deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution
Type: exploit
Path: modules/exploits/windows/iis/msadc.rb
Platform: win
Disclosure date: Jul 17 1998
Authors: aushack
References: OSVDB-272, BID-529, CVE-1999-1011, MSB-MS98-004, MSB-MS99-025

Description:
This module can be used to execute arbitrary commands on IIS servers
          that expose the /msadc/msadcs.dll Microsoft Data Access Components
          (MDAC) Remote Data Service (RDS) DataFactory service using VbBusObj
          or AdvancedDataFactory to inject shell commands into Microsoft Access
          databases (MDBs), MSSQL databases and ODBC/JET Data Source Name (DSN).
          Based on the msadcs.pl v2 exploit by Rain.Forest.Puppy, which was actively
          used in the wild in the late Ninties. MDAC versions affected include MDAC
          1.5, 2.0, 2.0 SDK, 2.1 and systems with the MDAC Sample Pages for RDS
          installed, and NT4 Servers with the NT Option Pack installed or upgraded
          2000 systems often running IIS3/4/5 however some vulnerable installations
          can still be found on newer Windows operating systems. Note that newer
          releases of msadcs.dll can still be abused however by default remote
          connections to the RDS is denied. Consider using VERBOSE if you're unable
          to successfully execute a command, as the error messages are detailed
          and useful for debugging. Also set NAME to obtain the remote hostname,
          and METHOD to use the alternative VbBusObj technique.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => normalize_uri(datastore['PATH']),
      'method' => 'GET',
    })
    if (res.code == 200)
      print_status("Server responded with HTTP #{res.code} OK")
      if (res.body =~ /Content-Type: application\/x-varg/)
        print_good("#{datastore['PATH']} matches fingerprint application\/x-varg")
        Exploit::CheckCode::Detected('MSADC RDS DataFactory interface detected')
      end
    else
      Exploit::CheckCode::Safe('MSADC RDS DataFactory interface not detected')
    end
  end
Metasploit Module: MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow
Type: exploit
Path: modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb
Platform: win
Disclosure date: 2003-05-30
References: CVE-2003-0109, OSVDB-4467, BID-7116, MSB-MS03-007

Description:
This exploits a buffer overflow in NTDLL.dll on Windows 2000
          through the SEARCH WebDAV method in IIS. This particular
          module only works against Windows 2000. It should have a
          reasonable chance of success against SP0 to SP3.

Check method (fingerprinting):
# Verify the service is running first
    res = send_request_raw({ 'uri' => '/' }, 5)
    return CheckCode::Safe('Connection failed') unless res

    xml = "<?xml version=\"1.0\"?>\r\n"
    xml << "<g:searchrequest xmlns:g=\"DAV:\">\r\n"
    xml << "<g:sql>\r\n"
    xml << "Select \"DAV:displayname\" from scope()\r\n"
    xml << "</g:sql>\r\n"
    xml << "</g:searchrequest>\r\n"

    response = send_request_cgi({
      'uri' => "/#{'x' * 65535}",
      'ctype' => 'text/xml',
      'method' => 'SEARCH',
      'data' => xml
    }, 5)

    if response && response.body.to_s.include?('Server Error(exception')
      return CheckCode::Vulnerable("We've hit a server error (exception)")
    end

    # Request-URI Too Long
    if response && response.code == 414
      return CheckCode::Safe("The server returned #{response.code} (#{response.message})")
    end

    # Did the server stop accepting requests?
    begin
      send_request_raw({ 'uri' => '/' }, 5)
    rescue StandardError
      return CheckCode::Appears('The server stopped accepting requests') unless res
    end

    CheckCode::Safe('Target does not appear to be vulnerable to WebDAV NTDLL overflow')
  end
Metasploit Module: Microsoft IIS WebDAV Write Access Code Execution
Type: exploit
Path: modules/exploits/windows/iis/iis_webdav_upload_asp.rb
Platform: win
Disclosure date: Dec 31 2004
Authors: hdm
References: OSVDB-397, BID-12141

Description:
This module can be used to execute a payload on IIS servers that
        have world-writeable directories. The payload is uploaded as an ASP
        script via a WebDAV PUT request.

