deardaniel/secdata-raw huggingface dataset:
Metasploit Module: PostgreSQL CREATE LANGUAGE Execution
Type: exploit
Path: modules/exploits/multi/postgres/postgres_createlang.rb
Platform: %w(linux unix win osx)
Disclosure date: 2016-01-01
References: URL-http://www.postgresql.org/docs/current/static/sql-createlanguage.html, URL-http://www.postgresql.org/docs/current/static/plperl.html, URL-http://www.postgresql.org/docs/current/static/plpython.html

Description:
Some installations of Postgres 8 and 9 are configured to allow loading external scripting languages.
          Most commonly this is Perl and Python. When enabled, command execution is possible on the host.
          To execute system commands, loading the "untrusted" version of the language is necessary.
          This requires a superuser. This is usually postgres. The execution should be platform-agnostic,
          and has been tested on OS X, Windows, and Linux.

          This module attempts to load Perl or Python to execute system commands. As this dynamically loads
          a scripting language to execute commands, it is not necessary to drop a file on the filesystem.

          Only Postgres 8 and up are supported.

Check method (fingerprinting):
vuln_version? ? CheckCode::Appears('PostgreSQL version appears vulnerable') : CheckCode::Safe('PostgreSQL version does not appear to be vulnerable')
  end
Metasploit Module: Snap Creek Duplicator WordPress plugin code injection
Type: exploit
Path: modules/exploits/multi/php/wp_duplicator_code_inject.rb
Platform: php
Disclosure date: 2018-08-29
References: URL-https://www.synacktiv.com/ressources/advisories/WordPress_Duplicator-1.2.40-RCE.pdf, CVE-2018-17207

Description:
When the WordPress plugin Snap Creek Duplicator restores a backup, it
          leaves dangerous files in the filesystem such as installer.php and
          installer-backup.php. These files allow anyone to call a function that
          overwrite the wp-config.php file AND this function does not sanitize
          POST parameters before inserting them inside the wp-config.php file,
          leading to arbitrary PHP code execution.
          WARNING: This exploit WILL break the wp-config.php file. If possible try
          to restore backups of the configuration after the exploit to make the
          WordPress site work again.

Check method (fingerprinting):
tpath = normalize_uri(datastore['TARGETURI'])

    vprint_status("Checking URI #{rhost + tpath}")
    response = send_request_cgi({ 'uri' => tpath }, timeout = datastore['TIMEOUT'])

    unless response
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection failed')
    end

    unless response.code == 200
      vprint_error("Server responded with #{response.code}")
      return CheckCode::Safe("Server responded with #{response.code}")
    end

    # check_plugin_version_from_readme('duplicator', '1.2.42')
    matches = response.body.to_s.scan(/version: ([^<]*)</)
    if matches.empty?
      return CheckCode::Unknown('Could not determine Duplicator version')
    end

    version = matches.last.first
    if Rex::Version.new(version) <= Rex::Version.new("1.2.40")
      return CheckCode::Vulnerable("Duplicator version #{version} is vulnerable")
    else
      return CheckCode::Detected("Duplicator version #{version} detected")
    end
  end
Metasploit Module: Jorani unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/php/jorani_path_trav.rb
Platform: %w[php
Disclosure date: 2023-01-06
References: CVE-2023-26469, URL-https://github.com/Orange-Cyberdefense/CVE-repository/blob/master/PoCs/CVE_Jorani.py

Description:
This module exploits an unauthenticated Remote Code Execution in Jorani prior to 1.0.2.
          It abuses 3 vulnerabilities: log poisoning and redirection bypass via header spoofing, then it uses path traversal to trigger the vulnerability.
          It has been tested on Jorani 1.0.0.

