.1'))

    Exploit::CheckCode::Appears("LibreNMS version #{version} detected, which is vulnerable.")
  end
Metasploit Module: Judge0 sandbox escape
Type: exploit
Path: modules/exploits/linux/http/judge0_sandbox_escape_cve_2024_28189.rb
Disclosure date: 2024-03-04
References: CVE-2024-28185, CVE-2024-28189, URL-https://tantosec.com/blog/judge0/
Targets: Linux Command

Description:
Judge0 does not account for symlinks placed inside the sandbox directory,
          which can be leveraged by an attacker to write to arbitrary files and gain code execution outside of the sandbox.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'version')
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    version = Rex::Version.new(res.body)
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable") unless version <= Rex::Version.new('1.13.0')

    print_status("Version #{version} detected, which is vulnerable")

    return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if compile_language_ids

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Kafka UI Unauthenticated Remote Command Execution via the Groovy Filter option.
Type: exploit
Path: modules/exploits/linux/http/kafka_ui_unauth_rce_cve_2023_52251.rb
Platform: unix
Disclosure date: 2023-09-27
References: CVE-2023-52251, URL-https://attackerkb.com/topics/ATJ1hTVB8H/cve-2023-52251, URL-https://github.com/BobTheShoplifter/CVE-2023-52251-POC
Targets: Unix/Linux Command

Description:
A command injection vulnerability exists in Kafka ui between `v0.4.0` and `v0.7.1` allowing
          an attacker to inject and execute arbitrary shell commands via the `groovy` filter parameter
          at the `topic` section.

Check method (fingerprinting):
vprint_status("Checking if #{peer} can be exploited.")
    return CheckCode::Appears("Kafka-ui version: #{@version}") if vuln_version?

    unless @version.blank?
      if @version.match(/\d\.\d\.\d/)
        return CheckCode::Safe("Kafka-ui version: #{@version}")
      else
        return CheckCode::Detected("Kafka-ui unknown version: #{@version}")
      end
    end
    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: DLINK DWL-2600 Authenticated Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/dlink_dwl_2600_command_injection.rb
Platform: unix
Disclosure date: 2019-05-15
References: CVE-2019-20499, EDB-46841
Targets: CMD, Linux mips Payload

Description:
Some DLINK Access Points are vulnerable to an authenticated OS command injection.
          Default credentials for the web interface are admin/admin.
Metasploit Module: F5 BIG-IP TMUI Directory Traversal and File Upload RCE
Type: exploit
Path: modules/exploits/linux/http/f5_bigip_tmui_rce_cve_2020_5902.rb
Platform: unix
Disclosure date: 2020-06-30
References: CVE-2020-5902, URL-https://support.f5.com/csp/article/K52145254, URL-https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
Targets: Unix Command, Linux Dropper

Description:
This module exploits a directory traversal in F5's BIG-IP Traffic
          Management User Interface (TMUI) to upload a shell script and execute
          it as the Unix root user.

          Unix shell access is obtained by escaping the restricted Traffic
          Management Shell (TMSH). The escape may not be reliable, and you may
          have to run the exploit multiple times. Sorry!

          Versions 11.6.1-11.6.5, 12.1.0-12.1.5, 13.1.0-13.1.3, 14.1.0-14.1.2,
          15.0.0, and 15.1.0 are known to be vulnerable. Fixes were introduced
          in 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, and 15.1.0.4.

          Tested against the VMware OVA release of 14.1.2.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'POST',
      'uri' => dir_trav('/tmui/locallb/workspace/fileRead.jsp'),
      'vars_post' => {
        'fileName' => '/etc/f5-release'
      }
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && /BIG-IP release (?<version>[\d.]+)/ =~ res.body
      return CheckCode::Safe('Target did not respond with BIG-IP version.')
    end

    # If we got here, the directory traversal was successful
    CheckCode::Vulnerable("Target is running BIG-IP #{version}.")
  end
Metasploit Module: Linksys WRT54 Access Point apply.cgi Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/linksys_apply_cgi.rb
Platform: linux
Disclosure date: 2005-09-13
References: CVE-2005-2799, OSVDB-19389, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=305

