deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Service System V Persistence
Type: exploit
Path: modules/exploits/linux/persistence/init_sysvinit.rb
Platform: unix
Disclosure date: 1983-01-01
References: URL-https://www.digitalocean.com/community/tutorials/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples

Description:
This module will create a service via System V on the box, and mark it for auto-restart.
          We need enough access to write service files and potentially restart services.

          Some systems include backwards compatibility, such as Ubuntu up to about 16.04.

          Targets:
          CentOS <= 5
          Debian <= 6
          Kali 2.0
          Ubuntu <= 6.06
          Note: System V won't restart the service if it dies, only an init change (reboot etc) will restart it.

          Verified on Kali 2.0, Ubuntu 10.04

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe('/etc/init.d/ isnt writable') unless writable?('/etc/init.d/')

    has_updatercd = command_exists?('update-rc.d')
    if has_updatercd || command_exists?('chkconfig') # centos 5
      return CheckCode::Appears("#{writable_dir} is writable and system is System V based")
    end

    CheckCode::Safe('Likely not a System V based system')
  end
Metasploit Module: Bash Profile Persistence
Type: exploit
Path: modules/exploits/linux/persistence/bash_profile.rb
Platform: unix
Disclosure date: 1989-06-08

Description:
This module writes an execution trigger to the target's Bash profile.
          The execution trigger executes a call back payload whenever the target
          user opens a Bash terminal.
          Verified on Ubuntu 22.04 and 18.04 desktop with Gnome

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    ppath = profile_path

    # check that target Bash profile file exists
    return CheckCode::Safe("Bash profile does not exist: #{ppath}") unless exist?(ppath)

    vprint_good("Bash profile exists: #{ppath}")

    # check that target Bash profile file is writable
    return CheckCode::Safe("Bash profile is not writable: #{ppath}") unless writable?(ppath)

    vprint_good("Bash profile is writable: #{ppath}")

    CheckCode::Detected("Bash profile exists and is writable: #{ppath}")
  end
Metasploit Module: Linux WSL via Startup Folder Persistence
Type: exploit
Path: modules/exploits/linux/persistence/wsl/startup_folder.rb
Disclosure date: 2016-08-02

Description:
This module establishes persistence by creating a payload in the windows startup folder from within
          the Windows Subsystem for Linux (WSL) environment. This allows for code execution on Windows user login.

          Verified on Windows 10 with Ubuntu 24.04 WSL distribution.

Check method (fingerprinting):
return CheckCode::Safe('Target is not WSL') unless wsl?

    vprint_good('Inside WSL environment')

    return CheckCode::Safe('No writable startup folders found') if exploitable_folders.empty?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: MySQL yaSSL CertDecoder::GetName Buffer Overflow
Type: exploit
Path: modules/exploits/linux/mysql/mysql_yassl_getname.rb
Platform: linux
Disclosure date: 2010-01-25
References: CVE-2009-4484, BID-37640, BID-37943, BID-37974, OSVDB-61956, URL-http://web.archive.org/web/[PII_REDACTED]1727/http://secunia.com:80/advisories/38344/

Description:
This module exploits a stack buffer overflow in the yaSSL (1.9.8 and earlier)
          implementation bundled with MySQL. By sending a specially crafted
          client certificate, an attacker can execute arbitrary code.

          This vulnerability is present within the CertDecoder::GetName function inside
          "taocrypt/src/asn.cpp". However, the stack buffer that is written to exists
          within a parent function's stack frame.

          NOTE: This vulnerability requires a non-default configuration. First, the attacker
          must be able to pass the host-based authentication. Next, the server must be
          configured to listen on an accessible network interface.  Lastly, the server
          must have been manually configured to use SSL.

          The binary from version 5.5.0-m2 was built with /GS and /SafeSEH. During testing
          on Windows XP SP3, these protections successfully prevented exploitation.

          Testing was also done with mysql on Ubuntu 9.04. Although the vulnerable code is
          present, both version 5.5.0-m2 built from source and version 5.0.75 from a binary
          package were not exploitable due to the use of the compiler's FORTIFY feature.

