deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Extract zip from Modbus communication
Type: auxiliary
Path: modules/auxiliary/analyze/modbus_zip.rb

Description:
This module is able to extract a zip file sent through Modbus from a pcap.
        Tested with Schneider TM221CE16R.
Metasploit Module: Telisca IPS Lock Cisco IP Phone Control
Type: auxiliary
Path: modules/auxiliary/voip/telisca_ips_lock_control.rb
Disclosure date: 2015-12-17
References: URL-https://github.com/rapid7/metasploit-framework/pull/6470

Description:
This module allows an unauthenticated attacker to exercise the
          "Lock" and "Unlock" functionality of Telisca IPS Lock for Cisco IP
          Phones. This module should be run in the VoIP VLAN, and requires
          knowledge of the target phone's name (for example, SEP002497AB1D4B).

          Set ACTION to either LOCK or UNLOCK. UNLOCK is the default.
Metasploit Module: Viproy CUCDM IP Phone XML Services - Speed Dial Attack Tool
Type: auxiliary
Path: modules/auxiliary/voip/cisco_cucdm_speed_dials.rb
Authors: fozavci
References: CVE-2014-3300, BID-68331

Description:
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
          (CDM), before version 10, doesn't implement access control properly, which allows remote
          attackers to modify user information. This module exploits the vulnerability to make
          unauthorized speed dial entity manipulations.
Metasploit Module: SIP Invite Spoof
Type: auxiliary
Path: modules/auxiliary/voip/sip_invite_spoof.rb

Description:
This module will create a fake SIP invite request making the targeted device ring
        and display fake caller id information.
Metasploit Module: SIP Deregister Extension
Type: auxiliary
Path: modules/auxiliary/voip/sip_deregister.rb

Description:
This module will attempt to deregister a SIP user from the provider. It
        has been tested successfully when the sip provider/server doesn't use REGISTER
        authentication.
Metasploit Module: Asterisk Manager Login Utility
Type: auxiliary
Path: modules/auxiliary/voip/asterisk_login.rb
References: URL-http://www.asterisk.org/astdocs/node201.html

Description:
This module attempts to authenticate to an Asterisk Manager service. Please note
          that by default, Asterisk Call Management (port 5038) only listens locally, but
          this can be manually configured in file /etc/asterisk/manager.conf by the admin
          on the victim machine.
Metasploit Module: Viproy CUCDM IP Phone XML Services - Call Forwarding Tool
Type: auxiliary
Path: modules/auxiliary/voip/cisco_cucdm_call_forward.rb
Authors: fozavci
References: CVE-2014-3300, BID-68331

Description:
The BVSMWeb portal in the web framework in Cisco Unified Communications Domain Manager
          (CDM) 10 does not properly implement access control, which allows remote attackers to
          modify user information. This module exploits the vulnerability to configure unauthorized
          call forwarding.
Metasploit Module: MS15-134 Microsoft Windows Media Center MCL Information Disclosure
Type: auxiliary
Path: modules/auxiliary/server/ms15_134_mcl_leak.rb
Disclosure date: 2015-12-08
References: CVE-2015-6127, MSB-MS15-134, URL-https://blog.coresecurity.com/2015/12/09/exploiting-windows-media-center/, URL-http://www.coresecurity.com/advisories/microsoft-windows-media-center-link-file-incorrectly-resolved-reference

Description:
This module exploits a vulnerability found in Windows Media Center. It allows an MCL
          file to render itself as an HTML document in the local machine zone by Internet Explorer,
          which can be used to leak files on the target machine.

          Please be aware that if this exploit is used against a patched Windows, it can cause the
          computer to be very slow or unresponsive (100% CPU). It seems to be related to how the
          exploit uses the URL attribute in order to render itself as an HTML file.
Metasploit Module: DHCP Client Bash Environment Variable Code Injection (Shellshock)
Type: auxiliary
Path: modules/auxiliary/server/dhclient_bash_env.rb
Disclosure date: Sep 24 2014
References: CVE-2014-6271, OSVDB-112004, EDB-34765, URL-https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/, URL-https://seclists.org/oss-sec/2014/q3/649, URL-https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
        handles external environment variables. This module targets dhclient by responding
        to DHCP requests with a malicious hostname, domainname, and URL which are then
        passed to the configuration scripts as environment variables, resulting in code
        execution.
Metasploit Module: NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)
Type: auxiliary
Path: modules/auxiliary/server/netbios_spoof_nat.rb
Disclosure date: Jun 14 2016
References: URL-http://xlab.tencent.com/en/2016/06/17/BadTunnel-A-New-Hope/, CVE-2016-3213, MSB-MS16-063, CVE-2016-3236, MSB-MS16-077

