deardaniel/secdata-raw huggingface dataset:
Metasploit Module: IPFire proxy.cgi RCE
Type: exploit
Path: modules/exploits/linux/http/ipfire_proxy_exec.rb
Platform: unix
Disclosure date: 2016-05-04
References: CVE-2025-34116, EDB-39765, URL-https://www.ipfire.org/news/ipfire-2-19-core-update-101-released

Description:
IPFire, a free linux based open source firewall distribution,
          version < 2.19 Update Core 101 contains a remote command execution
          vulnerability in the proxy.cgi page.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => '/cgi-bin/pakfire.cgi',
        'method' => 'GET'
      )
      fail_with(Failure::UnexpectedReply, "#{peer} - Could not connect to web service - no response") if res.nil?
      fail_with(Failure::UnexpectedReply, "#{peer} - Invalid credentials (response code: #{res.code})") if res.code != 200
      /\<strong\>IPFire (?<version>[\d.]{4}) \([\w]+\) - Core Update (?<update>[\d]+)/ =~ res.body

      if version && update && version == "2.19" && update.to_i < 101
        Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
      else
        Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end
Metasploit Module: Nagios XI Chained Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_chained_rce.rb
Platform: unix
Disclosure date: 2016-03-06
References: CVE-2018-8733, CVE-2018-8734, CVE-2018-8735, CVE-2018-8736, EDB-39899

Description:
This module exploits an SQL injection, auth bypass, file upload,
          command injection, and privilege escalation in Nagios XI <= 5.2.7
          to pop a root shell.

Check method (fingerprinting):
res = send_request_cgi!(
      'method' => 'GET',
      'uri' => '/nagiosxi/'
    )

    return unless res && (html = res.get_html_document)

    if (version = html.at('//input[@name = "version"]/@value'))
      version = version.value
      vprint_status("Nagios XI version: #{version}")
      if Rex::Version.new(version) <= target[:version]
        return CheckCode::Appears("Version #{version} appears to be vulnerable")
      end
    end

    return CheckCode::Safe("Version #{version} is not vulnerable") if version

    CheckCode::Unknown('Could not determine Nagios XI version')
  end
Metasploit Module: PineApp Mail-SeCure test_li_connection.php Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/pineapp_test_li_conn_exec.rb
Platform: unix
Disclosure date: 2013-07-26
References: CVE-2013-6829, ZDI-13-188, OSVDB-95782

Description:
This module exploits a command injection vulnerability on PineApp Mail-SeCure
          3.70. The vulnerability exists on the test_li_connection.php component, due to the
          insecure usage of the system() php function. This module has been tested successfully
          on PineApp Mail-SeCure 3.70.

Check method (fingerprinting):
# Since atm of writing this exploit there isn't patch available,
    # checking for the vulnerable component should be a reliable test.
    cookies = get_cookies
    if cookies.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    return Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/terramaster_unauth_rce_cve_2020_35665.rb
Platform: php
Disclosure date: 2020-12-12
References: CVE-2020-35665, CVE-2020-28188, URL-https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/, URL-https://attackerkb.com/topics/lXY4yjOvwx/cve-2020-35665
Targets: PHP, Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated remote code-execution vulnerability in TerraMaster TOS 4.2.06
          and lower via shell metacharacters in the Event parameter at vulnerable endpoint `include/makecvs.php`
          during CSV creation.
          Any unauthenticated user can therefore execute commands on the system under the same privileges as the
          web application, which typically runs under root at the TerraMaster Operating System.

Check method (fingerprinting):
get_terramaster_info
    return CheckCode::Safe('The target is not vulnerable') if @terramaster.empty?

    if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.06')
      return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
    else
      return CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
    end
  end
Metasploit Module: Apache OFBiz XML-RPC Java Deserialization
Type: exploit
Path: modules/exploits/linux/http/apache_ofbiz_deserialization.rb
Platform: unix
Disclosure date: 2020-07-13
References: CVE-2020-9496, CVE-2023-49070, CVE-2023-51467, URL-https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz, URL-https://ofbiz.apache.org/release-notes-17.12.04.html, URL-https://issues.apache.org/jira/browse/OFBIZ-11716, URL-https://blog.sonicwall.com/en-us/2023/12/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz/
Targets: Unix Command, Linux Dropper

Description:
This module exploits a Java deserialization vulnerability in Apache
          OFBiz's unauthenticated XML-RPC endpoint /webtools/control/xmlrpc for
          versions prior to 17.12.01 using the ROME gadget chain.