Check method (fingerprinting):
# For the check command
    print_status('Checking Jorani version')
    uri = normalize_uri(target_uri.path, 'index.php')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => "#{uri}/session/login"
    )

    if res.nil?
      return Exploit::CheckCode::Safe('There was a problem accessing the login page')
    end

    return Exploit::CheckCode::Safe('Target service is not running') unless service_running(res)

    print_good('Jorani seems to be running on the target!')

    current_version = get_version(res)
    return Exploit::CheckCode::Detected('Jorani detected but could not determine version') if current_version.nil?

    print_good("Found version: #{current_version}")
    current_version = Rex::Version.new(current_version)

    return Exploit::CheckCode::Appears("Jorani version #{current_version} is vulnerable") if current_version < Rex::Version.new('1.0.2')

    Exploit::CheckCode::Safe("Jorani version #{current_version} is not vulnerable")
  end
Metasploit Module: Unauthenticated remote code execution in Ignition
Type: exploit
Path: modules/exploits/multi/php/ignition_laravel_debug_rce.rb
Platform: unix
Disclosure date: 2021-01-13
References: CVE-2021-3129, URL-https://www.ambionics.io/blog/laravel-debug-rce
Targets: Unix (In-Memory), Windows (In-Memory)

Description:
Ignition before 2.5.2, as used in Laravel and other products,
          allows unauthenticated remote attackers to execute arbitrary code
          because of insecure usage of file_get_contents() and file_put_contents().
          This is exploitable on sites using debug mode with Laravel before 8.4.2.

Check method (fingerprinting):
print_status("Checking component version to #{datastore['RHOST']}:#{datastore['RPORT']}")
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path.to_s),
      'method' => 'PUT'
    })
    # Check whether it is using facade/ignition
    # If is using it should respond method not allowed
    # checking if debug mode is enable
    if res && res.code == 405 && res.body.match(/label:"(Debug)"/)
      vprint_status 'Debug mode is enabled.'
      # check version
      versions = JSON.parse(
        res.body.match(/.+"report":(\{.*),"exception_class/).captures.first.gsub(/$/, '}')
      )
      version = Rex::Version.new(versions['framework_version'])
      vprint_status "Found PHP #{versions['language_version']} running Laravel #{version}"
      # to be sure that it is vulnerable we could try to cleanup the log files (invalid and valid)
      # but it is way more intrusive than just checking the version moreover we would need to call
      # the find_log_file method before, meaning four requests more.
      return Exploit::CheckCode::Appears("Laravel #{version} with Ignition appears vulnerable") if version <= Rex::Version.new('8.26.1')
    end
    return Exploit::CheckCode::Safe('Target does not appear to be running Laravel with Ignition')
  end
Metasploit Module: Subversion Date Svnserve
Type: exploit
Path: modules/exploits/multi/svn/svnserve_date.rb
Platform: linux
Disclosure date: 2004-05-19
Authors: spoonm
References: CVE-2004-0397, OSVDB-6301, BID-10386, URL-http://lists.netsys.com/pipermail/full-disclosure/2004-May/021737.html

Description:
This is an exploit for the Subversion date parsing overflow.  This
          exploit is for the svnserve daemon (svn:// protocol) and will not work
          for Subversion over webdav (http[s]://).  This exploit should never
          crash the daemon, and should be safe to do multi-hits.

          **WARNING** This exploit seems to (not very often, I've only seen
          it during testing) corrupt the subversion database, so be careful!
Metasploit Module: Snort 2 DCE/RPC Preprocessor Buffer Overflow
Type: exploit
Path: modules/exploits/multi/ids/snort_dce_rpc.rb
Platform: win
Disclosure date: 2007-02-19
References: OSVDB-32094, CVE-2006-5276, URL-http://web.archive.org/web/[PII_REDACTED]5015/http://www.snort.org/docs/advisory-2007-02-19.html, URL-http://sf-freedom.blogspot.com/2007/02/snort-261-dcerpc-preprocessor-remote.html, URL-http://downloads.securityfocus.com/vulnerabilities/exploits/22616-linux.py

Description:
This module allows remote attackers to execute arbitrary code by exploiting the
          Snort service via crafted SMB traffic. The vulnerability is due to a boundary
          error within the DCE/RPC preprocessor when reassembling SMB Write AndX requests,
          which may result a stack-based buffer overflow with a specially crafted packet
          sent on a network that is monitored by Snort.

          Vulnerable versions include Snort 2.6.1, 2.7 Beta 1 and SourceFire IDS 4.1, 4.5 and 4.6.

