deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HP Data Protector Create New Folder Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_new_folder.rb
Platform: win
Disclosure date: 2012-03-12
References: CVE-2012-0124, OSVDB-80105, BID-52431, URL-https://www.rapid7.com/blog/post/2012/07/06/an-example-of-egghunting-to-exploit-cve-2012-0124

Description:
This module exploits a stack buffer overflow in HP Data Protector 5. The overflow
          occurs in the creation of new folders, where the name of the folder is handled in a
          insecure way by the dpwindtb.dll component. While the overflow occurs in the stack, the
          folder name is split in fragments in this insecure copy. Because of this, this module
          uses egg hunting to search a non corrupted copy of the payload in the heap. On the other
          hand the overflowed buffer is stored in a frame protected by stack cookies, because of
          this SEH handler overwrite is used.

          Any user of HP Data Protector Express is able to create new folders and trigger the
          vulnerability. Moreover, in the default installation the 'Admin' user has an empty
          password. Successful exploitation will lead to code execution with the privileges of
          the "dpwinsdr.exe" (HP Data Protector Express Domain Server Service) process, which
          runs as SYSTEM by default.
Metasploit Module: Wireshark console.lua Pre-Loading Script Execution
Type: exploit
Path: modules/exploits/windows/misc/wireshark_lua.rb
Platform: win
Disclosure date: 2011-07-18
References: CVE-2011-3360, OSVDB-75347, URL-https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6136, URL-http://technet.microsoft.com/en-us/security/msvr/msvr11-014

Description:
This module exploits a vulnerability in Wireshark 1.6 or less. When opening a
          pcap file, Wireshark will actually check if there's a 'console.lua' file in the same
          directory, and then parse/execute the script if found.  Versions affected by this
          vulnerability: 1.6.0 to 1.6.1, 1.4.0 to 1.4.8
Metasploit Module: Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/lianja_db_net.rb
Platform: win
Disclosure date: 2013-05-22
Authors: Spencer McIntyre
References: CVE-2013-3563, OSVDB-93759

Description:
This module exploits a stack buffer overflow in the db_netserver process, which
          is spawned by the Lianja SQL server.  The issue is fixed in Lianja SQL 1.0.0RC5.2.

Check method (fingerprinting):
begin
      connect
    rescue
      vprint_error("Unable to connect")
      return Exploit::CheckCode::Unknown('Unable to connect to target')
    end
    sock.put("db_net")
    if sock.recv(4) =~ /\d{1,5}/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: BigAnt Server 2.52 USV Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bigant_server_usv.rb
Platform: win
Disclosure date: 2009-12-29
References: CVE-2009-4660, OSVDB-61386, EDB-10765, EDB-10973

Description:
This exploits a stack buffer overflow in the BigAnt Messaging Service,
          part of the BigAnt Server product suite. This module was tested
          successfully against version 2.52.

          NOTE: The AntServer service does not restart, you only get one shot.
Metasploit Module: ActFax 5.01 RAW Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/actfax_raw_server_bof.rb
Platform: win
Disclosure date: 2013-02-05
References: CVE-2013-10064, OSVDB-89944, BID-57789, EDB-24467, URL-http://www.pwnag3.com/2013/02/actfax-raw-server-exploit.html

Description:
This module exploits a vulnerability in ActFax Server 5.01 RAW server. The RAW
          Server can be used to transfer fax messages without any underlying protocols. To
          note significant fields in the fax being transferred, like the fax number or the
          recipient, ActFax data fields can be used. This module exploits a buffer overflow
          in the handling of the @F506 fields due to the insecure usage of strcpy. This
          module has been tested successfully on ActFax 5.01 over Windows XP SP3 (English).
Metasploit Module: Poison Ivy Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/poisonivy_bof.rb
Platform: win
Disclosure date: 2012-06-24
References: OSVDB-83774, EDB-19613, URL-http://www.signal11.eu/en/research/articles/targeted_2010.pdf, URL-http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/

Description:
This module exploits a stack buffer overflow in the Poison Ivy 2.2.0 to 2.3.2 C&C server.
          The exploit does not need to know the password chosen for the bot/server communication.