          Versions up to 18.12.11 are exploitable utilizing an auth bypass CVE-2023-51467
          and use the CommonsBeanutils1 gadget chain.

          Verified working on 18.12.09, 17.12.01, and 15.12

Check method (fingerprinting):
# Send an empty serialized object
    res = send_request_xmlrpc('')

    return CheckCode::Unknown('Target did not respond to check.') unless res

    if res.body.include?('Failed to read result object: null')
      @version = 'pre-17'
      return CheckCode::Vulnerable('Target can deserialize arbitrary data.')
    end

    # newer @versions respond w/o a content length, so just validate the URL returns something that looks like OFBiz
    @version = version_from_login_page

    return CheckCode::Unknown('Target did not respond to check.') if @version.nil?
    return CheckCode::Unknown('Target version could not be determined') if @version == 'unknown'

    return CheckCode::Appears('Apache OFBiz pre version 17 detected') if @version == 'pre-17'
    return CheckCode::Appears("Apache OFBiz version #{@version} detected") if Rex::Version.new(@version) < Rex::Version.new('18.12.11')

    CheckCode::Safe("Apache OFBiz version #{@version} detected, and is unexploitable")
  end
Metasploit Module: Authenticated RCE in Splunk (splunk_archiver app)
Type: exploit
Path: modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb
Platform: unix
Disclosure date: 2024-07-01
References: CVE-2024-36985, URL-https://advisory.splunk.com/advisories/SVD-2024-0705, URL-https://web.archive.org/web/[PII_REDACTED]0921/https://psytester.github.io/CVE-2024-36985_SPLUNK_RCE_PoC/

Description:
This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise (splunk_archiver application).

          The flaw is rooted in the unsafe use of a Splunk lookup function, specifically | copybuckets, within the splunk_archiver application,
          which ultimately leads to the execution of the helper script sudobash with attacker-controlled arguments.

          The affected versions include any release prior to 9.0.10, as well as versions 9.1.2 through 9.1.5 and 9.2.0 through 9.2.2.

Check method (fingerprinting):
@cookie = splunk_login(datastore['USERNAME'], datastore['PASSWORD'])
    version = splunk_home_version(@cookie)
    if version <= Rex::Version.new('9.0.9') ||
       version.between?(Rex::Version.new('9.1.0'), Rex::Version.new('9.1.4')) ||
       version.between?(Rex::Version.new('9.2.0'), Rex::Version.new('9.2.1'))

      all_apps = get_apps(@cookie)
      return CheckCode::Detected("Exploitable version found: #{version}, but splunk_archiver app was not found") if !all_apps.key?('splunk_archiver')
      return CheckCode::Detected("Exploitable version found: #{version}, but splunk_archiver app is disabled") if all_apps['splunk_archiver'][:enabled] == false

      return CheckCode::Appears("Exploitable version found: #{version}, splunk_archiver app is enabled")
    end

    return CheckCode::Safe("Non-vulnerable version found: #{version}") if !version.nil?

    return CheckCode::Unknown('Target does not appear to be a Splunk instance')
  end

  # remove duplicate slashes
Metasploit Module: SonicWall SMA 100 Series Authenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/sonicwall_cve_2021_20039.rb
Platform: linux
Disclosure date: 2021-12-14
References: CVE-2021-20039, URL-https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026, URL-https://www.rapid7.com/blog/post/2022/01/11/cve-2021-20038-42-sonicwall-sma-100-multiple-vulnerabilities-fixed-2, URL-https://attackerkb.com/topics/9szJhq46lw/cve-2021-20039/rapid7-analysis
Targets: Linux Dropper