          Although suse11 was mentioned in the original blog post, the binary package they
          provide does not contain yaSSL or support SSL.
Metasploit Module: MySQL yaSSL SSL Hello Message Buffer Overflow
Type: exploit
Path: modules/exploits/linux/mysql/mysql_yassl_hello.rb
Platform: linux
Disclosure date: 2008-01-04
References: CVE-2008-0226, OSVDB-41195, BID-27140

Description:
This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
          implementation bundled with MySQL <= 6.0. By sending a specially crafted
          Hello packet, an attacker may be able to execute arbitrary code.
Metasploit Module: Squid NTLM Authenticate Overflow
Type: exploit
Path: modules/exploits/linux/proxy/squid_ntlm_authenticate.rb
Platform: linux
Disclosure date: 2004-06-08
Authors: skape
References: CVE-2004-0541, OSVDB-6791, URL-http://www.idefense.com/application/poi/display?id=107, BID-10500

Description:
This is an exploit for Squid\'s NTLM authenticate overflow
          (libntlmssp.c). Due to improper bounds checking in
          ntlm_check_auth, it is possible to overflow the 'pass'
          variable on the stack with user controlled data of a user
          defined length.  Props to iDEFENSE for the advisory.
Metasploit Module: Redis Lua Sandbox Escape
Type: exploit
Path: modules/exploits/linux/redis/redis_debian_sandbox_escape.rb
Platform: unix
Disclosure date: 2022-02-18
References: CVE-2022-0543, URL-https://www.lua.org/pil/8.2.html, URL-https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce, URL-https://www.debian.org/security/2022/dsa-5081, URL-http://web.archive.org/web/[PII_REDACTED]2732/https://ubuntu.com/security/CVE-2022-0543
Targets: Unix Command, Linux Dropper

Description:
This module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The
          vulnerability was introduced by Debian and Ubuntu Redis packages that
          insufficiently sanitized the Lua environment. The maintainers failed to
          disable the package interface, allowing attackers to load arbitrary libraries.

          On a typical `redis` deployment (not docker), this module achieves execution
          as the `redis` user. Debian/Ubuntu packages run Redis using systemd with the
          "MemoryDenyWriteExecute" permission, which limits some of what an attacker can
          do. For example, staged meterpreter will fail when attempting to use mprotect.
          As such, stageless meterpreter is the preferred payload.

          Redis can be configured with authentication or not. This module will work with
          either configuration (provided you provide the correct authentication details).
          This vulnerability could theoretically be exploited across a few architectures:
          i386, arm, ppc, etc. However, the module only supports x86_64, which is likely
          to be the most popular version.

Check method (fingerprinting):
connect

    # Before we get crazy sending exploits over the wire, let's just check if this could
    # plausiably be a vulnerable version. Using INFO we can check for:
    #
    # 1. 4 < Version < 6.1
    # 2. OS contains Linux
    # 3. redis_git_sha1:00000000
    #
    # We could probably fingerprint the build_id as well, but I'm worried I'll overlook at
    # package somewhere and it's nice to get final verification via exploitation anyway.
    info_output = redis_command('INFO')
    return CheckCode::Unknown('Failed authentication.') if info_output.nil?
    return CheckCode::Safe('Unaffected operating system') unless info_output.include? 'os:Linux'
    return CheckCode::Safe('Invalid git sha1') unless info_output.include? 'redis_git_sha1:00000000'

    redis_version = info_output[/redis_version:(?<redis_version>\S+)/, :redis_version]
    return CheckCode::Safe('Could not extract a version number') if redis_version.nil?
    return CheckCode::Safe("The reported version is unaffected: #{redis_version}") if Rex::Version.new(redis_version) < Rex::Version.new('5.0.0')
    return CheckCode::Safe("The reported version is unaffected: #{redis_version}") if Rex::Version.new(redis_version) >= Rex::Version.new('6.1.0')
    return CheckCode::Unknown('Unsupported architecture') unless info_output.include? 'x86_64'

    # okay, looks like a worthy candidate. Attempt exploitation.
    result = do_popen('id')
    return CheckCode::Vulnerable("Successfully executed the 'id' command.") unles
Metasploit Module: Redis Replication Code Execution
Type: exploit
Path: modules/exploits/linux/redis/redis_replication_cmd_exec.rb
Platform: linux
Disclosure date: 2018-11-13
References: CVE-2018-11218, URL-https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf, URL-https://github.com/RedisLabs/RedisModulesSDK

Description:
This module can be used to leverage the extension functionality added since Redis 4.0.0
          to execute arbitrary code. To transmit the given extension it makes use of the feature of Redis
          which called replication between master and slave.