          Any host on the Snort network may be used as the remote host. The remote host does not
          need to be running the SMB service for the exploit to be successful.
Metasploit Module: Calibre Python Code Injection (CVE-2024-6782)
Type: exploit
Path: modules/exploits/multi/misc/calibre_exec.rb
Platform: win
Disclosure date: 2024-07-31
References: URL-https://starlabs.sg/advisories/24/24-6782, CVE-2024-6782
Targets: Windows_Fetch, Linux Command

Description:
This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled (disabled by default), it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any authentication. The injected payload will get executed in the same context under which Calibre is being executed.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path)
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return CheckCode::Unknown('Connection failed')
    end

    if res && res.code == 200
      data = res.body.to_s
      pattern = /CALIBRE_VERSION\s*=\s*"([^"]+)"/

      match = data.match(pattern)

      unless match
        return CheckCode::Unknown('Could not determine the Calibre version')
      end

      version = match[1]
      vprint_status("Version retrieved: #{version}")

      if Rex::Version.new(version).between?(Rex::Version.new('6.9.0'), Rex::Version.new('7.15.0'))
        return CheckCode::Appears("Calibre version #{version} is vulnerable")
      else
        return CheckCode::Safe("Calibre version #{version} is not vulnerable")
      end
    else
      return CheckCode::Unknown(res ? "Unexpected HTTP status code: #{res.code}" : 'No response received from target')
    end
  end
Metasploit Module: Nanopool Claymore Dual Miner APIs RCE
Type: exploit
Path: modules/exploits/multi/misc/claymore_dual_miner_remote_manager_rce.rb
Platform: linux
Disclosure date: 2018-02-09
References: EDB-44638, CVE-2[PII_REDACTED], URL-http://web.archive.org/web/[PII_REDACTED]0426/https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution
Targets: Linux, Windows

Description:
This module takes advantage of miner remote manager APIs to exploit an RCE vulnerability.

Check method (fingerprinting):
target = select_target
    if target.nil?
      return Exploit::CheckCode::Safe('Unable to detect Claymore Dual Miner')
    end

    data = {
      'id' => 0,
      'jsonrpc' => '2.0',
      'method' => 'miner_getfile',
      'params' => ['config.txt']
    }.to_json
    connect
    sock.put(data)
    buf = sock.get_once || ''
    tmp = StringIO.new
    tmp << buf
    tmp2 = tmp.string
    hex = ''
    case target['Platform']
    when 'linux'
      hex = tmp2.scan(/\w+/)[5]
    when 'windows'
      hex = tmp2.scan(/\w+/)[7]
    end
    str = Rex::Text.hex_to_raw(hex)
    if str.include?('WARNING')
      return Exploit::CheckCode::Vulnerable('Response contains WARNING marker indicating command execution')
    else
      return Exploit::CheckCode::Detected('The target service was detected')
    end
  rescue Rex::AddressInUse, ::Errno::ETIMEDOUT, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, ::Timeout::Error, ::EOFError => e
    vprint_error(e.message)
    return Exploit::CheckCode::Unknown('Connection failed')
  ensure
    disconnect
  end
Metasploit Module: Zend Server Java Bridge Arbitrary Java Code Execution
Type: exploit
Path: modules/exploits/multi/misc/zend_java_bridge.rb
Platform: java
Disclosure date: 2011-03-28
References: OSVDB-71420, ZDI-11-113, EDB-17078

Description:
This module takes advantage of a trust relationship issue within the
          Zend Server Java Bridge. The Java Bridge is responsible for handling interactions
          between PHP and Java code within Zend Server.

          When Java code is encountered Zend Server communicates with the Java Bridge. The
          Java Bridge then handles the java code and creates the objects within the Java Virtual
          Machine. This interaction however, does not require any sort of authentication. This
          leaves the JVM wide open to remote attackers. Sending specially crafted data to the
          Java Bridge results in the execution of arbitrary java code.
Metasploit Module: FreeSWITCH Event Socket Command Execution
Type: exploit
Path: modules/exploits/multi/misc/freeswitch_event_socket_cmd_exec.rb
Platform: unix
Disclosure date: 2019-11-03
Authors: bcoles
References: CVE-2019-19492, URL-https://freeswitch.org/confluence/display/FREESWITCH/mod_event_socket
Targets: Unix (In-Memory), Linux (Dropper), PowerShell (In-Memory), Windows (In-Memory), Windows (Dropper)

Description:
This module uses the FreeSWITCH event socket interface
          to execute system commands using the `system` API command.

          The event socket service is enabled by default and listens
          on TCP port 8021 on the local network interface.