Description:
This module exploits a stack buffer overflow in apply.cgi on the Linksys WRT54G and WRT54GS routers.
          According to iDefense who discovered this vulnerability, all WRT54G versions prior to
          4.20.7 and all WRT54GS version prior to 1.05.2 may be affected.
Metasploit Module: Symantec Web Gateway 5.0.2.18 pbcontrol.php Command Injection
Type: exploit
Path: modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb
Platform: unix
Disclosure date: 2012-07-23
References: CVE-2012-2953, OSVDB-84120, BID-54426, EDB-20088, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00

Description:
This module exploits a command injection vulnerability found in Symantec Web
          Gateway's HTTP service.  While handling the filename parameter, the Spywall API
          does not do any filtering before passing it to an exec() call in proxy_file(),
          thus results in remote code execution under the context of the web server. Please
          note authentication is NOT needed to gain access.

Check method (fingerprinting):
dir = File.dirname(target_uri.path)

    res1 = send_request_raw({ 'uri' => "#{dir}/login.php" })
    res2 = send_request_raw({ 'uri' => "#{dir}/pbcontrol.php" })

    if res1 and res2
      if res1.body =~ /\<title\>Symantec Web Gateway\<\/title\>/ and res2.body =~ /^0$/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Bludit Directory Traversal Image File Upload Vulnerability
Type: exploit
Path: modules/exploits/linux/http/bludit_upload_images_exec.rb
Platform: php
References: CVE-2019-16113, URL-https://github.com/bludit/bludit/issues/1081, URL-https://github.com/bludit/bludit/commit/a9640ff6b5f2c0fa770ad7758daf24fec6fbf3f5#diff-6f5ea518e6fc98fb4c16830bbf9f5dac

Description:
This module exploits a vulnerability in Bludit. A remote user could abuse the uuid
          parameter in the image upload feature in order to save a malicious payload anywhere
          onto the server, and then use a custom .htaccess file to bypass the file extension
          check to finally get remote code execution.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php')
    })

    unless res
      vprint_error('Connection timed out')
      return CheckCode::Unknown('Could not determine the target status')
    end

    html = res.get_html_document
    generator_tag = html.at('meta[@name="generator"]')
    unless generator_tag
      vprint_error('No generator metadata tag found in HTML')
      return CheckCode::Safe('The target is not vulnerable')
    end

    content_attr = generator_tag.attributes['content']
    unless content_attr
      vprint_error("No content attribute found in metadata tag")
      return CheckCode::Safe('The target is not vulnerable')
    end

    if content_attr.value == 'Bludit'
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Western Digital MyCloud multi_uploadify File Upload Vulnerability
Type: exploit
Path: modules/exploits/linux/http/wd_mycloud_multiupload_upload.rb
Platform: php
Disclosure date: 2017-07-29
References: URL-https://www.exploitee.rs/index.php/Western_Digital_MyCloud#.2Fjquery.2Fuploader.2Fmulti_uploadify.php_.28added_08.2F06.2F2017.29, URL-https://download.exploitee.rs/file/generic/Exploiteers-DEFCON25.pdf, URL-https://www.youtube.com/watch?v=EO_49pfmA5A, CVE-2017-17560

Description:
This module exploits a file upload vulnerability found in Western Digital's MyCloud
          NAS web administration HTTP service. The /web/jquery/uploader/multi_uploadify.php
          PHP script provides multipart upload functionality that is accessible without authentication
          and can be used to place a file anywhere on the device's file system. This allows an
          attacker the ability to upload a PHP shell onto the device and obtain arbitrary code
          execution as root.

Check method (fingerprinting):
res = send_request_cgi('uri' => '/web/jquery/uploader/multi_uploadify.php')

    if res.nil?
      vprint_error('Connection failed')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 302 && res.headers['Location'] =~ /\?status=1/
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: NETGEAR ReadyNAS Perl Code Evaluation
Type: exploit
Path: modules/exploits/linux/http/netgear_readynas_exec.rb
Platform: unix
Disclosure date: 2013-07-12
References: CVE-2013-2751, OSVDB-98826, URL-http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/, URL-http://www.tripwire.com/register/security-advisory-netgear-readynas/

Description:
This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The
          vulnerability exists on the web front end, specifically in the np_handler.pl component,
          due to an insecure usage of the eval() perl function. This module has been tested
          successfully on a NETGEAR ReadyNAS 4.2.23 Firmware emulated environment.