Description:
This module exploits an authenticated command injection vulnerability
          in the SonicWall SMA 100 series web interface. Exploitation results in
          command execution as root. The affected versions are:

          - 10.2.1.2-24sv and below
          - 10.2.0.8-37sv and below
          - 9.0.0.11-31sv and below

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, '/cgi-bin/welcome'),
      'agent' => 'SonicWALL Mobile Connect'
    })
    return CheckCode::Unknown('Failed to retrieve the version information') unless res&.code == 200

    version = res.body.match(/\.([0-9.\-a-z]+)\.js" type=/)
    return CheckCode::Unknown('Failed to retrieve the version information') unless version

    version = version[1]

    major, minor, revision, build = version.split('.', 4)
    build, point = build.split('-', 2)
    print_status("Version found: #{major}.#{minor}.#{revision}.#{build}-#{point}")
    point.delete_suffix('sv')

    case major
    when '9'
      return CheckCode::Safe("Version #{version} is not vulnerable") unless minor.to_i == 0 && revision.to_i == 0 && build.to_i <= 11 && point.to_i <= 31
    when '10'
      return CheckCode::Safe("Version #{version} is not vulnerable") unless minor.to_i == 2

      case revision
      when '0'
        return CheckCode::Safe("Version #{version} is not vulnerable") unless build.to_i <= 8 && point.to_i <= 37
      when '1'
        return CheckCode::Safe("Version #{version} is not vulnerable") unless build.to_i <= 2 && point.to_i <= 24
      else
        return CheckCode::Safe("Version #{version} is not vulnerable")
      end
    else
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end
    CheckCode::Appears('Based on the discovered version.')
  end
Metasploit Module: Hadoop YARN ResourceManager Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/linux/http/hadoop_unauth_exec.rb
Platform: linux
Disclosure date: 2016-10-19
References: URL-http://archive.hack.lu/2016/Wavestone%20-%20Hack.lu%202016%20-%20Hadoop%20safari%20-%20Hunting%20for%20vulnerabilities%20-%20v1.0.pdf, URL-https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn, URL-https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-common/SecureMode.html

Description:
This module uses Hadoop's standard ResourceManager REST API to execute arbitrary commands on an unsecured Hadoop server.
          Hadoop administrators should enable Kerberos authentication for these endpoints by changing the 'hadoop.security.authentication' setting in 'core-site.xml' from 'simple' (the default) to 'kerberos' before exposing the node to the network.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, '/ws/v1/cluster/apps/new-application'),
        'method' => 'POST'
      )
    rescue Rex::ConnectionError
      vprint_error("#{peer} - Connection failed")
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res && res.code == 200 && res.body.include?('application-id')
      return CheckCode::Appears('The target appears to be vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Cisco Firepower Management Console 6.0 Post Authentication UserAdd Vulnerability
Type: exploit
Path: modules/exploits/linux/http/cisco_firepower_useradd.rb
Platform: linux
Disclosure date: 2016-10-10
References: CVE-2016-6433, URL-https://blog.korelogic.com/blog/2016/10/10/virtual_appliance_spelunking

Description:
This module exploits a vulnerability found in Cisco Firepower Management Console.
          The management system contains a configuration flaw that allows the www user to
          execute the useradd binary, which can be abused to create backdoor accounts.
          Authentication is required to exploit this vulnerability.

