deardaniel/secdata-raw huggingface dataset:
Metasploit Module: DiskBoss Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/diskboss_get_bof.rb
Platform: win
Disclosure date: 2016-12-05
References: CVE-2025-34105, EDB-40869, EDB-42395

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of DiskBoss Enterprise v7.5.12, v7.4.28, and v8.2.14,
          caused by improper bounds checking of the request path in HTTP GET
          requests sent to the built-in web server. This module has been
          tested successfully on Windows XP SP3 and Windows 7 SP1.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    if res && res.code == 200
      if res.body =~ /DiskBoss Enterprise v(7\.4\.28|7\.5\.12|8\.2\.14)/
        return Exploit::CheckCode::Vulnerable('Target is vulnerable')
      elsif res.body =~ /DiskBoss Enterprise/
        return Exploit::CheckCode::Detected('Target service detected')
      end
    else
      vprint_error('Unable to determine due to a HTTP connection timeout')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Free Download Manager Remote Control Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/fdm_auth_header.rb
Platform: win
Disclosure date: 2009-02-02
References: CVE-2009-0183, OSVDB-51745

Description:
This module exploits a stack buffer overflow in Free Download Manager
          Remote Control 2.5 Build 758. When sending a specially crafted
          Authorization header, an attacker may be able to execute arbitrary code.
Metasploit Module: Cogent DataHub HTTP Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/cogent_datahub_request_headers_bof.rb
Platform: win
Disclosure date: 2013-07-26
References: CVE-2013-0680, OSVDB-95819, BID-53455, ZDI-13-178, URL-http://www.cogentdatahub.com/Info/130712_ZDI-CAN-1915_Response.html

Description:
This module exploits a stack based buffer overflow on Cogent DataHub 7.3.0. The
          vulnerability exists in the HTTP server. While handling HTTP headers, a
          strncpy() function is used in a dangerous way. This module has been tested
          successfully on Cogent DataHub 7.3.0 (Demo) on Windows XP SP3.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => "/datahub.asp",
      'method' => 'GET',
    })

    if res and res.code == 200 and res.body =~ /<title>DataHub - Web Data Browser<\/title>/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Sitecore Experience Platform (XP) PreAuth Deserialization RCE
Type: exploit
Path: modules/exploits/windows/http/sitecore_xp_cve_2021_42237.rb
Platform: win
Disclosure date: 2021-11-02
References: CVE-2021-42237, URL-https://blog.assetnote.io/2021/11/02/sitecore-rce/, URL-https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a deserialization vulnerability in the Report.ashx page
          of Sitecore XP 7.5 to 7.5.2, 8.0 to 8.0.7, 8.1 to 8.1.3, and 8.2 to 8.2.7.
          Versions 7.2.6 and earlier and 9.0 and later are not affected.

          The vulnerability occurs due to Report.ashx's handler, located in Sitecore.Xdb.Client.dll
          under the Sitecore.sitecore.shell.ClientBin.Reporting.Report defintion, having a ProcessRequest()
          handler that calls ProcessReport() with the context of the attacker's request without properly
          checking if the attacker is authenticated or not.

          This request then causes ReportDataSerializer.DeserializeQuery() to be called, which will
          end up calling the DeserializeParameters() function of
          Sitecore.Analytics.Reporting.ReportDataSerializer, if a "parameters" XML tag is found in
          the attacker's request.

          Then for each subelement named "parameter", the code will check that it has a name and
          if it does, it will call NetDataContractSerializer().ReadObject on it. NetDataContractSerializer is
          vulnerable to deserialization attacks and can be trivially exploited by using the
          TypeConfuseDelegate gadget chain.

