deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Unified Remote Auth Bypass to RCE
Type: exploit
Path: modules/exploits/windows/misc/unified_remote_rce.rb
Platform: win
Disclosure date: 2021-02-25
References: EDB-49587, URL-https://www.unifiedremote.com/, URL-https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/unified%20remote/unified-remote-rce.py, CVE-2022-3229

Description:
This module utilizes the Unified Remote remote control protocol to type out and
          deploy a payload.  The remote control protocol can be configured to have no passwords,
          a group password, or individual user accounts.  If the web page is accessible, the
          access control is set to no password for exploitation, then reverted.
          If the web page is not accessible, exploitation will be tried blindly.
          This module has been successfully tested against version 3.11.0.2483 (50) on Windows 10.

Check method (fingerprinting):
security_mode = get_config
    if security_mode.nil?
      return CheckCode::Unknown('Unable to get config from web server, unknown status of Unified Remote Controller')
    end

    CheckCode::Vulnerable("Unified Remote is vulnerable on port #{security_mode['interfaces']['tcp']['port']} with security mode '#{security_mode['security']['mode']}' (can be bypassed, if needed)")
  end
Metasploit Module: ALLMediaServer 1.6 SEH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/cve_2022_28381_allmediaserver_bof.rb
Platform: win
Disclosure date: 2022-04-01
References: CVE-2022-28381, URL-https://github.com/Matrix07ksa/ALLMediaServer-1.6-Buffer-Overflow

Description:
This module exploits a stack buffer overflow leading to a SEH handler overwrite
          in ALLMediaServer 1.6. The vulnerability is caused due to a boundary error
          within the handling of a HTTP request. Note that this exploit will only work
          against x86 or WoW64 targets, x64 is not supported at this time.
Metasploit Module: Citrix Provisioning Services 5.6 streamprocess.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/citrix_streamprocess.rb
Platform: win
Disclosure date: 2011-01-20
Authors: mog
References: OSVDB-70597, ZDI-11-023, URL-http://web.archive.org/web/[PII_REDACTED]4820/http://secunia.com:80/advisories/42954/, URL-http://support.citrix.com/article/CTX127149

Description:
This module exploits a stack buffer overflow in Citrix Provisioning Services 5.6.
          By sending a specially crafted packet to the Provisioning Services server, a fixed
          length buffer on the stack can be overflowed and arbitrary code can be executed.
Metasploit Module: HP Intelligent Management Center UAM Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_imc_uam.rb
Platform: win
Disclosure date: 2012-08-29
References: CVE-2012-3274, OSVDB-85060, BID-55271, ZDI-12-171, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03589863

Description:
This module exploits a remote buffer overflow in HP Intelligent Management Center
          UAM. The vulnerability exists in the uam.exe component, when using sprint in a
          insecure way for logging purposes. The vulnerability can be triggered by sending a
          malformed packet to the 1811/UDP port. The module has been successfully tested on
          HP iMC 5.0 E0101 and UAM 5.0 E0102 over Windows Server 2003 SP2 (DEP bypass).
Metasploit Module: Poison Ivy 2.1.x C2 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/poisonivy_21x_bof.rb
Platform: win
Disclosure date: 2016-06-03
References: URL-http://samvartaka.github.io/exploitation/2016/06/03/dead-rats-exploiting-malware

Description:
This module exploits a stack buffer overflow in the Poison Ivy 2.1.x C&C server.
          The exploit does not need to know the password chosen for the bot/server communication.

Check method (fingerprinting):
connect
    # Poke
    sock.put("\x01")
    # Fetch response
    response = sock.get_once(6)

    if (response == "\x89\xFF\x90\x0B\x00\x00")
      vprint_status("Poison Ivy C&C version 2.1.4 detected.")
      return Exploit::CheckCode::Appears('Poison Ivy C&C version 2.1.4 detected')
    elsif (response == "\x89\xFF\x38\xE0\x00\x00")
      vprint_status("Poison Ivy C&C version 2.0.0 detected.")
      return Exploit::CheckCode::Safe('Poison Ivy C&C version 2.0.0 detected, not vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not running a vulnerable version')
  end

  # Load known plaintext chunk
Metasploit Module: TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/trendmicro_cmdprocessor_addtask.rb
Platform: win
Disclosure date: 2011-12-07
References: CVE-2011-5001, OSVDB-77585, ZDI-11-345

Description:
This module exploits a vulnerability in the CmdProcessor.exe component of Trend
          Micro Control Manger up to version 5.5.