Check method (fingerprinting):
# For this exploit to work, we need to check two services:
    # * HTTP - To create the backdoor account for SSH
    # * SSH  - To execute our payload

    vprint_status('Checking Cisco Firepower Management console...')
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/img/favicon.png?v=6.0.1-1213')
    })

    if res && res.code == 200
      vprint_status("Console is found.")
      vprint_status("Checking SSH service.")
      begin
        opts = ssh_client_defaults.merge({
          port: datastore['SSHPORT'],
          password: Rex::Text.rand_text_alpha(5),
          auth_methods: ['password']
        })
        ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
          Net::SSH.start(rhost, 'admin', opts)
        end
      rescue Timeout::Error
        vprint_error('The SSH connection timed out.')
        return Exploit::CheckCode::Unknown('Could not determine the target status')
      rescue Net::SSH::AuthenticationFailed
        # Hey, it talked. So that means SSH is running.
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      rescue Net::SSH::Exception => e
        vprint_error(e.message)
      end
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Seagate Business NAS Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/seagate_nas_php_exec_noauth.rb
Platform: php
Disclosure date: 2015-03-01
References: CVE-2014-8684, CVE-2014-8686, CVE-2014-8687, EDB-36202, URL-http://www.seagate.com/au/en/support/external-hard-drives/network-storage/business-storage-2-bay-nas/, URL-http://web.archive.org/web/[PII_REDACTED]4553/https://beyondbinary.io/advisory/seagate-nas-rce/

Description:
Some Seagate Business NAS devices are vulnerable to command execution via a local
          file include vulnerability hidden in the language parameter of the CodeIgniter
          session cookie. The vulnerability manifests in the way the language files are
          included in the code on the login page, and hence is open to attack from users
          without the need for authentication. The cookie can be easily decrypted using a
          known static encryption key and re-encrypted once the PHP object string has been
          modified.

          This module has been tested on the STBN300 device.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri),
        'method' => 'GET',
        'headers' => {
          'Accept' => 'text/html'
        }
      )

      if res && res.code == 200
        headers = res.to_s

        # validate headers
        if headers.include?('X-Powered-By: PHP/5.2.13') && headers.include?('Server: lighttpd/1.4.28')
          # and make sure that the body contains the title we'd expect
          if res.body.include?('Login to BlackArmor')
            return Exploit::CheckCode::Appears('The target appears to be vulnerable')
          end
        end
      end
    rescue Rex::ConnectionRefused, Rex::ConnectionTimeout, Rex::HostUnreachable
      # something went wrong, assume safe.
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  #
  # Executez ze sploitz!
  #
Metasploit Module: CWP login.php Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/control_web_panel_login_cmd_exec.rb
Platform: unix
Disclosure date: 2023-01-05
References: CVE-2022-44877, URL-https://github.com/numanturle/CVE-2022-44877, URL-https://control-webpanel.com/changelog#[PII_REDACTED]45-84af1b53-c121
Targets: Unix Command, Linux Dropper

Description:
Control Web Panel versions < 0.9.8.1147 are vulnerable to
          unauthenticated OS command injection. Successful exploitation results
          in code execution as the root user. The results of the command are not
          contained within the HTTP response and the request will block while
          the command is running.

Check method (fingerprinting):
sleep_time = rand(5..10)

    _, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end

    vprint_status("Elapsed time: #{elapsed_time} seconds")

    unless elapsed_time > sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Appears('Successfully tested command injection.')
  rescue Msf::Exploit::Failed
    return CheckCode::Safe('Failed to test command injection.')
  end
Metasploit Module: Moodle Remote Code Execution (CVE-2024-43425)
Type: exploit
Path: modules/exploits/linux/http/moodle_rce.rb
Disclosure date: 2024-08-27
References: URL-https://blog.redteam-pentesting.de/2024/moodle-rce/, URL-https://www.redteam-pentesting.de/en/advisories/rt-sa-2024-009/, URL-https://moodle.org/mod/forum/discuss.php?d=461193, CVE-2024-43425
Targets: Linux Command

Description:
This module exploits a command injection vulnerability in Moodle (CVE-2024-43425) to obtain remote code execution.
          Affected versions include 4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11, and earlier unsupported versions.
Metasploit Module: Apache Spark Unauthenticated Command Injection RCE
Type: exploit
Path: modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb
Platform: unix
Disclosure date: 2022-07-18
References: URL-https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc, URL-https://attackerkb.com/topics/5FyKBES4BL/cve-2022-33891, CVE-2022-33891
Targets: Unix (In-Memory), Linux Dropper

Description:
This module exploits an unauthenticated command injection vulnerability in Apache Spark.
          Successful exploitation results in remote code execution under the context of the Spark application user.