Description:
This module listens for a NetBIOS name request and then continuously spams
        NetBIOS responses to a target for given hostname, causing the target to cache
        a malicious address for this name. On high-speed networks, the PPSRATE value
        should be increased to speed up this attack. As an example, a value of around
        30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup.
        Distant targets may require more time and lower rates for a successful attack.

        This module works when the target is behind a NAT gateway, since the stream of
        NetBIOS responses will keep the NAT mapping alive after the initial setup. To
        trigger the initial NetBIOS request to the Metasploit system, force the target
        to access a UNC link pointing to the same address (HTML, Office attachment, etc).

        This NAT-piercing issue was named the 'BadTunnel' vulnerability by the discoverer,
        Yu Yang (@tombkeeper). The Microsoft patches (MS16-063/MS16-077) impact the way
        that the proxy host (WPAD) host is identified, but do change the predictability
        of NetBIOS requests.
Metasploit Module: OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
Type: auxiliary
Path: modules/auxiliary/server/openssl_heartbeat_client_memory.rb
Disclosure date: Apr 07 2014
References: CVE-2014-0160, US-CERT-VU-720951, URL-https://www.cisa.gov/uscert/ncas/alerts/TA14-098A, URL-http://heartbleed.com/

Description:
This module provides a fake SSL service that is intended to
        leak memory from client systems as they connect. This module is
        hardcoded for using the AES-128-CBC-SHA1 cipher.
Metasploit Module: SOCKS Proxy UNC Path Redirection
Type: auxiliary
Path: modules/auxiliary/server/socks_unc.rb
Authors: hdm

Description:
This module provides a Socks proxy service
      that redirects all HTTP requests to a web page that
      loads a UNC path.
Metasploit Module: Native LDAP Server (Example)
Type: auxiliary
Path: modules/auxiliary/server/ldap.rb

Description:
This module provides a Rex based LDAP service to expose the
          native Rex LDAP server functionality created during log4shell
          development.
Metasploit Module: Hardware Bridge Server
Type: auxiliary
Path: modules/auxiliary/server/local_hwbridge.rb

Description:
This module sets up a web server to bridge communications between
          Metasploit and physically attached hardware.
          Currently this module supports: automotive
Metasploit Module: Regsvr32.exe (.sct) Command Delivery Server
Type: auxiliary
Path: modules/auxiliary/server/regsvr32_command_delivery_server.rb
References: URL-http://web.archive.org/web/[PII_REDACTED]5048/http://subt0x10.blogspot.com:80/2016/04/bypass-application-whitelisting-script.html

Description:
This module uses the Regsvr32.exe Application Whitelisting Bypass technique as a way to run a command on
          a target system. The major advantage of this technique is that you can execute a static command on the target
          system and dynamically and remotely change the command that will actually run (by changing the value of CMD).
          This is useful when combined with persistence methods (e.g., a recurring scheduled task) or when flexibility
          is needed through the use of a single command (e.g., as Rubber Ducky payload).
Metasploit Module: HTTP Client Automatic Exploiter
Type: auxiliary
Path: modules/auxiliary/server/browser_autopwn.rb

Description:
This module has three actions.  The first (and the default)
          is 'WebServer' which uses a combination of client-side and
          server-side techniques to fingerprint HTTP clients and then
          automatically exploit them.  Next is 'DefangedDetection' which
          does only the fingerprinting part.  Lastly, 'list' simply
          prints the names of all exploit modules that would be used by
          the WebServer action given the current MATCH and EXCLUDE
          options.