Check method (fingerprinting):
connect
    # they are only vulnerable if we can run the CONFIG command, so try that
    return CheckCode::Safe unless (config_data = redis_command('CONFIG', 'GET', '*')) && config_data =~ /dbfilename/

    if (info_data = redis_command('INFO')) && /redis_version:(?<redis_version>\S+)/ =~ info_data
      report_redis(redis_version)
    end

    unless redis_version
      return CheckCode::Unknown('Cannot retrieve redis version, please check it manually')
    end

    # Only vulnerable to version 4.x or 5.x
    version = Rex::Version.new(redis_version)
    if version >= Rex::Version.new('4.0.0')
      return CheckCode::Vulnerable("Redis version is #{redis_version}")
    end

    CheckCode::Safe
  ensure
    disconnect
  end
Metasploit Module: Exim GHOST (glibc gethostbyname) Buffer Overflow
Type: exploit
Path: modules/exploits/linux/smtp/exim_gethostbyname_bof.rb
Platform: unix
Disclosure date: 2015-01-27
References: CVE-2015-0235, US-CERT-VU-967332, OSVDB-117579, BID-72325, URL-https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt, URL-https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability, URL-http://r-7.co/1CAnMc0

Description:
This module remotely exploits CVE-2015-0235, aka GHOST, a heap-based
          buffer overflow in the GNU C Library's gethostbyname functions on x86
          and x86_64 GNU/Linux systems that run the Exim mail server.

Check method (fingerprinting):
# for now, no information about the vulnerable state of the target
    check_code = Exploit::CheckCode::Unknown

    begin
      # not exploiting, just checking
      smtp_connect(false)

      # malloc()ate gethostbyname's buffer, and
      # make sure its next_chunk isn't the top chunk

      9.times do
        smtp_send("HELO ", "", "0", "", "", 1024 + 16 - 1 + 0)
        smtp_recv(HELO_CODES)
      end

      # overflow (4 bytes) gethostbyname's buffer, and
      # overwrite its next_chunk's size field with 0x00303030

      smtp_send("HELO ", "", "0", "", "", 1024 + 16 - 1 + 4)
      # from now on, an exception means vulnerable
      check_code = Exploit::CheckCode::Vulnerable
      # raise an exception if no valid SMTP reply
      reply = smtp_recv(ANY_CODE)
      # can't determine vulnerable state if smtp_verify_helo() isn't called
      return Exploit::CheckCode::Unknown if reply[:code] !~ /#{HELO_CODES}/

      # realloc()ate gethostbyname's buffer, and
      # crash (old glibc) or abort (new glibc)
      # on the overwritten size field

      smtp_send("HELO ", "", "0", "", "", 2048 - 16 - 1 + 4)
      # raise an exception if no valid SMTP reply
      reply = smtp_recv(ANY_CODE)
      # can't determine vulnerable state if smtp_verify_helo() isn't called
      return Exploit::CheckCode::Unknown if reply[:code] !~ /#{HELO_CODES}/

      # a vulnerable target should've crashed by now
      check_code = Exploit::CheckCode::Safe
    rescue
      peer = "#{rhost}:#{rport}
Metasploit Module: Exim and Dovecot Insecure Configuration Command Injection
Type: exploit
Path: modules/exploits/linux/smtp/exim4_dovecot_exec.rb
Platform: linux
Disclosure date: 2013-05-03
References: OSVDB-93004, EDB-25297, URL-https://www.redteam-pentesting.de/advisories/rt-sa-2013-001

Description:
This module exploits a command injection vulnerability against Dovecot with
          Exim using the "use_shell" option. It uses the sender's address to inject arbitrary
          commands, since this is one of the user-controlled variables. It has been
          successfully tested on Debian Squeeze using the default Exim4 with the dovecot-common
          packages.
Metasploit Module: Barracuda ESG TAR Filename Command Injection
Type: exploit
Path: modules/exploits/linux/smtp/barracuda_esg_tarfile_rce.rb
Platform: unix
Disclosure date: 2023-05-23
References: CVE-2023-2868, URL-https://www.barracuda.com/company/legal/esg-vulnerability, URL-https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally, URL-https://attackerkb.com/topics/NCRbE1IDJP/cve-2023-2868

Description:
This module exploits CVE-2023-2868, a command injection vulnerability in
          Barracuda Email Security Gateway (ESG) appliances. The vulnerability exists
          in how the ESG processes TAR file attachments - filenames containing shell
          metacharacters (backticks) are passed directly to shell commands during
          extraction, allowing remote command execution.