Check method (fingerprinting):
# camellia block size
    block_size = 16
    # number of blocks in challenge
    block_count = 16
    challenge = ("\x00" * block_size * block_count)

    indicator = {}
    # 0x0000113e as first 4 bytes on PI 2.1.0
    indicator[[0x0000113e].pack('V')] = '2.1.0'
    # 0x00001212 as first 4 bytes on PI 2.1.1
    indicator[[0x00001212].pack('V')] = '2.1.1'
    # 0x000013f6 as first 4 bytes on PI 2.1.2
    indicator[[0x000013f6].pack('V')] = '2.1.2'

    # 0x000013e0 as 4 bytes after challenge on PI 2.2.0
    indicator[[0x000013e0].pack('V')] = '2.2.0'
    # 0x00001470 as 4 bytes after challenge on PI 2.3.0
    indicator[[0x00001470].pack('V')] = '2.3.0'
    # 0x000015D0 as 4 bytes after challenge on PI 2.3.1/2.3.2
    indicator[[0x000015D0].pack('V')] = '2.3.1/2.3.2'

    connect
    sock.put(challenge)
    response = sock.get_once(256)

    if response && response.length == 256
      # Poison Ivy >= 2.2.0 Challenge Response uses Camellia in ECB mode which means identical plaintext blocks
      # map to identical ciphertext blocks. A challenge composed of identical blocks will thus result in a response of identical blocks.
      first_block = response[0, 16]
      (1..15).each do |index|
        unless response[index * 16, 16] == first_block
          vprint_status("Response doesn't match Poison Ivy Challenge-Response format.")
          return Exploit::CheckCode::Safe('Response does not match Poison Ivy challenge-response format')
        end
      end

      response = sock
Metasploit Module: Talkative IRC v0.4.4.16 Response Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/talkative_response.rb
Platform: win
Disclosure date: 2009-03-17
References: CVE-2009-20007, OSVDB-64582, BID-34141, EDB-8227

Description:
This module exploits a stack buffer overflow in Talkative IRC v0.4.4.16.
          When a specially crafted response string is sent to a client,
          an attacker may be able to execute arbitrary code.
Metasploit Module: HP OpenView Operations OVTrace Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_ovtrace.rb
Platform: win
Disclosure date: 2007-08-09
Authors: MC
References: CVE-2007-3872, OSVDB-39527, BID-25255

Description:
This module exploits a stack buffer overflow in HP OpenView Operations version A.07.50.
          By sending a specially crafted packet, a remote attacker may be able to execute arbitrary code.
Metasploit Module: POP Peeper v3.4 DATE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/poppeeper_date.rb
Platform: win
Disclosure date: 2009-02-27
References: CVE-2009-1029, OSVDB-53560, BID-34093

Description:
This module exploits a stack buffer overflow in POP Peeper v3.4.
          When a specially crafted DATE string is sent to a client,
          an attacker may be able to execute arbitrary code. This
          module is based off of krakowlabs code.
Metasploit Module: Avaya WinPMD UniteHostRouter Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/avaya_winpmd_unihostrouter.rb
Platform: win
Disclosure date: 2011-05-23
References: OSVDB-82764, OSVDB-73269, BID-47947, EDB-18397, URL-https://downloads.avaya.com/css/P8/documents/100140122, URL-http://web.archive.org/web/[PII_REDACTED]5515/http://secunia.com:80/advisories/44062

Description:
This module exploits a stack buffer overflow in Avaya WinPMD. The vulnerability
          exists in the UniteHostRouter service, due to the insecure usage of memcpy when
          parsing specially crafted "To:" headers. The module has been tested successfully on
          Avaya WinPMD 3.8.2 over Windows XP SP3 and Windows 2003 SP2.
Metasploit Module: Serve DLL via webdav server
Type: exploit
Path: modules/exploits/windows/misc/webdav_delivery.rb
Platform: %w[win
Disclosure date: 1999-01-01

Description:
This module simplifies the rundll32.exe Application Whitelisting Bypass technique.
          The module creates a webdav server that hosts a dll file. When the user types the provided rundll32
          command on a system, rundll32 will load the dll remotly and execute the provided export function.
          The export function needs to be valid, but the default meterpreter function can be anything.
          The process does write the dll to C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore\Tfs_DAV
          but does not load the dll from that location. This file should be removed after execution.
          The extension can be anything you'd like, but you don't have to use one. Two files will be
          written to disk. One named the requested name and one with a dll extension attached.
Metasploit Module: HPE iMC dbman RestartDB Unauthenticated RCE
Type: exploit
Path: modules/exploits/windows/misc/hp_imc_dbman_restartdb_unauth_rce.rb
Platform: win
Disclosure date: 2017-05-15
References: CVE-2017-5816, EDB-43198, ZDI-17-340, BID-98469, URL-https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03745en_us

Description:
This module exploits a remote command execution vulnerablity in
          Hewlett Packard Enterprise Intelligent Management Center before
          version 7.3 E0504P04.