          This module has been tested successfully on FreeSWITCH versions:

          1.6.10-17-726448d~44bit on FreeSWITCH-Deb8-TechPreview virtual machine;
          1.8.4~64bit on Ubuntu 19.04 (x64); and
          1.10.1~64bit on Windows 7 SP1 (EN) (x64).

Check method (fingerprinting):
connect
    banner = sock.get_once.to_s
    disconnect

    if banner.include?('Access Denied, go away.') || banner.include?('text/rude-rejection')
      vprint_error 'Access denied by network ACL'
      return CheckCode::Safe('Access denied by network ACL')
    end

    unless banner.include?('Content-Type: auth/request')
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Appears('FreeSWITCH Event Socket responded to auth request')
  end
Metasploit Module: BMC Patrol Agent Privilege Escalation Cmd Execution
Type: exploit
Path: modules/exploits/multi/misc/bmc_patrol_cmd_exec.rb
Platform: win
Disclosure date: 2019-01-17
References: CVE-2018-20735, URL-https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin/
Targets: Generic Command Callback

Description:
This module leverages the remote command execution feature provided by
          the BMC Patrol Agent software. It can also be used to escalate privileges
          on Windows hosts as the software runs as SYSTEM but only verfies that the password
          of the provided user is correct. This also means if the software is running on a
          domain controller, it can be used to escalate from a normal domain user to domain
          admin as SYSTEM on a DC is DA. **WARNING** The windows version of this exploit uses
          powershell to execute the payload. The powershell version tends to timeout on
          the first run so it may take multiple tries.
Metasploit Module: TeamCity Agent XML-RPC Command Execution
Type: exploit
Path: modules/exploits/multi/misc/teamcity_agent_xmlrpc_exec.rb
Platform: win
Disclosure date: 2015-04-14
Authors: Dylan Pindur <dylanpindur@gmail.com>
References: URL-https://www.tenable.com/plugins/nessus/94675

Description:
This module allows remote code execution on TeamCity Agents configured
          to use bidirectional communication via xml-rpc. In bidirectional mode
          the TeamCity server pushes build commands to the Build Agents over port
          TCP/9090 without requiring authentication. Up until version 10 this was
          the default configuration. This module supports TeamCity agents from
          version 6.0 onwards.

Check method (fingerprinting):
version = determine_version
    if !version.nil? && version >= 15772
      Exploit::CheckCode::Appears("TeamCity agent version #{version} appears vulnerable")
    else
      Exploit::CheckCode::Safe("TeamCity agent does not appear vulnerable")
    end
  end
Metasploit Module: VSCode ipynb Remote Development RCE
Type: exploit
Path: modules/exploits/multi/misc/vscode_ipynb_remote_dev_exec.rb
Platform: win
Disclosure date: 2022-11-22
References: CVE-2022-41034, URL-https://github.com/andyhsu024/CVE-2022-41034

Description:
VSCode when opening an Jupyter notebook (.ipynb) file bypasses the trust model.
          On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed
          HTML and javascript, which can then open new terminal windows within VSCode.
          Each of these new windows can then execute arbitrary code at startup.

          During testing, the first open of the Jupyter notebook resulted in pop-ups
          displaying errors of unable to find the payload exe file. The second attempt
          at opening the Jupyter notebook would result in successful exeuction.

          Successfully tested against VSCode 1.70.2 on Windows 10.

Check method (fingerprinting):
CheckCode::Unsupported
  end
Metasploit Module: VERITAS NetBackup Remote Command Execution
Type: exploit
Path: modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb
Platform: %w{linux unix win}
Disclosure date: 2004-10-21
References: CVE-2004-1389, OSVDB-11026, BID-11494

Description:
This module allows arbitrary command execution on an
          ephemeral port opened by Veritas NetBackup, whilst an
          administrator is authenticated. The port is opened and
          allows direct console access as root or SYSTEM from
          any source address.