          The exploit sends an email with a specially crafted TAR attachment where
          the filename contains a backtick-wrapped command. When the ESG processes
          this attachment, the command is executed as the mail processing user.

          Note: Payload execution may take 30-90 seconds after email delivery.
          Amavisd queues and processes attachments asynchronously.

          Affected versions: Barracuda ESG firmware prior to May 2023 patch.

          Payloads containing single quotes or backticks are incompatible with
          the injection mechanism. Use cmd/unix/generic with a custom CMD for
          specialized payload requirements.

Check method (fingerprinting):
connect
    banner_str = banner.to_s
    if banner_str =~ /barracuda/i
      return CheckCode::Detected('Barracuda ESG detected in SMTP banner')
    end

    if banner_str =~ /ESMTP/i
      return CheckCode::Unknown('SMTP server detected, but cannot confirm Barracuda ESG')
    end

    CheckCode::Safe('No SMTP banner detected')
  rescue Rex::ConnectionError => e
    CheckCode::Unknown("Connection failed: #{e.message}")
  ensure
    disconnect
  end
Metasploit Module: Apache James Server 2.3.2 Insecure User Creation Arbitrary File Write
Type: exploit
Path: modules/exploits/linux/smtp/apache_james_exec.rb
Platform: linux
Disclosure date: 2015-10-01
References: CVE-2015-7611, EDB-35513, URL-https://www.exploit-db.com/docs/english/40123-exploiting-apache-james-server-2.3.2.pdf

Description:
This module exploits a vulnerability that exists due to a lack of input
          validation when creating a user. Messages for a given user are stored
          in a directory partially defined by the username. By creating a user
          with a directory traversal payload as the username, commands can be
          written to a given directory. To use this module with the cron
          exploitation method, run the exploit using the given payload, host, and
          port. After running the exploit, the payload will be executed within 60
          seconds. Due to differences in how cron may run in certain Linux
          operating systems such as Ubuntu, it may be preferable to set the
          target to Bash Completion as the cron method may not work. If the target
          is set to Bash completion, start a listener using the given payload,
          host, and port before running the exploit. After running the exploit,
          the payload will be executed when a user logs into the system. For this
          exploitation method, bash completion must be enabled to gain code
          execution. This exploitation method will leave an Apache James mail
          object artifact in the /etc/bash_completion.d directory and the
          malicious user account.

Check method (fingerprinting):
# SMTP service check
    connect
    smtp_banner = sock.get_once
    disconnect
    unless smtp_banner.to_s.include? "JAMES SMTP Server"
      return CheckCode::Safe("Target port #{rport} is not a JAMES SMTP server")
    end

    # James Remote Administration Tool service check
    connect(true, { 'RHOST' => datastore['RHOST'], 'RPORT' => datastore['ADMINPORT'] })
    admin_banner = sock.get_once
    disconnect
    unless admin_banner.to_s.include? "JAMES Remote Administration Tool"
      return CheckCode::Safe("Target is not JAMES Remote Administration Tool")
    end

    # Get version number
    version = admin_banner.scan(/JAMES Remote Administration Tool ([\d\.]+)/).flatten.first
    # Null check
    unless version
      return CheckCode::Detected("Could not determine JAMES Remote Administration Tool version")
    end

    # Create version objects
    target_version = Rex::Version.new(version)
    vulnerable_version = Rex::Version.new("2.3.2")

    # Check version number
    if target_version > vulnerable_version
      return CheckCode::Safe
    elsif target_version == vulnerable_version
      return CheckCode::Appears
    elsif target_version < vulnerable_version
      return CheckCode::Detected("Version #{version} of JAMES Remote Administration Tool may be vulnerable")
    end
  end
Metasploit Module: Samba SetInformationPolicy AuditEventsInfo Heap Overflow
Type: exploit
Path: modules/exploits/linux/samba/setinfopolicy_heap.rb
Platform: %w[linux unix
Disclosure date: 2012-04-10
References: CVE-2012-1182, OSVDB-81303, BID-52973, ZDI-12-069
Targets: 2:3.5.11~dfsg-1ubuntu2 on Ubuntu Server 11.10, 2:3.5.8~dfsg-1ubuntu2 on Ubuntu Server 11.10, 2:3.5.8~dfsg-1ubuntu2 on Ubuntu Server 11.04, 2:3.5.4~dfsg-1ubuntu8 on Ubuntu Server 10.10, 2:3.5.6~dfsg-3squeeze6 on Debian Squeeze, 3.5.10-0.107.el5 on CentOS 5

Description:
This module triggers a vulnerability in the LSA RPC service of the Samba daemon
          because of an error on the PIDL auto-generated code. Making a specially crafted
          call to SetInformationPolicy to set a PolicyAuditEventsInformation allows to
          trigger a heap overflow and finally execute arbitrary code with root privileges.