          The target IIS machine must meet these conditions to be considered
        as exploitable: It allows 'Script resource access', Read and Write
        permission, and supports ASP.
Metasploit Module: MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution
Type: exploit
Path: modules/exploits/windows/iis/ms01_026_dbldecode.rb
Platform: win
Disclosure date: 2001-05-15
References: CVE-2001-0333, OSVDB-556, BID-2708, MSB-MS01-026, URL-http://marc.info/?l=bugtraq&m=[PII_REDACTED]1300&w=2
Targets: Windows (Dropper), Windows (Command)

Description:
This module will execute an arbitrary payload on a Microsoft IIS installation
          that is vulnerable to the CGI double-decode vulnerability of 2001.

          This module has been tested successfully on:

          Windows 2000 Professional (SP0) (EN);
          Windows 2000 Professional (SP1) (AR);
          Windows 2000 Professional (SP1) (CZ);
          Windows 2000 Server (SP0) (FR);
          Windows 2000 Server (SP1) (EN); and
          Windows 2000 Server (SP1) (SE).

          Note: This module will leave a Metasploit payload exe in the IIS scripts directory.

Check method (fingerprinting):
win_dir = detect_windows_directory
    win_dir ? CheckCode::Vulnerable("Found Windows directory name: #{win_dir}") : CheckCode::Safe('Could not detect Windows directory via double decode')
  end
Metasploit Module: MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow
Type: exploit
Path: modules/exploits/windows/iis/ms01_023_printer.rb
Platform: win
Disclosure date: 2001-05-01
References: CVE-2001-0241, OSVDB-3323, BID-2674, MSB-MS01-023, URL-https://seclists.org/lists/bugtraq/2001/May/0005.html

Description:
This exploits a buffer overflow in the request processor of the
          Internet Printing Protocol ISAPI module in IIS. This module
          works against Windows 2000 Server and Professional SP0-SP1.

          If the service stops responding after a successful compromise,
          run the exploit a couple more times to completely kill the
          hung process.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/NULL.printer',
      'version' => '1.0'
    })

    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Safe('Server did not return expected error code') unless res.code == 500
    # Error response is language dependent: "<b>Error in web printer install.</b>"
    return CheckCode::Safe('Server response does not match expected format') unless res.body.to_s.starts_with?('<b>') && res.body.to_s.ends_with?('</b>')

    res = send_request_cgi({
      'uri' => '/NULL.printer',
      'vhost' => rand_text_alpha(257),
      'version' => '1.0'
    })

    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Detected("The IUSER account is locked out, we can't check") if res.body.to_s.include?('locked out')
    return CheckCode::Safe('Server did not return expected error code for overflow test') unless res.code == 500
    return CheckCode::Safe('Server response does not match expected format for overflow test') unless res.body.to_s.starts_with?('<b>') && res.body.to_s.ends_with?('</b>')

    CheckCode::Appears('IIS .printer ISAPI extension appears vulnerable')
  end
Metasploit Module: MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow
Type: exploit
Path: modules/exploits/windows/iis/ms02_065_msadc.rb
Platform: win
Disclosure date: 2002-11-02
Authors: aushack
References: OSVDB-14502, BID-6214, CVE-2002-1142, MSB-MS02-065, URL-http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0082.html

Description:
This module can be used to execute arbitrary code on IIS servers
          that expose the /msadc/msadcs.dll Microsoft Data Access Components
          (MDAC) Remote Data Service (RDS) DataFactory service. The service is
          exploitable even when RDS is configured to deny remote connections
          (handsafe.reg). The service is vulnerable to a heap overflow where
          the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
          Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path))

    return CheckCode::Unknown('Connection failed') unless res
    return CheckCode::Unknown('HTTP server error') if res.code == 500
    return CheckCode::Safe('Access Forbidden') if res.code == 403

    if res.code == 200 && res.body.to_s.include?('Content-Type: application/x-varg')
      return CheckCode::Detected("#{target_uri.path} content type matches fingerprint application/x-varg")
    end

    CheckCode::Safe('MSADC interface not detected')
  end
Metasploit Module: MS02-018 Microsoft IIS 4.0 .HTR Path Overflow
Type: exploit
Path: modules/exploits/windows/iis/ms02_018_htr.rb
Platform: win
Disclosure date: 2002-04-10
References: CVE-1999-0874, OSVDB-3325, BID-307, URL-http://www.eeye.com/html/research/advisories/AD19990608.html, MSB-MS02-018