          The specific flaw exists within CmdProcessor.exe service running on TCP port
          20101. The vulnerable function is the CGenericScheduler::AddTask function of
          cmdHandlerRedAlertController.dll. When processing a specially crafted IPC packet,
          controlled data is copied into a 256-byte stack buffer. This can be exploited
          to execute remote code under the context of the user.
Metasploit Module: Bopup Communications Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bopup_comm.rb
Platform: win
Disclosure date: 2009-06-18
References: CVE-2009-2227, OSVDB-55275, URL-http://www.blabsoft.com/products/server, EDB-9002

Description:
This module exploits a stack buffer overflow in Bopup Communications Server 3.2.26.5460.
          By sending a specially crafted packet, an attacker may be
          able to execute arbitrary code.
Metasploit Module: Apple iTunes 10 Extended M3U Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/itunes_extm3u_bof.rb
Platform: win
Disclosure date: 2012-06-21
References: OSVDB-83220, EDB-19322, URL-http://pastehtml.com/view/c25uhk4ab.html

Description:
This module exploits a stack buffer overflow in iTunes 10.4.0.80 to 10.6.1.7.
          When opening an extended .m3u file containing an "#EXTINF:" tag description,
          iTunes will copy the content after "#EXTINF:" without appropriate checking
          from a heap buffer to a stack buffer, writing beyond the stack buffer's boundary,
          which allows code execution under the context of the user.

          Please note before using this exploit, you must have precise knowledge of the
          victim machine's QuickTime version (if installed), and then select your target
          accordingly.

          In addition, even though this exploit can be used as remote, you should be aware
          the victim's browser behavior when opening an itms link.  For example,
          IE/Firefox/Opera by default will ask the user for permission before launching the
          itms link by iTunes.  Chrome will ask for permission, but also spits a warning.
          Safari would be an ideal target, because it will open the link without any
          user interaction.
Metasploit Module: Ivanti EPM Agent Portal Command Execution
Type: exploit
Path: modules/exploits/windows/misc/ivanti_agent_portal_cmdexec.rb
Platform: win
Disclosure date: 2023-06-07
References: CVE-2023-28324, URL-https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324?language=en_US, URL-https://github.com/horizon3ai/CVE-2023-28324

Description:
This module leverages an unauthenticated RCE in Ivanti's EPM Agent Portal where a RPC client can invoke a method
          which will run an attacker-specified string on the remote target as NT AUTHORITY\SYSTEM.
          This vulnerability is present in versions prior to EPM 2021.1 Su4 and EPM 2022 Su2.

Check method (fingerprinting):
cwd = execute_command('echo %cd%', 0)
    return CheckCode::Safe('Command execution failed.') unless cwd.to_s =~ /.:\\Windows\\System32/i

    CheckCode::Vulnerable("Command execution test succeeded. Current working directory: #{cwd}")
  rescue Rex::SocketError => e
    CheckCode::Safe("MS-NRTP connection failed. #{e.class}: #{e.message}")
  end
Metasploit Module: HP Diagnostics Server magentservice.exe Overflow
Type: exploit
Path: modules/exploits/windows/misc/hp_magentservice.rb
Platform: win
Disclosure date: 2012-01-12
References: OSVDB-72815, CVE-2011-4789, ZDI-12-016

Description:
This module exploits a stack buffer overflow in HP Diagnostics Server
          magentservice.exe service. By sending a specially crafted packet, an attacker
          may be able to execute arbitrary code. Originally found and posted by
          AbdulAziz Harir via ZDI.
Metasploit Module: Symantec Altiris DS SQL Injection
Type: exploit
Path: modules/exploits/windows/misc/altiris_ds_sqli.rb
Platform: win
Disclosure date: 2008-05-15
References: CVE-2008-2286, OSVDB-45313, BID-29198, URL-http://www.zerodayinitiative.com/advisories/ZDI-08-024
Targets: Windows 2003 (with tftp client available)

Description:
This module exploits a SQL injection flaw in Symantec Altiris Deployment Solution 6.8
          to 6.9.164. The vulnerability exists on axengine.exe which fails to adequately sanitize
          numeric input fields in "UpdateComputer" notification Requests. In order to spawn a shell,
          several SQL injections are required in close succession, first to enable xp_cmdshell, then
          retrieve the payload via TFTP and finally execute it. The module also has the capability
          to disable or enable local application authentication. In order to work the target system
          must have a tftp client available.