Check method (fingerprinting):
connect

    sploit = rand_text_alphanumeric(10)
    buf = "\x20\x20\x201\x20\x20\x20\x20\x20\x201\necho #{sploit}\n"

    sock.put(buf)
    banner = sock.get_once

    disconnect

    if banner.to_s.index(sploit)
      return Exploit::CheckCode::Vulnerable('Target executed the echo command successfully')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Metasploit RPC Console Command Execution
Type: exploit
Path: modules/exploits/multi/misc/msf_rpc_console.rb
Platform: ruby
Disclosure date: 2011-05-22
Authors: bcoles
References: URL-https://help.rapid7.com/metasploit/Content/api/rpc/overview.html, URL-https://community.rapid7.com/docs/DOC-1516
Targets: Ruby, Windows CMD, Unix CMD

Description:
This module connects to a specified Metasploit RPC server and
          uses the 'console.write' procedure to execute operating
          system commands. Valid credentials are required to access the
          RPC interface.

          This module has been tested successfully on Metasploit 4.15
          on Kali 1.0.6; Metasploit 4.14 on Kali 2017.1; and Metasploit
          4.14 on Windows 7 SP1.
Metasploit Module: HP Data Protector EXEC_INTEGUTIL Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/hp_data_protector_exec_integutil.rb
Platform: unix
Disclosure date: 2014-10-02
References: ZDI-14-344
Targets: Linux 64 bits / HP Data Protector 9, Windows 64 bits / HP Data Protector 9

Description:
This exploit abuses a vulnerability in the HP Data Protector. The vulnerability exists
          in the Backup client service, which listens by default on TCP/5555. The EXEC_INTEGUTIL
          request allows to execute arbitrary commands from a restricted directory. Since it
          includes a perl executable, it's possible to use an EXEC_INTEGUTIL packet to execute
          arbitrary code. On linux targets, the perl binary isn't on the restricted directory, but
          an EXEC_BAR packet can be used to access the perl binary, even in the last version of HP
          Data Protector for linux.  This module has been tested successfully on HP Data Protector
          9 over Windows 2008 R2 64 bits and CentOS 6 64 bits.

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    if fingerprint =~ /Data Protector A\.(\d+\.\d+)/
      version = $1
      vprint_status("Windows / HP Data Protector version #{version} found")
    elsif fingerprint =~ / INET/
      vprint_status("Linux / HP Data Protector found")
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target does not appear to be HP Data Protector')
    end

    if Rex::Version.new(version) <= Rex::Version.new('9')
      return Exploit::CheckCode::Appears("HP Data Protector version #{version} is vulnerable")
    end

    Exploit::CheckCode::Detected('There is no patch at the time of module writing')
  end
Metasploit Module: Apache ActiveMQ Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/apache_activemq_rce_cve_2023_46604.rb
Platform: win
Disclosure date: 2023-10-27
References: CVE-2023-46604, URL-https://github.com/X1r0z/ActiveMQ-RCE, URL-https://exp10it.cn/2023/10/apache-activemq-%E7%89%88%E6%9C%AC-5.18.3-rce-%E5%88%86%E6%9E%90/, URL-https://attackerkb.com/topics/IHsgZDE3tS/cve-2023-46604/rapid7-analysis, URL-https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt

Description:
This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache
          ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to
          5.16.6, and all versions before 5.15.16.

Check method (fingerprinting):
connect

    len = sock.timed_read(4)&.unpack1('N')

    return CheckCode::Unknown('Invalid or unexpected response length') if len.nil? || len > 0x2000 # upper limit in case the service isn't ActiveMQ

    res = sock.timed_read(len)

    disconnect

    return CheckCode::Unknown('No response received from target') unless res

    _, magic = res.unpack('CZ*')

    return CheckCode::Unknown('Response length mismatch') unless res.length == len

    return CheckCode::Unknown('Target is not an ActiveMQ service') unless magic == 'ActiveMQ'

    return CheckCode::Detected('ActiveMQ detected but version could not be determined') unless res =~ /ProviderVersion...(\d+\.\d+\.\d+)/

    version = Rex::Version.new(::Regexp.last_match(1))

    ranges = [
      ['5.18.0', '5.18.2'],
      ['5.17.0', '5.17.5'],
      ['5.16.0', '5.16.6'],
      ['0.0.0', '5.15.15']
    ]

    ranges.each do |min, max|
      if version.between?(Rex::Version.new(min), Rex::Version.new(max))
        return Exploit::CheckCode::Appears("Apache ActiveMQ #{version}")
      end
    end

    Exploit::CheckCode::Safe("Apache ActiveMQ #{version}")
  rescue ::Timeout::Error
    CheckCode::Unknown('Could not determine vulnerability status')
  end