          By exploiting this vulnerability, an attacker can gain arbitrary code execution as the user
          that IIS is running as, aka NT AUTHORITY\NETWORK SERVICE. Users can then use technique 4
          of the "getsystem" command to use RPCSS impersonation and get SYSTEM level code execution.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'sitecore', 'shell', 'ClientBin', 'Reporting', 'Report.ashx')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && res.body.include?('Sitecore.Analytics.Reporting.ReportDataSerializer.DeserializeQuery')
      return CheckCode::Safe('Target is not running Sitecore XP or has patched the vulnerability.')
    end

    return CheckCode::Appears('Response.ashx is accessible and appears to be deserializing data!')
  end
Metasploit Module: Oracle Endeca Server Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/oracle_endeca_exec.rb
Platform: win
Disclosure date: Jul 16 2013
References: CVE-2013-3763, BID-61217, OSVDB-95269, ZDI-13-190, URL-http://www.oracle.com/technetwork/topics/security/cpujuly2[PII_REDACTED].html

Description:
This module exploits a command injection vulnerability on the Oracle Endeca
        Server 7.4.0. The vulnerability exists on the createDataStore method from the
        controlSoapBinding web service. The vulnerable method only exists on the 7.4.0
        branch and isn't available on the 7.5.5.1 branch. In addition, the injection
        has been found to be Windows specific. This module has been tested successfully
        on Endeca Server 7.4.0.787 over Windows 2008 R2 (64 bits).

Check method (fingerprinting):
res = send_request_soap(version_soap)

    if res.nil? or res.code != 200 or res.body !~ /versionResponse/
      return Exploit::CheckCode::Safe('Target did not return a valid version response')
    end

    version_match = res.body.match(/<serverVersion>Oracle Endeca Server ([0-9\.]*) /)

    if version_match.nil?
      return Exploit::CheckCode::Safe('Could not extract version from response')
    else
      version = version_match[1]
    end

    vprint_status("Version found: Oracle Endeca Server #{version}")

    if version =~ /7\.4\.0/ and version <= "7.4.0.787"
      return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: DiskSavvy Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/disksavvy_get_bof.rb
Platform: win
Disclosure date: 2016-12-01
References: CVE-2017-6187, EDB-40869

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of DiskSavvy Enterprise v9.1.14 and v9.3.14,
          caused by improper bounds checking of the request path in HTTP GET
          requests sent to the built-in web server. This module has been
          tested successfully on Windows XP SP3 and Windows 7 SP1.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    if res && res.code == 200
      version = res.body[/Disk Savvy Enterprise v[^<]*/]
      if version
        vprint_status("Version detected: #{version}")
        if version =~ /9\.(1|3)\.14/
          return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
        end

        return Exploit::CheckCode::Detected("Target detected with version: #{version}")
      end
    else
      vprint_error('Unable to determine due to a HTTP connection timeout')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('Disk Savvy Enterprise not detected')
  end
Metasploit Module: HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_snmp.rb
Platform: win
Disclosure date: 2009-12-09
References: CVE-2009-3849, OSVDB-60933

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
          By sending a specially crafted CGI request to Snmp.exe, an attacker may be able to execute
          arbitrary code.
Metasploit Module: HP LoadRunner EmulationAdmin Web Service Directory Traversal
Type: exploit
Path: modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb
Platform: win
Disclosure date: 2013-10-30
References: CVE-2013-4837, OSVDB-99231, BID-63475, ZDI-13-259, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03969437

Description:
This module exploits a directory traversal vulnerability in version 11.52 of HP
          LoadRunner. The vulnerability exists in the EmulationAdmin web service, specifically
          in the copyFileToServer method, allowing the upload of arbitrary files. This module has
          been tested successfully on HP LoadRunner 11.52 on Windows 2003 SP2.