Check method (fingerprinting):
res = send_update_computer("2659")

    unless res and res =~ /Result=Success/ and res =~ /DSVersion=(.*)/
      return Exploit::CheckCode::Unknown('Target did not return a successful response')
    end

    version = $1

    unless version =~ /^6\.(\d+)\.(\d+)$/
      return Exploit::CheckCode::Safe("Altiris DS version #{version} is not vulnerable")
    end

    vprint_status "#{rhost}:#{rport} - Altiris DS Version '#{version}'"

    minor = $1.to_i
    build = $2.to_i

    if minor == 8
      if build == 206 || build == 282 || build == 378
        return Exploit::CheckCode::Appears("Altiris DS version #{version} appears vulnerable")
      elsif build < 390
        return Exploit::CheckCode::Appears("Altiris DS version #{version} appears vulnerable")
      end
    elsif minor == 9 and build < 176
      # The existence of versions matching this profile is a possibility... none were observed in the wild though
      # as such, we're basing confidence off of Symantec's vulnerability bulletin.
      return Exploit::CheckCode::Appears("Altiris DS version #{version} appears vulnerable")
    end

    return Exploit::CheckCode::Safe("Altiris DS version #{version} is not vulnerable")
  end
Metasploit Module: Bomberclone 0.11.6 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bomberclone_overflow.rb
Platform: win
Disclosure date: 2006-02-16
Authors: Jacopo Cervini <acaro[at]jervus.it>
References: CVE-2006-0460, OSVDB-23263, BID-16697

Description:
This module exploits a stack buffer overflow in Bomberclone 0.11.6 for Windows.
          The return address is overwritten with lstrcpyA memory address,
          the second and third value are the destination buffer,
          the fourth value is the source address of our buffer in the stack.
          This exploit is like a return in libc.

          ATTENTION
          The shellcode is exec ONLY when someone try to close bomberclone.
Metasploit Module: IMail LDAP Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ldap/imail_thc.rb
Platform: win
Disclosure date: 2004-02-17
References: CVE-2004-0297, OSVDB-3984, BID-9682, URL-http://web.archive.org/web/[PII_REDACTED]5821/http://secunia.com:80/advisories/10880/

Description:
This exploits a buffer overflow in the LDAP service that is
          part of the IMail product. This module was tested against
          version 7.10 and 8.5, both running on Windows 2000.
Metasploit Module: Network Associates PGP KeyServer 7 LDAP Buffer Overflow
Type: exploit
Path: modules/exploits/windows/ldap/pgp_keyserver7.rb
Platform: win
Disclosure date: 2001-07-16
References: CVE-2001-1320, OSVDB-4742, BID-3046, URL-http://www.ee.oulu.fi/research/ouspg/protos/testing/c06/ldapv3/

Description:
This module exploits a stack buffer overflow in the LDAP service that is
          part of the NAI PGP Enterprise product suite. This module was tested
          against PGP KeyServer v7.0. Due to space restrictions, egghunter is
          used to find our payload - therefore you may wish to adjust WfsDelay.
Metasploit Module: MS04-045 Microsoft WINS Service Memory Overwrite
Type: exploit
Path: modules/exploits/windows/wins/ms04_045_wins.rb
Platform: win
Disclosure date: 2004-12-14
References: CVE-2004-1080, OSVDB-12378, BID-11763, MSB-MS04-045

Description:
This module exploits an arbitrary memory write flaw in the
          WINS service. This exploit has been tested against Windows
          2000 only.

Check method (fingerprinting):
ret = fprint

    info = 'This system is running '
    info << ((ret[1] == '?') ? 'an unknown windows version ' : "Windows #{ret[1]} ")
    info << ((ret[2] == '?') ? '' : "with service pack #{ret[2]} ")
    info << (ret[3] ? '(clean heap)' : '(dirty heap)')

    print_status(info)
    return ret[0]
  end
Metasploit Module: EMC Networker Format String
Type: exploit
Path: modules/exploits/windows/emc/networker_format_string.rb
Disclosure date: 2012-08-29
References: CVE-2012-2288, OSVDB-85116, BID-55330, URL-http://aluigi.altervista.org/misc/aluigi0216_story.txt

Description:
This module exploits a format string vulnerability in the lg_sprintf function
          as implemented in liblocal.dll on EMC Networker products. This module exploits the
          vulnerability by using a specially crafted RPC call to the program number 0x5F3DD,
          version 0x02, and procedure 0x06. This module has been tested successfully on EMC
          Networker 7.6 SP3 on Windows XP SP3 and Windows 2003 SP2 (DEP bypass).
Metasploit Module: EMC AlphaStor Device Manager Opcode 0x75 Command Injection
Type: exploit
Path: modules/exploits/windows/emc/alphastor_device_manager_exec.rb
Platform: win
Disclosure date: 2013-01-18
References: CVE-2013-0928, ZDI-13-033

Description:
This module exploits a flaw within the Device Manager (rrobtd.exe). When parsing the 0x75
          command, the process does not properly filter user supplied input allowing for arbitrary
          command injection. This module has been tested successfully on EMC AlphaStor 4.0 build 116
          with Windows 2003 SP2 and Windows 2008 R2.