Description:
This exploits a buffer overflow in the ISAPI ISM.DLL used to
          process HTR scripting in IIS 4.0. This module works against
          Windows NT 4 Service Packs 3, 4, and 5. The server will
          continue to process requests until the payload being
          executed has exited. If you've set EXITFUNC to 'seh', the
          server will continue processing requests, but you will have
          trouble terminating a bind shell. If you set EXITFUNC to
          thread, the server will crash upon exit of the bind shell.
          The payload is alpha-numerically encoded without a NOP sled
          because otherwise the data gets mangled by the filters.
Metasploit Module: Microsoft IIS WebDav ScStoragePathFromUrl Overflow
Type: exploit
Path: modules/exploits/windows/iis/iis_webdav_scstoragepathfromurl.rb
Platform: win
Disclosure date: 2017-03-26
References: CVE-2017-7269, BID-97127, URL-https://github.com/edwardz246003/IIS_exploit, URL-https://0patch.blogspot.com/2017/03/0patching-immortal-cve-2017-7269.html
Targets: Microsoft Windows Server 2003 R2 SP2 x86

Description:
Buffer overflow in the ScStoragePathFromUrl function
          in the WebDAV service in Internet Information Services (IIS) 6.0
          in Microsoft Windows Server 2003 R2 allows remote attackers to
          execute arbitrary code via a long header beginning with
          "If: <http://" in a PROPFIND request, as exploited in the
          wild in July or August 2016.

          Original exploit by Zhiniang Peng and Chen Wu.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => target_uri.path,
      'method' => 'OPTIONS'
    })

    unless res
      vprint_error 'Connection failed'
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    unless supports_webdav? res.headers
      vprint_status 'Server does not support WebDAV'
      return CheckCode::Safe('Server does not support WebDAV')
    end

    if res.headers['Server'].to_s.include? 'IIS/6.0'
      return CheckCode::Vulnerable('IIS/6.0 with WebDAV enabled detected')
    end

    CheckCode::Detected('WebDAV enabled but IIS version is not 6.0')
  end

  # corelan.be
  # rop chain generated with mona.py
Metasploit Module: MS01-033 Microsoft IIS 5.0 IDQ Path Overflow
Type: exploit
Path: modules/exploits/windows/iis/ms01_033_idq.rb
Platform: win
Disclosure date: 2001-06-18
References: CVE-2001-0500, OSVDB-568, MSB-MS01-033, BID-2880

Description:
This module exploits a stack buffer overflow in the IDQ ISAPI handler for
          Microsoft Index Server.
Metasploit Module: Audiotran 1.4.1 (PLS File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/audiotran_pls.rb
Platform: win
Disclosure date: 2010-01-09
References: CVE-2009-0476, OSVDB-55424, EDB-11079

Description:
This module exploits a stack-based buffer overflow in Audiotran 1.4.1.
          An attacker must send the file to victim and the victim must open the file.
          Alternatively it may be possible to execute code remotely via an embedded
          PLS file within a browser, when the PLS extension is registered to Audiotran.
          This functionality has not been tested in this module.
Metasploit Module: DjVu DjVu_ActiveX_MSOffice.dll ActiveX ComponentBuffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/djvu_imageurl.rb
Platform: win
Disclosure date: 2008-10-30
References: CVE-2008-4922, OSVDB-49592, BID-31987

Description:
This module exploits a stack buffer overflow in DjVu ActiveX Component. When sending an
          overly long string to the ImageURL() property of DjVu_ActiveX_MSOffice.dll (3.0)
          an attacker may be able to execute arbitrary code. This control is not marked safe
          for scripting, so choose your attack vector accordingly.
Metasploit Module: SafeNet SoftRemote GROUPNAME Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/safenet_softremote_groupname.rb
Platform: win
Disclosure date: 2009-10-30
References: CVE-2009-3861, OSVDB-59660, URL-http://www.senseofsecurity.com.au/advisories/SOS-09-008

Description:
This module exploits a stack buffer overflow in SafeNet SoftRemote
          Security Policy Editor <= 10.8.5. When an attacker
          creates a specially formatted security policy with an
          overly long GROUPNAME argument, it is possible to execute
          arbitrary code.
Metasploit Module: Office OLE Multiple DLL Side Loading Vulnerabilities
Type: exploit
Path: modules/exploits/windows/fileformat/office_ole_multiple_dll_hijack.rb
Platform: win
Disclosure date: 2015-12-08
Authors: Yorick Koster
References: CVE-2015-6132, CVE-2015-6128, CVE-2015-6133, CVE-2016-0041, CVE-2016-0100, CVE-2016-3235, MSB-MS15-132, MSB-MS16-014, MSB-MS16-025, MSB-MS16-041