          The module uses brute force to guess the stackpivot/rop chain or the system()
          address and redirect flow there in order to bypass NX. The start and stop addresses
          for brute forcing have been calculated empirically. On the other hand the module
          provides the StartBrute and StopBrute which allow the user to configure his own
          addresses.

Check method (fingerprinting):
vprint_status('Connect with SMB1 for the check method, since it needs native_lm info')
    connect(versions: [1])
    smb_login
    disconnect

    version = smb_peer_lm.scan(/Samba (\d\.\d.\d*)/).flatten[0]
    minor = version.scan(/\.(\d*)$/).flatten[0].to_i
    vprint_status("Version found: #{version}")

    return CheckCode::Appears if version =~ (/^3\.4/) && (minor < 16)
    return CheckCode::Appears if version =~ (/^3\.5/) && (minor < 14)
    return CheckCode::Appears if version =~ (/^3\.6/) && (minor < 4)

    return CheckCode::Safe
  rescue StandardError
    return CheckCode::Unknown
  end

  # Perform a DCE/RPC Function Call
Metasploit Module: Samba trans2open Overflow (Linux x86)
Type: exploit
Path: modules/exploits/linux/samba/trans2open.rb
Platform: linux
Disclosure date: 2003-04-07
References: CVE-2003-0201, OSVDB-4469, BID-7294, URL-https://seclists.org/bugtraq/2003/Apr/103

Description:
This exploits the buffer overflow found in Samba versions
          2.2.0 to 2.2.8. This particular module is capable of
          exploiting the flaw on x86 Linux systems that do not
          have the noexec stack option set.

          NOTE: Some older versions of RedHat do not seem to be vulnerable
          since they apparently do not allow anonymous access to IPC.
Metasploit Module: Samba is_known_pipename() Arbitrary Module Load
Type: exploit
Path: modules/exploits/linux/samba/is_known_pipename.rb
Platform: linux
Disclosure date: 2017-03-24
References: CVE-2017-7494, URL-https://www.samba.org/samba/security/CVE-2017-7494.html
Targets: Automatic (Interact), Automatic (Command), Linux x86, Linux x86_64, Linux ARM (LE), Linux ARM64, Linux MIPS, Linux MIPSLE, Linux MIPS64, Linux MIPS64LE

Description:
This module triggers an arbitrary shared library load vulnerability
          in Samba versions 3.5.0 to 4.4.14, 4.5.10, and 4.6.4. This module
          requires valid credentials, a writeable folder in an accessible share,
          and knowledge of the server-side path of the writeable folder. In
          some cases, anonymous access combined with common filesystem locations
          can be used to automatically exploit this vulnerability.

Check method (fingerprinting):
res = smb_fingerprint

    unless res['native_lm'] =~ /Samba ([\d.]+)/
      print_error("does not appear to be Samba: #{res['os']} / #{res['native_lm']}")
      return CheckCode::Safe
    end

    samba_version = Rex::Version.new(::Regexp.last_match(1).gsub(/\.$/, ''))

    vprint_status("Samba version identified as #{samba_version}")

    if samba_version < Rex::Version.new('3.5.0')
      return CheckCode::Safe
    end

    # Patched in 4.4.14
    if samba_version < Rex::Version.new('4.5.0') &&
       samba_version >= Rex::Version.new('4.4.14')
      return CheckCode::Safe
    end

    # Patched in 4.5.10
    if samba_version > Rex::Version.new('4.5.0') &&
       samba_version < Rex::Version.new('4.6.0') &&
       samba_version >= Rex::Version.new('4.5.10')
      return CheckCode::Safe
    end

    # Patched in 4.6.4
    if samba_version >= Rex::Version.new('4.6.4')
      return CheckCode::Safe
    end

    smb_connect
    find_writeable_share_path
    disconnect

    if @share.to_s.empty?
      return CheckCode::Detected("Samba version #{samba_version} found, but no writeable share has been identified")
    end

    return CheckCode::Appears("Samba version #{samba_version} found with writeable share '#{@share}'")
  end