Check method (fingerprinting):
packet = "\x75~ mminfo & #{rand_text_alpha(512)}"
    res = send_packet(packet)
    if res && res =~ /Could not fork command/
      return Exploit::CheckCode::Detected('AlphaStor Device Manager detected')
    end

    Exploit::CheckCode::Unknown('Could not conclusively detect AlphaStor Device Manager')
  end
Metasploit Module: EMC Replication Manager Command Execution
Type: exploit
Path: modules/exploits/windows/emc/replication_manager_exec.rb
Platform: win
Disclosure date: 2011-02-07
References: CVE-2011-0647, OSVDB-70853, BID-46235, URL-http://www.securityfocus.com/archive/1/516260, ZDI-11-061

Description:
This module exploits a remote command-injection vulnerability in EMC Replication Manager
          client (irccd.exe). By sending a specially crafted message invoking RunProgram function an
          attacker may be able to execute arbitrary commands with SYSTEM privileges. Affected
          products are EMC Replication Manager < 5.3. This module has been successfully tested
          against EMC Replication Manager 5.2.1 on XP/W2003. EMC Networker Module for Microsoft
          Applications 2.1 and 2.2 may be vulnerable too although this module have not been tested
          against these products.
Metasploit Module: EMC AlphaStor Agent Buffer Overflow
Type: exploit
Path: modules/exploits/windows/emc/alphastor_agent.rb
Platform: win
Disclosure date: 2008-05-27
Authors: MC
References: CVE-2008-2158, OSVDB-45714, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=702

Description:
This module exploits a stack buffer overflow in EMC AlphaStor 3.1.
          By sending a specially crafted message, an attacker may
          be able to execute arbitrary code.
Metasploit Module: SafeNet SoftRemote IKE Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/vpn/safenet_ike_11.rb
Platform: win
Disclosure date: 2009-06-01
References: CVE-2009-1943, OSVDB-54831, BID-35154, URL-http://reversemode.com/index.php?option=com_content&task=view&id=63&Itemid=1

Description:
This module exploits a stack buffer overflow in Safenet SoftRemote IKE IreIKE.exe
          service. When sending a specially crafted udp packet to port 62514 an
          attacker may be able to execute arbitrary code. This module has
          been tested with Juniper NetScreen-Remote 10.8.0 (Build 20) using
          windows/meterpreter/reverse_ord_tcp payloads.
Metasploit Module: MS04-011 Microsoft Private Communications Transport Overflow
Type: exploit
Path: modules/exploits/windows/ssl/ms04_011_pct.rb
Platform: win
Disclosure date: 2004-04-13
References: CVE-2003-0719, OSVDB-5250, BID-10116, MSB-MS04-011

Description:
This module exploits a buffer overflow in the Microsoft
          Windows SSL PCT protocol stack. This code is based on Johnny
          Cyberpunk's THC release and has been tested against Windows
          2000 and Windows XP. To use this module, specify the remote
          port of any SSL service, or the port and protocol of an
          application that uses SSL. The only application protocol
          supported at this time is SMTP. You only have one chance to
          select the correct target, if you are attacking IIS, you may
          want to try one of the other exploits first (WebDAV). If
          WebDAV does not work, this more than likely means that this
          is either Windows 2000 SP4+ or Windows XP (IIS 5.0 vs IIS
          5.1). Using the wrong target may not result in an immediate
          crash of the remote system.
Metasploit Module: Dell Webcam CrazyTalk ActiveX BackImage Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/dell_webcam_crazytalk.rb
Platform: win
Disclosure date: 2012-03-19
References: URL-http://www.dell.com/support/drivers/us/en/04/DriverDetails/DriverFileFormats?c=us&l=en&s=bsd&cs=04&DriverId=R230103, EDB-18621, OSVDB-80205