          Also adds a 'list' command which is the same as running with
          ACTION=list.
Metasploit Module: SOCKS Proxy Server
Type: auxiliary
Path: modules/auxiliary/server/socks_proxy.rb

Description:
This module provides a SOCKS proxy server that uses the builtin Metasploit routing to relay connections.
Metasploit Module: TeamViewer Unquoted URI Handler SMB Redirect
Type: auxiliary
Path: modules/auxiliary/server/teamviewer_uri_smb_redirect.rb
References: URL-https://jeffs.sh/CVEs/CVE-2020-13699.txt, CVE-2020-13699, URL-https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448

Description:
This module exploits an unquoted parameter call within the Teamviewer
          URI handler to create an SMB connection to an attacker controlled IP.
          TeamViewer < 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870,
          12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3 are
          vulnerable.
          Only Firefox can be exploited by this vulnerability, as all other
          browsers encode the space after 'play' and before the SMB location,
          preventing successful exploitation.
          Teamviewer 15.4.4445, and 8.0.16642 were succssfully tested against.
Metasploit Module: Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/server/android_mercury_parseuri.rb
References: URL-http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/, URL-http://versprite.com/og/multiple-vulnerabilities-in-mercury-browser-for-android-version-3-0-0/

Description:
This module exploits an unsafe intent URI scheme and directory traversal found in
          Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a
          private wifi manager activity, which starts a web server for Mercury on port 8888.
          The webserver also suffers a directory traversal that allows remote access to
          sensitive files.

          By default, this module will go after webviewCookiesChromium.db, webviewCookiesChromiumPrivate.db,
          webview.db, and bookmarks.db. But if this isn't enough, you can also specify the
          ADDITIONAL_FILES datastore option to collect more files.
Metasploit Module: OpenSSL Alternative Chains Certificate Forgery MITM Proxy
Type: auxiliary
Path: modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb
Disclosure date: Jul 9 2015
References: CVE-2015-1793, URL-http://git.openssl.org/?p=openssl.git;a=commit;h=f404943bcab4898d18f3ac1b36479d1d7bbbb9e6

Description:
This module exploits a logic error in OpenSSL by impersonating the server
        and sending a specially-crafted chain of certificates, resulting in
        certain checks on untrusted certificates to be bypassed on the client,
        allowing it to use a valid leaf certificate as a CA certificate to sign a
        fake certificate. The SSL/TLS session is then proxied to the server
        allowing the session to continue normally and application data transmitted
        between the peers to be saved.

        The valid leaf certificate must not contain the keyUsage extension or it
        must have at least the keyCertSign bit set (see X509_check_issued function
        in crypto/x509v3/v3_purp.c); otherwise; X509_verify_cert fails with
        X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY. This module requires an
        active man-in-the-middle attack.
Metasploit Module: Fake DNS Service
Type: auxiliary
Path: modules/auxiliary/server/fakedns.rb
Authors: ddz

Description:
This module provides a DNS service that redirects
      all queries to a particular address.
Metasploit Module: GNU Wget FTP Symlink Arbitrary Filesystem Access
Type: auxiliary
Path: modules/auxiliary/server/wget_symlink_file_write.rb
Disclosure date: Oct 27 2014
Authors: hdm
References: CVE-2014-4877, URL-https://bugzilla.redhat.com/show_bug.cgi?id=1139181, URL-https://www.rapid7.com/blog/post/2014/10/28/r7-2014-15-gnu-wget-ftp-symlink-arbitrary-filesystem-access

Description:
This module exploits a vulnerability in Wget when used in
        recursive (-r) mode with a FTP server as a destination. A
        symlink is used to allow arbitrary writes to the target's
        filesystem. To specify content for the file, use the
        "file:/path" syntax for the TARGET_DATA option.

        Tested successfully with wget 1.14. Versions prior to 1.16
        are presumed vulnerable.
Metasploit Module: ICMP Exfiltration Service
Type: auxiliary
Path: modules/auxiliary/server/icmp_exfil.rb
Authors: Chris John Riley
References: URL-https://github.com/todb/packetfu, URL-https://nmap.org/book/nping-man.html, URL-https://blog.c22.cc/2012/02/17/quick-post-fun-with-python-ctypes-simpleicmp/

Description:
This module is designed to provide a server-side component to receive and store files
        exfiltrated over ICMP echo request packets.

        To use this module you will need to send an initial ICMP echo request containing the
        specific start trigger (defaults to '^BOF') this can be followed by the filename being sent (or
        a random filename can be assigned). All data received from this source will automatically
        be added to the receive buffer until an ICMP echo request containing a specific end trigger
        (defaults to '^EOL') is received.