Check method (fingerprinting):
depth = datastore['DEPTH']
    install_path = datastore['INSTALLPATH']

    vprint_status("Detecting tomcat version...")
    tomcat_version = get_tomcat_version

    if tomcat_version
      print_status("Tomcat #{tomcat_version} detected... Verifying traversal...")
      location = ""
      location << install_path
      location << "\\" unless install_path.ends_with("\\") or install_path.ends_with("/")
      location << "apache-tomcat-#{tomcat_version}\\webapps\\ServiceEmulation"

      res = read_file(depth, location, "index.jsp")

      if res and res.code == 200 and res.body.to_s =~ /HP Service Emulation/
        vprint_good("Traversal exists and parameters are correct...")
        return Exploit::CheckCode::Vulnerable("Target is vulnerable with Tomcat version #{tomcat_version}")
      elsif res and res.code == 500 and res.body.to_s =~ /FileNotFoundException/
        vprint_warning("Traversal appears to exist, try adjusting parameters DEPTH and INSTALLPATH...")
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{tomcat_version}")
      else
        vprint_error("Failed to verify the directory traversal...")
      end
    else
      vprint_error("Tomcat version not detected...")
    end

    vprint_status("Checking if the vulnerable web service and method exist...")
    res = send_request_cgi({
      'uri' => normalize_uri('ServiceEmulation', 'services', 'EmulationAdmin'),
      'vars_get' => { 'wsdl' => 1 }
    })

    if res and res.code == 200 and
Metasploit Module: IBM Tivoli Endpoint Manager POST Query Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ibm_tivoli_endpoint_bof.rb
Platform: win
Disclosure date: 2011-05-31
References: CVE-2011-1220, OSVDB-72713, OSVDB-72751, BID-48049, ZDI-11-169

Description:
This module exploits a stack based buffer overflow in the way IBM Tivoli
          Endpoint Manager versions 3.7.1, 4.1, 4.1.1, 4.3.1 handles long POST query
          arguments.

          This issue can be triggered by sending a specially crafted HTTP POST request to
          the service (lcfd.exe) listening on TCP port 9495. To trigger this issue authorization
          is required. This exploit makes use of a second vulnerability, a hardcoded account
          (tivoli/boss) is used to bypass the authorization restriction.
Metasploit Module: FortiNet FortiClient Endpoint Management Server FCTID SQLi to RCE
Type: exploit
Path: modules/exploits/windows/http/forticlient_ems_fctid_sqli.rb
Platform: win
Disclosure date: 2024-04-21
References: URL-https://www.horizon3.ai/attack-research/attack-blogs/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive/, URL-https://www.horizon3.ai/attack-research/attack-blogs/cve-2023-48788-revisiting-fortinet-forticlient-ems-to-exploit-7-2-x/, URL-https://github.com/horizon3ai/CVE-2023-48788/blob/main/CVE-2023-48788.py, CVE-2023-48788

Description:
An SQLi injection vulnerability exists in FortiNet FortiClient EMS (Endpoint Management Server).
          FortiClient EMS serves as an endpoint management solution tailored for enterprises, offering a centralized
          platform for overseeing enrolled endpoints. The SQLi is vulnerability is due to user controller strings which
          can be sent directly into database queries.

          FcmDaemon.exe is the main service responsible for communicating with enrolled clients. By default it listens on port 8013
          and communicates with FCTDas.exe which is responsible for translating requests and sending them to the database.
          In the message header of a specific request sent between the two services, the FCTUID parameter is vulnerable
          SQLi. The SQLi can used to enable the xp_cmdshell which can then be used to obtain unauthenticated remote code
          execution in the context of NT AUTHORITY\SYSTEM

          Affected versions of FortiClient EMS include:
          7.2.0 through 7.2.2
          7.0.1 through 7.0.10

          Upgrading to either 7.2.3, 7.0.11 or above is recommended by FortiNet.

          It should be noted that in order to be vulnerable, at least one endpoint needs to be enrolled / managed by FortiClient
          EMS for the necessary vulnerable services to be available.

Check method (fingerprinting):
@version = get_version
    return CheckCode::Unknown("#{peer} - Version info was unable to be extracted from the target. FmcDaemon.exe might not be running.") unless @version

    if @version.between?(Rex::Version.new('7.2.0'), Rex::Version.new('7.2.2')) || @version.between?(Rex::Version.new('7.0.1'), Rex::Version.new('7.0.10'))
      return CheckCode::Appears("Version detected: #{@version}")
    end

    CheckCode::Safe("Version detected: #{@version}")
  end
Metasploit Module: ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection
Type: exploit
Path: modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb
Platform: win
Disclosure date: 2023-04-12
References: CVE-2023-29084, URL-https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/, URL-https://www.zerodayinitiative.com/advisories/ZDI-23-438/, URL-https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html, URL-https://www.manageengine.com/products/ad-manager/release-notes.html
Targets: Windows Command

Description:
ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient
          validation of user input when performing the ChangePasswordAction function before passing it into a string that is later
          used as an OS command to execute.