Description:
This module exploits a vulnerability in Dell Webcam's CrazyTalk component.
          Specifically, when supplying a long string for a file path to the BackImage
          property, an overflow may occur after checking certain file extension names,
          resulting in remote code execution under the context of the user.
Metasploit Module: RealNetworks Realplayer QCP Parsing Heap Overflow
Type: exploit
Path: modules/exploits/windows/browser/realplayer_qcp.rb
Platform: win
Disclosure date: 2011-08-16
References: CVE-2011-2950, OSVDB-74549, BID-49172, ZDI-11-265, URL-http://service.real.com/realplayer/security/08162011_player/en/

Description:
This module exploits a heap overflow in Realplayer when handling a .QCP file.
          The specific flaw exists within qcpfformat.dll. A static 256 byte buffer is
          allocated on the heap and user-supplied data from the file is copied within a
          memory copy loop.

          This allows a remote attacker to execute arbitrary code running in the context
          of the web browser via a .QCP file with a specially crafted "fmt" chunk.
          At this moment this module exploits the flaw on Windows XP IE6, IE7.
Metasploit Module: Foxit Reader Plugin URL Processing Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb
Platform: win
Disclosure date: 2013-01-07
References: CVE-2013-10068, OSVDB-89030, BID-57174, EDB-23944, URL-http://web.archive.org/web/[PII_REDACTED]3143/http://secunia.com/advisories/51733/

Description:
This module exploits a vulnerability in the Foxit Reader Plugin, it exists in
          the npFoxitReaderPlugin.dll module. When loading PDF files from remote hosts,
          overly long query strings within URLs can cause a stack-based buffer overflow,
          which can be exploited to execute arbitrary code. This exploit has been tested
          on Windows 7 SP1 with Firefox 18.0 and Foxit Reader version 5.4.4.11281
          (npFoxitReaderPlugin.dll version 2.2.1.530).
Metasploit Module: PcVue 10.0 SV.UIGrdCtrl.1 'LoadObject()/SaveObject()' Trusted DWORD Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/pcvue_func.rb
Platform: win
Disclosure date: 2011-10-05
References: CVE-2011-4044, OSVDB-77561, BID-49795, URL-http://aluigi.altervista.org/adv/pcvue_1-adv.txt

Description:
This module exploits a function pointer control within SVUIGrd.ocx of PcVue 10.0.
          By setting a dword value for the SaveObject() or LoadObject(), an attacker can
          overwrite a function pointer and execute arbitrary code.
Metasploit Module: HP Mercury Quality Center ActiveX Control ProgColor Buffer Overflow
Type: exploit
Path: modules/exploits/windows/browser/hpmqc_progcolor.rb
Platform: win
Disclosure date: 2007-04-04
References: CVE-2007-1819, OSVDB-34317, BID-23239, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=497

Description:
This module exploits a stack-based buffer overflow in SPIDERLib.Loader
          ActiveX control (Spider90.ocx) 9.1.0.4353 installed by TestDirector (TD)
          for Hewlett-Packard Mercury Quality Center 9.0 before Patch 12.1, and
          8.2 SP1 before Patch 32.
          By setting an overly long value to 'ProgColor', an attacker can overrun
          a buffer and execute arbitrary code.
Metasploit Module: Adobe Flash Player PCRE Regex Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/adobe_flash_pcre.rb
Platform: win
Disclosure date: 2014-11-25
References: CVE-2015-0318, URL-http://googleprojectzero.blogspot.com/2015/02/exploitingscve-2015-0318sinsflash.html, URL-http://web.archive.org/web/[PII_REDACTED]3607/https://code.google.com/p/google-security-research/issues/detail?id=199

Description:
This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error
          in the PCRE engine, specifically in the handling of the \c escape sequence when followed by
          a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode.
Metasploit Module: MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability
Type: exploit
Path: modules/exploits/windows/browser/ie_cbutton_uaf.rb
Platform: win
Disclosure date: 2012-12-27
References: CVE-2012-4792, OSVDB-88774, US-CERT-VU-154201, BID-57070, MSB-MS13-008, URL-http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html, URL-http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/, URL-http://technet.microsoft.com/en-us/security/advisory/2794220, URL-http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx, URL-http://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/

Description:
This module exploits a vulnerability found in Microsoft Internet Explorer. A
          use-after-free condition occurs when a CButton object is freed, but a reference
          is kept and used again during a page reload, an invalid memory that's controllable
          is used, and allows arbitrary code execution under the context of the user.

          Please note: This vulnerability has been exploited in the wild targeting
          mainly China/Taiwan/and US-based computers.