          The command injection occurs because Spark checks the group membership of the user passed
          in the ?doAs parameter by using a raw Linux command.

          It is triggered by a non-default setting called spark.acls.enable.
          This configuration setting spark.acls.enable should be set true in the Spark configuration to make the application vulnerable for this attack.

          Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1 are affected by this vulnerability.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited!")

    res = execute_command("echo #{Rex::Text.rand_text_alpha_lower(8..12)}")

    return CheckCode::Unknown('Did not receive a response from target.') unless res

    if res.code != 403
      return CheckCode::Safe('Target did not respond with a 403 response.')
    end

    sleep_time = rand(5..10)
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")

    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end

    print_status("Elapsed time: #{elapsed_time} seconds.")

    unless res && elapsed_time >= sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/sophos_wpa_iface_exec.rb
Platform: unix
Disclosure date: 2014-04-08
References: CVE-2014-2849, CVE-2014-2850, URL-http://www.zerodayinitiative.com/advisories/ZDI-14-069/

Description:
This module takes advantage of two vulnerabilities in order to gain remote code execution as root
          as an otherwise non-privileged authorized user. By taking advantage of a mass assignment
          vulnerability that allows an unprivileged authenticated user to change the administrator's
          password hash, the module updates the password to login as the admin to reach the second vulnerability.
          No server-side sanitization is done on values passed when configuring a static network interface.
          This allows an administrator user to run arbitrary commands in the context of the web application,
          which is root when configuring the network interface. This module will inadvertently delete
          any other users that may have been present as a side effect of changing the admin's password.
Metasploit Module: Eramba (up to 3.19.1) Authenticated Remote Code Execution Module
Type: exploit
Path: modules/exploits/linux/http/eramba_rce.rb
Platform: unix
Disclosure date: 2023-08-01
References: CVE-2023-36255, URL-https://trovent.github.io/security-advisories/TRSA-2303-01/TRSA-2303-01.txt
Targets: Command

Description:
This module exploits a remote code execution vulnerability in Eramba.
          An authenticated user can execute arbitrary commands on the server by
          exploiting the path parameter in the download-test-pdf endpoint.
          Eramba debug mode has to be enabled.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('/login')
    })

    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    html_body = res.get_html_document
    version_html = html_body.at('//p[contains(text(), "App version")]/strong')&.text
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless version_html

    return Exploit::CheckCode::Safe('Debug mode not enabled.') unless html_body.at('input[@name="_Token[debug]"]')

    version = Rex::Version.new(version_html)

    return Exploit::CheckCode::Appears("Eramba Version #{version} is affected.") if version <= Rex::Version.new('3.19.1')

    return Exploit::CheckCode::Safe("Eramba Version #{version} is not affected.")
  end
Metasploit Module: Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb
Platform: unix
Disclosure date: 2016-09-01
References: CVE-2019-10655, URL-https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920, URL-https://github.com/dirtyfilthy/gxv3175-remote-code-exec/blob/master/modules/exploits/linux/http/grandstream_gxv3175_cmd_exec.rb
Targets: Linux (cmd), Linux (ARMLE)

Description:
This module exploits a command injection vulnerability in Grandstream GXV31XX
          IP multimedia phones. The 'settimezone' action does not validate input in the
          'timezone' parameter allowing injection of arbitrary commands.

          A buffer overflow in the 'phonecookie' cookie parsing allows authentication
          to be bypassed by providing an alphanumeric cookie 93 characters in length.

          This module was tested successfully on Grandstream models:
          GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and
          GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.

Check method (fingerprinting):
res = send_manager_request(
      'action' => 'settimezone',
      'timezone' => ''
    )

    if res && res.code == 200 && res.body.to_s.include?('Response=Success')
      return CheckCode::Detected('phonecookie authentication bypassed successfully.')
    end

    CheckCode::Safe('The target is not vulnerable')
  end