          The dbman service allows unauthenticated remote users to restart
          a user-specified database instance (OpCode 10008), however the
          instance ID is not sanitized, allowing execution of arbitrary
          operating system commands as SYSTEM. This service listens on
          TCP port 2810 by default.

          This module has been tested successfully on iMC PLAT v7.2 (E0403)
          on Windows 7 SP1 (EN).

Check method (fingerprinting):
# empty RestartDB packet
    pkt = [10008].pack('N')

    connect
    sock.put pkt
    res = sock.get_once
    disconnect

    # Expected reply:
    # "\x00\x00\x00\x01\x00\x00\x00:08\x02\x01\xFF\x043Dbman deal msg error, please to see dbman_debug.log"
    return CheckCode::Detected('HP IMC dbman service detected') if res =~ /dbman/i

    CheckCode::Safe('HP IMC dbman service not detected')
  end
Metasploit Module: HP Data Protector Cell Request Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_crs.rb
Platform: win
Disclosure date: 2013-06-03
References: CVE-2013-2333, OSVDB-93867, BID-60309, ZDI-13-130

Description:
This module exploits a stack-based buffer overflow in the Hewlett-Packard Data Protector
          product. The vulnerability, due to the insecure usage of _swprintf, exists at the Cell
          Request Service (crs.exe) when parsing packets with opcode 211. This module has been tested
          successfully on HP Data Protector 6.20 and 7.00 on Windows XP SP3.

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      vprint_error("Unable to fingerprint")
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    port = get_crs_port

    if port.nil?
      vprint_status("HP Data Protector version #{fingerprint}")
      vprint_error("But CRS port not found")
    else
      vprint_status("CRS running on port #{port}/TCP, HP Data Protector version #{fingerprint}")
    end

    if fingerprint =~ /HP Data Protector A\.06\.20: INET, internal build 370/
      # More likely to be exploitable
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    elsif fingerprint =~ /HP Data Protector A\.07\.00: INET, internal build 72/
      # More likely to be exploitable
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    elsif fingerprint =~ /HP Data Protector A\.07\.00/
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    elsif fingerprint =~ /HP Data Protector A\.07\.01/
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    elsif fingerprint =~ /HP Data Protector A\.06\.20/
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    elsif fingerprint =~ /HP Data Protector A\.06\.21/
      return Exploit::CheckCode::Appears("#{fingerprint} appears vulnerable")
    end

    return Exploit::CheckCode::Safe("#{fingerprint} is not vulnerable")
  end
Metasploit Module: HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_omniinet_2.rb
Platform: win
Disclosure date: 2009-12-17
References: CVE-2009-3844, BID-37250, OSVDB-60852, ZDI-09-091

Description:
This module exploits a stack-based buffer overflow in the Hewlett-Packard
          OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b)
          packet, a remote attacker may be able to execute arbitrary code with elevated
          privileges.

          This service is installed with HP OpenView Data Protector, HP Application
          Recovery Manager and potentially other products. This exploit has been tested
          against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1
          of Application Recovery Manager.

          NOTE: There are actually two consecutive wcscpy() calls in the program (which
          may be why ZDI considered them two separate issues). However, this module only
          exploits the second one.