          By making a POST request to /api/json/admin/saveServerSettings with a params POST
          parameter containing a JSON array object that has a USERNAME or PASSWORD element containing a
          carriage return and newline, followed by the command the attacker wishes to execute, an attacker can gain RCE as the user
          running ADManager Plus, which will typically be the local administrator.

          Note that the attacker must be authenticated in order to send requests to /api/json/admin/saveServerSettings,
          so this vulnerability does require authentication to exploit.

          As this exploit modifies the HTTP proxy settings for the entire server, one cannot use fetch payloads
          with this exploit, since these will use HTTP connections that will be affected by the change in configuration.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => target_uri.path,
      'method' => 'GET'
    )

    unless res && res.code == 200 && res.body
      return CheckCode::Unknown('Browsing to root of website returned a non-200 or empty response!')
    end

    unless res.body&.match(/\.val\('ADManager Plus Authentication'\)/)
      return CheckCode::Safe('Target is not running ADManager Plus!')
    end

    build_number = res.body&.match(/src=".+\.js\?v=(\d{4})"/)
    unless build_number
      return CheckCode::Unknown('Home page did not leak the build number via the ?v= parameter as expected!')
    end

    build_number = build_number[1]
    print_good("The target is running AdManager Plus build #{build_number}!")

    # Versions 7181 and later are patched, everything prior is vulnerable.
    target_build = Rex::Version.new(build_number)
    if target_build >= Rex::Version.new('7181')
      CheckCode::Safe('Target is running a patched version of AdManager Plus!')
    elsif target_build < Rex::Version.new('7181')
      CheckCode::Appears('Target appears to be running a vulnerable version of AdManager Plus!')
    else
      CheckCode::Unknown("An unknown error occurred when trying to parse the build number: #{build_number}. Please report this error!")
    end
  end
Metasploit Module: Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability
Type: exploit
Path: modules/exploits/windows/http/novell_mdm_lfi.rb
Platform: win
References: CVE-2013-1081, OSVDB-91119, ZDI-13-087, URL-http://www.novell.com/support/kb/doc.php?id=7011895

Description:
This module exercises a vulnerability in Novel Zenworks Mobile Management's Mobile Device Management component
        which can allow unauthenticated remote code execution. Due to a flaw in the MDM.php script's input validation,
        remote attackers can both upload and execute code via a directory traversal flaw exposed in the 'language'
        parameter of a POST call to DUSAP.php.

Check method (fingerprinting):
v = get_version
    print_status("Detected version: #{v || 'Unknown'}")

    if v.nil?
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif v =~ /^2\.6\.[01]/ or v =~ /^2\.7\.0/
      # Conditions based on OSVDB info
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Disk Sorter Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/disksorter_bof.rb
Platform: win
Disclosure date: 2017-03-15
References: CVE-2017-7230

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of Disk Sorter Enterprise v9.5.12, caused by
          improper bounds checking of the request path in HTTP GET requests
          sent to the built-in web server. This module has been tested
          successfully on Windows 7 SP1 x86.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    if res && res.code == 200
      version = res.body[/Disk Sorter Enterprise v[^<]*/]
      if version
        vprint_status("Version detected: #{version}")
        if version =~ /9\.5\.12/
          return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
        end

        return Exploit::CheckCode::Detected("Target detected with version: #{version}")
      end
    else
      vprint_error('Unable to determine due to a HTTP connection timeout')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('Disk Sorter Enterprise not detected')
  end
Metasploit Module: eDirectory 8.7.3 iMonitor Remote Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/edirectory_imonitor.rb
Platform: win
Disclosure date: 2005-08-11
References: CVE-2005-2551, OSVDB-18703, BID-14548

Description:
This module exploits a stack buffer overflow in eDirectory 8.7.3
          iMonitor service. This vulnerability was discovered by Peter
          Winter-Smith of NGSSoftware.