        Suggested Client:
        Data can be sent from the client using a variety of tools. One such example is nping (included
        with the NMAP suite of tools) - usage: nping --icmp 10.0.0.1 --data-string "BOFtest.txt" -c1
Metasploit Module: WPAD.dat File Server
Type: auxiliary
Path: modules/auxiliary/server/wpad.rb

Description:
This module generates a valid wpad.dat file for WPAD mitm
          attacks. Usually this module is used in combination with DNS attacks
          or the 'NetBIOS Name Service Spoofer' module. Please remember as the
          server will be running by default on TCP port 80 you will need the
          required privileges to open that port.
Metasploit Module: HTTP Client MS Credential Relayer
Type: auxiliary
Path: modules/auxiliary/server/http_ntlmrelay.rb

Description:
This module relays negotiated NTLM Credentials from an HTTP server to multiple
          protocols. Currently, this module supports relaying to SMB and HTTP.

          Complicated custom attacks requiring multiple requests that depend on each
          other can be written using the SYNC* options. For example, a CSRF-style
          attack might first set an HTTP_GET request with a unique SNYNCID and set
          an HTTP_POST request with a SYNCFILE, which contains logic to look
          through the database and parse out important values, such as the CSRF token
          or authentication cookies, setting these as configuration options, and finally
          create a web page with iframe elements pointing at the HTTP_GET and HTTP_POSTs.
Metasploit Module: HTTP Client Automatic Exploiter 2 (Browser Autopwn)
Type: auxiliary
Path: modules/auxiliary/server/browser_autopwn2.rb
Disclosure date: 2015-07-05
References: URL-https://www.rapid7.com/blog/post/2015/07/16/the-new-metasploit-browser-autopwn-strikes-faster-and-smarter--part-2

Description:
This module will automatically serve browser exploits. Here are the options you can
          configure:

          The INCLUDE_PATTERN option allows you to specify the kind of exploits to be loaded. For example,
          if you wish to load just Adobe Flash exploits, then you can set Include to 'adobe_flash'.

          The EXCLUDE_PATTERN option will ignore exploits. For example, if you don't want any Adobe Flash
          exploits, you can set this. Also note that the Exclude option will always be evaluated
          after the Include option.

          The MaxExploitCount option specifies the max number of exploits to load by Browser Autopwn.
          By default, 20 will be loaded. But note that the client will probably not be vulnerable
          to all 20 of them, so only some will actually be served to the client.

          The HTMLContent option allows you to provide a basic webpage. This is what the user behind
          the vulnerable browser will see. You can simply set a string, or you can do the file://
          syntax to load an HTML file. Note this option might break exploits so try to keep it
          as simple as possible.

          The MaxSessionCount option is used to limit how many sessions Browser Autopwn is allowed to
          get. The default -1 means unlimited. Combining this with other options such as RealList
          and Custom404, you can get information about which visitors (IPs) clicked on your malicious
          link, what exploits they might be vulnerable to, redirect them to your own internal
          training website without actually attacking them.

          For more information about Browser Autopwn, please see the referenced blog post.
Metasploit Module: Android Meterpreter Browsable Launcher
Type: auxiliary
Path: modules/auxiliary/server/android_browsable_msf_launch.rb
References: URL-http://developer.android.com/reference/android/content/Intent.html#CATEGORY_BROWSABLE

Description:
This module allows you to open an android meterpreter via a browser. An Android
          meterpreter must be installed as an application beforehand on the target device
          in order to use this.

          For best results, you can consider using the auxiliary/client/sms/send_text to
          trick your target into opening the malicious link, and wake up Meterpreter.
Metasploit Module: Cross Platform Webkit File Dropper
Type: auxiliary
Path: modules/auxiliary/server/webkit_xslt_dropper.rb
References: CVE-2011-1774

Description:
This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8
          files to the target file-system.  By default, the file will be dropped in
          C:\Program Files\
Metasploit Module: Java Secure Socket Extension (JSSE) SKIP-TLS MITM Proxy
Type: auxiliary
Path: modules/auxiliary/server/jsse_skiptls_mitm_proxy.rb
Disclosure date: Jan 20 2015
References: CVE-2014-6593, URL-https://www.smacktls.com/#skip, URL-https://www.smacktls.com/smack.pdf, URL-http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html, URL-https://www-304.ibm.com/support/docview.wss?uid=swg21695474