Check method (fingerprinting):
connect
    sock.put(rand_text_alpha_upper(64))
    resp = sock.get_once(-1, 5)
    disconnect

    if (resp)
      resp = resp.unpack('v*').pack('C*')
      print_status("Received response: " + resp)

      # extract version
      if (resp =~ /HP Data Protector/)
        version = resp.split[3]
      elsif (resp =~ /HP OpenView Storage Data Protector/)
        version = resp.split[5]
      elsif (resp =~ /HP StorageWorks Application Recovery Manager/)
        version = resp.split[5]
      else
        return Exploit::CheckCode::Detected('HP Data Protector service detected but version could not be extracted')
      end

      version = version.split('.')
      major = version[1].to_i
      minor = version[2].to_i
      if ((major < 6) or (major == 6 and minor < 11))
        return Exploit::CheckCode::Appears("HP Data Protector version #{version.join('.')} appears vulnerable")
      end

      if ((major > 6) or (major == 6 and minor >= 11))
        return Exploit::CheckCode::Safe("HP Data Protector version #{version.join('.')} is not vulnerable")
      end

    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: BigAnt Server DUPF Command Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/misc/bigant_server_dupf_upload.rb
Platform: win
Disclosure date: 2013-01-09
References: CVE-2012-6274, US-CERT-VU-990652, BID-57214, OSVDB-89342

Description:
This exploits an arbitrary file upload vulnerability in BigAnt Server 2.97 SP7.
          A lack of authentication allows to make unauthenticated file uploads through a DUPF
          command. Additionally the filename option in the same command can be used to launch
          a directory traversal attack and achieve arbitrary file upload.

          The module uses the Windows Management Instrumentation service to execute an
          arbitrary payload on vulnerable installations of BigAnt on Windows XP and 2003. It
          has been successfully tested on BigAnt Server 2.97 SP7 over Windows XP SP3 and 2003
          SP2.
Metasploit Module: Eureka Email 2.2q ERR Remote Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/eureka_mail_err.rb
Platform: win
Disclosure date: 2009-10-22
References: CVE-2009-3837, OSVDB-59262, EDB-10235

Description:
This module exploits a buffer overflow in the Eureka Email 2.2q
          client that is triggered through an excessively long ERR message.

          NOTE: this exploit isn't very reliable. Unfortunately reaching the
          vulnerable code can only be done when manually checking mail (Ctrl-M).
          Checking at startup will not reach the code targeted here.
Metasploit Module: HP Operations Agent Opcode coda.exe 0x8c Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_operations_agent_coda_8c.rb
Platform: win
Disclosure date: Jul 09 2012
References: CVE-2012-2020, OSVDB-83674, BID-54362, ZDI-12-115

Description:
This module exploits a buffer overflow vulnerability in HP Operations Agent for
        Windows. The vulnerability exists in the HP Software Performance Core Program
        component (coda.exe) when parsing requests for the 0x8c opcode. This module has
        been tested successfully on HP Operations Agent 11.00 over Windows XP SP3 and
        Windows 2003 SP2 (DEP bypass).

        The coda.exe components runs only for localhost by default, network access must be
        granted through its configuration to be remotely exploitable. On the other hand it
        runs on a random TCP port, to make easier reconnaissance a check function is
        provided.

Check method (fingerprinting):
res = ping

    if not res
      vprint_error("No response from target")
      return Exploit::CheckCode::Unknown('No response from target')
    end

    if res !~ /HTTP\/1\.1 200 OK/
      return Exploit::CheckCode::Unknown('Failed to determine the target state')
    end

    if res =~ /server:.*coda 11.(\d+)/
      minor = $1.to_i
      if minor < 2
        return Exploit::CheckCode::Appears("HP Operations Agent CODA 11.#{minor} appears vulnerable")
      else
        return Exploit::CheckCode::Safe("HP Operations Agent CODA 11.#{minor} is not vulnerable")
      end
    end

    if res =~ /server:.*coda/
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Apple QuickTime 7.3 RTSP Response Header Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/apple_quicktime_rtsp_response.rb
Platform: win
Disclosure date: 2007-11-23
Authors: MC
References: CVE-2007-6166, OSVDB-40876, BID-26549, EDB-4648

Description:
This module exploits a stack buffer overflow in Apple QuickTime 7.3. By sending an overly long
          RTSP response to a client, an attacker may be able to execute arbitrary code.
Metasploit Module: AgentX++ Master AgentX::receive_agentx Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/agentxpp_receive_agentx.rb
Platform: win
Disclosure date: 2010-04-16
References: CVE-2010-1318, OSVDB-63919, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=867

Description:
This exploits a stack buffer overflow in the AgentX++ library, as used by
          various applications. By sending a specially crafted request, an attacker can
          execute arbitrary code, potentially with SYSTEM privileges.