Check method (fingerprinting):
res = send_request_payload(")")
    if res and res.code == 200 and res.body =~ /syntax error at \(eval/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Pandora ITSM authenticated command injection leading to RCE via the backup function
Type: exploit
Path: modules/exploits/linux/http/pandora_itsm_auth_rce_cve_2025_4653.rb
Platform: unix
Disclosure date: 2025-06-10
References: CVE-2025-4653, URL-https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/, URL-https://attackerkb.com/topics/wgCb1QQm1t/cve-2025-4653
Targets: Unix/Linux Command

Description:
Pandora ITSM is a platform for Service Management & Support including a Helpdesk for support
          and customer service teams, aligned with ITIL processes.
          This module exploits a command injection vulnerability in the `name` backup setting at the
          application setup page of Pandora ITSM. This can be triggered by generating a backup with a
          malicious payload injected at the `name` parameter.
          You need to have admin access at the Pandora ITSM  Web application in order to execute this RCE.
          This access can be achieved by knowing the admin credentials to access the web application or
          leveraging a default password vulnerability in Pandora ITSM that allows an attacker to access
          the Pandora FMS ITSM database, create a new admin user and gain administrative access to the
          Pandora ITSM Web application. This attack can be remotely executed over the WAN as long as the
          MySQL services are exposed to the outside world.
          This issue affects all ITSM Enterprise editions up to `5.0.105` and is patched at `5.0.106`.

Check method (fingerprinting):
# use API v1.0 to check version
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'include', 'api.php'),
      'vars_get' => {
        'info' => 'version'
      }
    })
    return CheckCode::Unknown('Received unknown response.') unless res&.code == 200
    return CheckCode::Safe('Target is not a Pandora ITSM application.') unless res.body.include?('Pandora ITSM')

    version = res.body.match(/\d{1,3}\.\d{1,3}\.\d{1,3}/)
    unless version.nil?
      version = Rex::Version.new(version)
      if version < Rex::Version.new('5.0.106')
        return CheckCode::Appears(res.body.strip.to_s)
      else
        return CheckCode::Safe(res.body.strip.to_s)
      end
    end
    CheckCode::Detected('Could not determine the Pandora ITSM version.')
  end
Metasploit Module: TrueOnline / ZyXEL P660HN-T v1 Router Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/trueonline_p660hn_v1_rce.rb
Platform: unix
Disclosure date: 2016-12-26
References: CVE-2017-18368, URL-https://seclists.org/fulldisclosure/2017/Jan/40, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt, URL-https://blogs.securiteam.com/index.php/archives/2910

Description:
TrueOnline is a major ISP in Thailand, and it distributes a customized version of
          the ZyXEL P660HN-T v1 router. This customized version has an unauthenticated command
          injection vulnerability in the remote log forwarding page.
          This module was tested in an emulated environment, as the author doesn't have access to the
          Thai router any more. Any feedback should be sent directly to the module's author, as well as
          to the Metasploit project.
          There are other language strings in the firmware, so it is likely that this firmware is not only
          distributed in Thailand. Other P660HN-T v1 in other countries might be vulnerable too.

Check method (fingerprinting):
res = send_request_cgi!({
      'uri' => '/cgi-bin/authorize.asp',
      'method' => 'GET'
    })
    if res && res.body =~ /ZyXEL P-660HN-T1A/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: Palo Alto Networks readSessionVarsFromFile() Session Corruption
Type: exploit
Path: modules/exploits/linux/http/panos_readsessionvars.rb
Platform: unix
Disclosure date: 2017-12-11
References: CVE-2017-15944, URL-https://seclists.org/fulldisclosure/2017/Dec/38, BID-102079