Description:
Multiple DLL side loading vulnerabilities were found in various COM components.
          These issues can be exploited by loading various these components as an embedded
          OLE object. When instantiating a vulnerable object Windows will try to load one
          or more DLLs from the current working directory. If an attacker convinces the
          victim to open a specially crafted (Office) document from a directory also
          containing the attacker's DLL file, it is possible to execute arbitrary code with
          the privileges of the target user. This can potentially result in the attacker
          taking complete control of the affected system.
Metasploit Module: UltraISO CUE File Parsing Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ultraiso_cue.rb
Platform: win
Disclosure date: 2007-05-24
References: CVE-2007-2888, OSVDB-36570, BID-24140, EDB-3978

Description:
This module exploits a stack-based buffer overflow in EZB Systems, Inc's
          UltraISO. When processing .CUE files, data is read from file into a
          fixed-size stack buffer. Since no bounds checking is done, a buffer overflow
          can occur. Attackers can execute arbitrary code by convincing their victim
          to open an CUE file.

          NOTE: A file with the same base name, but the extension of "bin" must also
          exist. Opening either file will trigger the vulnerability, but the files must
          both exist.
Metasploit Module: McAfee Remediation Client ActiveX Control Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mcafee_hercules_deletesnapshot.rb
Platform: win
Disclosure date: 2008-08-04
References: OSVDB-94540, EDB-16639

Description:
This module exploits a stack buffer overflow in McAfee Remediation Agent 4.5.0.41. When
          sending an overly long string to the DeleteSnapshot() method
          of enginecom.dll (3.7.0.9) an attacker may be able to execute arbitrary code.
          This control is not marked safe for scripting, so choose your attack vector accordingly.
Metasploit Module: ACDSee XPM File Section Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/acdsee_xpm.rb
Platform: win
Disclosure date: 2007-11-23
Authors: MC
References: CVE-2007-2193, OSVDB-35236, BID-23620

Description:
This module exploits a buffer overflow in ACDSee 9.0.
          When viewing a malicious XPM file with the ACDSee product,
          a remote attacker could overflow a buffer and execute
          arbitrary code.
Metasploit Module: URSoft W32Dasm Disassembler Function Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ursoft_w32dasm.rb
Platform: win
Disclosure date: 2005-01-24
References: CVE-2005-0308, OSVDB-13169, BID-12352, URL-http://aluigi.altervista.org/adv/w32dasmbof-adv.txt

Description:
This module exploits a buffer overflow in W32Dasm <= v8.93.
          By creating a malicious file and convincing a user to disassemble
          the file with a vulnerable version of W32Dasm, the Imports/Exports
          function is copied to the stack and arbitrary code may be executed
          locally as the user.
Metasploit Module: Microsoft Visual Basic VBP Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/ms_visual_basic_vbp.rb
Platform: win
Disclosure date: 2007-09-04
References: CVE-2007-4776, EDB-4361, OSVDB-36936, BID-25629

Description:
This module exploits a stack buffer overflow in Microsoft Visual Basic
          6.0. A specially crafted Visual Basic Project (VBP) file containing
          a long reference line can be used to execute arbitrary code.
Metasploit Module: Adobe Reader U3D Memory Corruption Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_reader_u3d.rb
Platform: win
Disclosure date: 2011-12-06
References: CVE-2011-2462, OSVDB-77529, BID-50922, URL-http://www.adobe.com/support/security/advisories/apsa11-04.html, URL-http://web.archive.org/web/[PII_REDACTED]5907/http://blog.9bplus.com/analyzing-cve-2011-2462/, URL-https://sites.google.com/site/felipeandresmanzano/PDFU3DExploitJS_CVE_2009_2990.py?attredirects=0, URL-http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html

Description:
This module exploits a vulnerability in the U3D handling within
          versions 9.x through 9.4.6 and 10 through to 10.1.1 of Adobe Reader.
          The vulnerability is due to the use of uninitialized memory.