          This module was tested successfully against master.exe as included with Real
          Network\'s Helix Server v12. When installed as a service with Helix Server,
          the service runs as SYSTEM, has no recovery action, but will start automatically
          on boot.

          This module does not work with NX/XD enabled but could be modified easily to
          do so. The address
Metasploit Module: HP OmniInet.exe MSG_PROTOCOL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_omniinet_1.rb
Platform: win
Disclosure date: 2009-12-17
References: CVE-2007-2280, BID-37396, OSVDB-61206, ZDI-09-099

Description:
This module exploits a stack-based buffer overflow in the Hewlett-Packard
          OmniInet NT Service. By sending a specially crafted MSG_PROTOCOL (0x010b)
          packet, a remote attacker may be able to execute arbitrary code with elevated
          privileges.

          This service is installed with HP OpenView Data Protector, HP Application
          Recovery Manager and potentially other products. This exploit has been tested
          against versions 6.1, 6.0, and 5.50 of Data Protector. and versions 6.0 and 6.1
          of Application Recovery Manager.

          NOTE: There are actually two consecutive wcscpy() calls in the program (which
          may be why ZDI considered them two separate issues). However, this module only
          exploits the first one.

Check method (fingerprinting):
connect
    sock.put(rand_text_alpha_upper(64))
    resp = sock.get_once(-1, 5)
    disconnect

    if (resp)
      resp = resp.unpack('v*').pack('C*')
      print_status("Received response: " + resp)

      # extract version
      if (resp =~ /HP Data Protector/)
        version = resp.split[3]
      elsif (resp =~ /HP OpenView Storage Data Protector/)
        version = resp.split[5]
      elsif (resp =~ /HP StorageWorks Application Recovery Manager/)
        version = resp.split[5]
      else
        return Exploit::CheckCode::Detected('HP Data Protector service detected but version could not be extracted')
      end

      version = version.split('.')
      major = version[1].to_i
      minor = version[2].to_i
      if ((major < 6) or (major == 6 and minor < 11))
        return Exploit::CheckCode::Appears("HP Data Protector version #{version.join('.')} appears vulnerable")
      end

      if ((major > 6) or (major == 6 and minor >= 11))
        return Exploit::CheckCode::Safe("HP Data Protector version #{version.join('.')} is not vulnerable")
      end

    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: PlugX Controller Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/plugx.rb
Platform: win
Disclosure date: 2017-07-27
Authors: Professor Plum

Description:
This module exploits a stack buffer overflow in the PlugX Controller (C2 server).

Check method (fingerprinting):
connect
    key = rand(0xFFFFFFFF)
    hh = [key, 0, 0, 0, 0, 0].pack('I<S<S<S<S<I<')
    hdr = xor_wrap(key, hh)
    sock.put([key].pack('I<') + hdr[4..-1])
    if validate_response(sock.get_once || '')
      return Exploit::CheckCode::Appears('PlugX C&C server detected')
    end

    Exploit::CheckCode::Safe('No valid PlugX response detected')
  end
Metasploit Module: IBM WebSphere RCE Java Deserialization Vulnerability
Type: exploit
Path: modules/exploits/windows/misc/ibm_websphere_java_deserialize.rb
Platform: win
Disclosure date: 2015-11-06
References: CVE-2015-7450, URL-https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java, URL-http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability, URL-https://www.tenable.com/plugins/index.php?view=single&id=87171

Description:
This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization
          call of unauthenticated Java objects exists to the Apache Commons Collections (ACC) library, which allows
          remote arbitrary code execution. Authentication is not required in order to exploit this vulnerability.
Metasploit Module: Enterasys NetSight nssyslogd.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/enterasys_netsight_syslog_bof.rb
Platform: win
Disclosure date: 2011-12-19
References: CVE-2011-5227, OSVDB-77971, BID-51124, ZDI-11-350

Description:
This module exploits a stack buffer overflow in Enterasys NetSight. The
          vulnerability exists in the Syslog service (nssylogd.exe) when parsing a specially
          crafted PRIO from a syslog message. The module has been tested successfully on
          Enterasys NetSight 4.0.1.34 over Windows XP SP3 and Windows 2003 SP2.