Description:
This module exploits a chain of vulnerabilities in Palo Alto Networks products running
          PAN-OS versions prior to 6.1.19, 7.0.19, 7.1.14, and 8.0.6. This chain starts by using
          an authentication bypass flaw to to exploit an XML injection issue, which is then
          abused to create an arbitrary directory, and finally gains root code execution by
          exploiting a vulnerable cron script. This module uses an initial reverse TLS callback
          to stage arbitrary payloads on the target appliance. The cron job used for the final
          payload runs every 15 minutes by default and exploitation can take up to 20 minutes.
Metasploit Module: NETGEAR WNR2000v5 (Un)authenticated hidden_lang_avi Stack Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/netgear_wnr2000_rce.rb
Platform: unix
Disclosure date: 2016-12-20
References: CVE-2016-10174, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear-wnr2000.txt, URL-https://seclists.org/fulldisclosure/2016/Dec/72, URL-http://kb.netgear.com/000036549/Insecure-Remote-Access-and-Command-Execution-Security-Vulnerability

Description:
The NETGEAR WNR2000 router has a stack buffer overflow vulnerability in the hidden_lang_avi
          parameter.
          In order to exploit it, it is necessary to guess the value of a certain timestamp which
          is in the configuration of the router. An authenticated attacker can simply fetch this
          from a page, but an unauthenticated attacker has to brute force it.
          Brute forcing the timestamp token might take a few minutes, a few hours, or days, but
          it is guaranteed that it can be bruteforced.
          This module implements both modes, and it works very reliably. It has been tested with
          the WNR2000v5, firmware versions 1.0.0.34 and 1.0.0.18. It should also work with hardware
          revisions v4 and v3, but this has not been tested - with these routers it might be necessary
          to adjust the LibcBase variable as well as the gadget addresses.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })
    if res && res.headers['WWW-Authenticate']
      auth = res.headers['WWW-Authenticate']
      if auth =~ /WNR2000v5/
        return Exploit::CheckCode::Detected('The target service was detected')
      elsif auth =~ /WNR2000v4/ || auth =~ /WNR2000v3/
        return Exploit::CheckCode::Unknown('Could not determine the target status')
      end
    end
    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: DIR-850L (Un)authenticated OS Command Exec
Type: exploit
Path: modules/exploits/linux/http/dlink_dir850l_unauth_exec.rb
Platform: linux
Disclosure date: 2017-08-09
References: CVE-2019-17508, URL-https://www.seebug.org/vuldb/ssvid-96333, URL-https://blogs.securiteam.com/index.php/archives/3310

Description:
This module leverages an unauthenticated credential disclosure
          vulnerability to then execute arbitrary commands on DIR-850L routers
          as an authenticated user. Unable to use Meterpreter payloads.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/',
        'method' => 'GET'
      })
      if res && res.headers['Server']
        auth = res.headers['Server']
        if auth =~ /DIR-850L/
          if auth =~ /WEBACCESS\/1\.0/
            return Exploit::CheckCode::Safe('The target is not vulnerable')
          else
            return Exploit::CheckCode::Detected('The target service was detected')
          end
        end
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Mida Solutions eFramework ajaxreq.php Command Injection
Type: exploit
Path: modules/exploits/linux/http/mida_solutions_eframework_ajaxreq_rce.rb
Platform: linux
Disclosure date: 2020-07-24
References: CVE-2020-15920, EDB-48768, URL-https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
Targets: Linux (x86), Linux (x64), UNIX (cmd)

Description:
This module exploits a command injection vulnerability in Mida
          Solutions eFramework version 2.9.0 and prior.

          The `ajaxreq.php` file allows unauthenticated users to inject
          arbitrary commands in the `PARAM` parameter to be executed as
          the apache user. The sudo configuration permits the apache user
          to execute any command as root without providing a password,
          resulting in privileged command execution as root.

          This module has been successfully tested on Mida Solutions
          eFramework-C7-2.9.0 virtual appliance.

Check method (fingerprinting):
res = execute_command('id')

    unless res
      return CheckCode::Safe('Connection failed')
    end

    unless res.body.include?('uid=')
      return CheckCode::Safe('Target is not vulnerable')
    end

    CheckCode::Vulnerable('The target is vulnerable')
  end