          Arbitrary code execution is achieved by embedding specially crafted U3D
          data into a PDF document. A heap spray via JavaScript is used in order to
          ensure that the memory used by the invalid pointer issue is controlled.
Metasploit Module: VisiWave VWR File Parsing Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/visiwave_vwr_type.rb
Platform: win
Disclosure date: 2011-05-20
References: CVE-2011-2386, OSVDB-72464, URL-http://www.visiwave.com/blog/index.php?/archives/4-Version-2.1.9-Released.html, URL-http://www.stratsec.net/Research/Advisories/VisiWave-Site-Survey-Report-Trusted-Pointer-%28SS-20

Description:
This module exploits a vulnerability found in VisiWave's Site Survey Report application.
          When processing .VWR files, VisiWaveReport.exe attempts to match a valid pointer based on the 'Type'
          property (valid ones include 'Properties', 'TitlePage', 'Details', 'Graph', 'Table', 'Text',
          'Image'), but if a match isn't found, the function that's supposed to handle this routine
          ends up returning the input as a pointer, and later used in a CALL DWORD PTR [EDX+10]
          instruction.  This allows attackers to overwrite it with any arbitrary value, and results code
          execution.  A patch is available at visiwave.com; the fix is done by XORing the return value as
          null if no match is found, and then it is validated before use.

          NOTE: During installation, the application will register two file handles, VWS and VWR, which allows a
          victim user to 'double click' the malicious VWR file and execute code.  This module was also built
          to bypass ASLR and DEP.
Metasploit Module: A-PDF WAV to MP3 v1.0.0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/a_pdf_wav_to_mp3.rb
Platform: win
Disclosure date: 2010-08-17
References: CVE-2019-5618, OSVDB-67241, EDB-14676, EDB-14681

Description:
This module exploits a buffer overflow in A-PDF WAV to MP3 v1.0.0. When
          the application is used to import a specially crafted m3u file, a buffer overflow occurs
          allowing arbitrary code execution.
Metasploit Module: Steinberg MyMP3Player 3.0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/mymp3player_m3u.rb
Platform: win
Disclosure date: 2010-03-18
References: CVE-2010-20123, OSVDB-64580, EDB-11791

Description:
This module exploits a stack buffer overflow in Steinberg MyMP3Player == 3.0. When
          the application is used to open a specially crafted m3u file, a buffer overflow occurs
          allowing arbitrary code execution.
Metasploit Module: Altap Salamander 2.5 PE Viewer Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/altap_salamander_pdb.rb
Platform: win
Disclosure date: 2007-06-19
References: CVE-2007-3314, BID-24557, OSVDB-37579, URL-http://vuln.sg/salamander25-en.html

Description:
This module exploits a buffer overflow in Altap Salamander <= v2.5.
          By creating a malicious file and convincing a user to view the file with
          the Portable Executable Viewer plugin within a vulnerable version of
          Salamander, the PDB file string is copied onto the stack and the
          SEH can be overwritten.
Metasploit Module: ProShow Gold v4.0.2549 (PSH File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/proshow_cellimage_bof.rb
Platform: win
Disclosure date: 2009-08-20
References: CVE-2009-3214, OSVDB-57226, EDB-9483, EDB-9519

Description:
This module exploits a stack-based buffer overflow in ProShow Gold v4.0.2549.
          An attacker must send the file to victim and the victim must open the file.
Metasploit Module: xRadio 0.95b Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/xradio_xrl_sehbof.rb
Platform: win
Disclosure date: 2011-02-08
References: CVE-2008-2789, BID-46290, EDB-16141

Description:
This module exploits a buffer overflow in xRadio 0.95b.
          Using the application to import a specially crafted xrl file,
          a buffer overflow occurs allowing arbitrary code execution.
Metasploit Module: Orbit Downloader URL Unicode Conversion Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/orbit_download_failed_bof.rb
Platform: win
Disclosure date: 2008-04-03
References: BID-28541, OSVDB-44036, CVE-2008-1602, URL-http://www.coresecurity.com/content/orbit-downloader

Description:
This module exploits a stack-based buffer overflow in Orbit Downloader.
          The vulnerability is due to Orbit converting a URL ascii string to unicode
          in an insecure way with MultiByteToWideChar.
          The vulnerability is exploited with a specially crafted metalink file that
          should be opened with Orbit through the "File->Add Metalink..." option.
Metasploit Module: CVE-2025-33053 Exploit via Malicious .URL File and WebDAV
Type: exploit
Path: modules/exploits/windows/fileformat/unc_url_cve_2025_33053.rb
Platform: win
Disclosure date: 2025-06-11
References: CVE-2025-33053, URL-https://github.com/DevBuiHieu/CVE-2025-33053-Proof-Of-Concept

Description:
This module exploits CVE-2025-33053 by generating a malicious .URL file pointing
          to a trusted LOLBAS binary with parameters designed to trigger unintended behavior.
          Optionally, a payload is generated and hosted on a specified WebDAV directory.
          When the victim opens the shortcut, it will attempt to access the WebDAV path,
          potentially resulting in remote code execution via a trusted binary.