          NOTE: repeated exploitation attempts may cause eDirectory to crash. It does
          not restart automatically in a default installation.
Metasploit Module: HP OpenView Network Node Manager OpenView5.exe CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_openview5.rb
Platform: win
Disclosure date: 2007-12-06
References: CVE-2007-6204, OSVDB-39530, BID-26741

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
          By sending a specially crafted CGI request, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Apache Tomcat CGIServlet enableCmdLineArguments Vulnerability
Type: exploit
Path: modules/exploits/windows/http/tomcat_cgi_cmdlineargs.rb
Platform: win
Disclosure date: 2019-04-10
References: CVE-2019-0232, URL-https://wwws.nightwatchcybersecurity.com/2019/04/30/remote-code-execution-rce-in-cgi-servlet-apache-tomcat-on-windows-cve-2019-0232/, URL-https://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-cve-2019-0232-a-remote-code-execution-vulnerability-in-apache-tomcat/

Description:
This module exploits a vulnerability in Apache Tomcat's CGIServlet component. When the
          enableCmdLineArguments setting is set to true, a remote user can abuse this to execute
          system commands, and gain remote code execution.

Check method (fingerprinting):
sig = Rex::Text.rand_text_alpha(10)
    uri = normalize_uri(target_uri.path)
    uri << "?&echo+#{sig}"

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => uri
    })

    unless res
      vprint_error('No Response from server')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body.include?(sig)
      return CheckCode::Vulnerable('Target is vulnerable')
    end

    CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: PeerCast URL Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/peercast_url.rb
Platform: win
Disclosure date: 2006-03-08
References: CVE-2006-1148, OSVDB-23777, BID-17040

Description:
This module exploits a stack buffer overflow in PeerCast <= v0.1216.
          The vulnerability is caused due to a boundary error within the
          handling of URL parameters.
Metasploit Module: Numara / BMC Track-It! FileStorageService Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/trackit_file_upload.rb
Platform: win
Disclosure date: 2014-10-07
References: CVE-2014-4872, OSVDB-112741, US-CERT-VU-121036, URL-https://seclists.org/fulldisclosure/2014/Oct/34

Description:
This module exploits an arbitrary file upload vulnerability in Numara / BMC Track-It!
          v8 to v11.X.
          The application exposes the FileStorageService .NET remoting service on port 9010
          (9004 for version 8) which accepts unauthenticated uploads. This can be abused by
          a malicious user to upload a ASP or ASPX file to the web root leading to arbitrary
          code execution as NETWORK SERVICE or SYSTEM.
          This module has been tested successfully on versions 11.3.0.355, 10.0.51.135, 10.0.50.107,
          10.0.0.143, 9.0.30.248 and 8.0.2.51.

Check method (fingerprinting):
version = get_version
    if version != nil
      if (version[0].to_i < 11) or
         (version[0].to_i == 11 and version[1].to_i <= 3) or
         (version[0].to_i == 11 and version[1].to_i == 3 and version[2].to_i == 0 and version[3].to_i < 999)
        ctx = { 'Msf' => framework, 'MsfExploit' => self }
        sock = Rex::Socket.create_tcp({ 'PeerHost' => rhost, 'PeerPort' => datastore['RPORT_REMOTING'], 'Context' => ctx })
        if not sock.nil?
          sock.write(rand_text_alpha(rand(200) + 100))
          res = sock.recv(1024)
          if res =~ /Tcp channel protocol violation: expecting preamble/
            return Exploit::CheckCode::Appears("Detected vulnerable version: #{version.join('.')}")
          end

          sock.close
        end
      else
        return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version.join('.')}")
      end
    end
    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end