Description:
This module exploits an incomplete internal state distinction in Java Secure
        Socket Extension (JSSE) by impersonating the server and finishing the
        handshake before the peers have authenticated themselves and instantiated
        negotiated security parameters, resulting in a plaintext SSL/TLS session
        with the client. This plaintext SSL/TLS session is then proxied to the
        server using a second SSL/TLS session from the proxy to the server (or an
        alternate fake server) allowing the session to continue normally and
        plaintext application data transmitted between the peers to be saved. This
        module requires an active man-in-the-middle attack.
Metasploit Module: PXE Boot Exploit Server
Type: auxiliary
Path: modules/auxiliary/server/pxeexploit.rb

Description:
This module provides a PXE server, running a DHCP and TFTP server.
        The default configuration loads a linux kernel and initrd into memory that
        reads the hard drive; placing a payload to install metsvc, disable the
        firewall, and add a new user metasploit on any Windows partition seen,
        and add a uid 0 user with username and password metasploit to any linux
        partition seen. The windows user will have the password p@SSw0rd!123456
        (in case of complexity requirements) and will be added to the administrators
        group.

        Note: the displayed IP address of a target is the address this DHCP server
        handed out, not the "normal" IP address the host uses.
Metasploit Module: Microsoft Windows HTTP to LDAP Relay
Type: auxiliary
Path: modules/auxiliary/server/relay/http_to_ldap.rb

Description:
This module supports running an HTTP server which validates credentials, and
          then attempts to execute a relay attack against an LDAP server on the
          configured RHOSTS hosts.

          It is not possible to relay NTLMv2 to LDAP due to the Message Integrity Check
          (MIC). As a result, this will only work with NTLMv1. The module takes care of
          removing the relevant flags to bypass signing.

          If the relay succeeds, an LDAP session to the target will be created. This can
          be used by any modules that support LDAP sessions, like `admin/ldap/rbcd` or
          `auxiliary/gather/ldap_query`.

          Supports LDAP and captures NTLMv1 as well as NTLMv2 hashes.
Metasploit Module: SMB to HTTP relay version of Get NAA Creds
Type: auxiliary
Path: modules/auxiliary/server/relay/relay_get_naa_credentials.rb
References: URL-https://blog.xpnsec.com/unobfuscating-network-access-accounts/, URL-https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-2/cred-2_description.md, URL-https://github.com/Mayyhem/SharpSCCM, URL-https://github.com/garrettfoster13/sccmhunter

Description:
This module creates an SMB server and then relays the credentials passed to it to SCCM's HTTP server
              (aka Management Point) to gain an authenticated connection. Once authenticated it then attempts to retrieve
              the Network Access Account(s), if configured, from the SCCM server. This requires a computer account,
              which can be added using the samr_account module.

              If you have domain credentials but are unsure of the either the MANAGEMENT_POINT or SITE_CODE for the
              SCCM server, the original (non-relay) version of this module has an auto discovery feature which will use
              domain credentials to run an LDAP query to find both the MANAGEMENT_POINT and the SITE_CODE.
Metasploit Module: ESC8 Relay: SMB to HTTP(S)
Type: auxiliary
Path: modules/auxiliary/server/relay/esc8.rb

Description:
This module creates an SMB server and then relays the credentials passed to it
        to an HTTP server to gain an authenticated connection.  Once that connection is
        established, the module makes an authenticated request for a certificate based
        on a given template.
Metasploit Module: Microsoft Windows SMB to MSSQL Relay
Type: auxiliary
Path: modules/auxiliary/server/relay/smb_to_mssql.rb

Description:
This module supports running an SMB server which validates credentials, and then attempts to execute a relay
          attack against an MSSQL server on the configured RHOSTS hosts.

          If the relay succeeds, an MSSQL session to the target will be created. This can be used by any modules that
          support MSSQL sessions, like `admin/mssql/mssql_enum`. The session can also be used to run arbitrary queries.

          Supports SMBv2, SMBv3, and captures NTLMv1 as well as NTLMv2 hashes.
          SMBv1 is not supported - please see https://github.com/rapid7/metasploit-framework/issues/16261