deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ManageEngine ADSelfService Plus Custom Script Execution
Type: exploit
Path: modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2022_28810.rb
Platform: win
Disclosure date: 2022-04-09
References: CVE-2022-28810, URL-https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html, URL-https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-command-execution-fixed/
Targets: Windows Command

Description:
This module exploits the "custom script" feature of ADSelfService Plus. The
          feature was removed in build 6122 as part of the patch for CVE-2022-28810.
          For purposes of this module, a "custom script" is arbitrary operating system
          command execution.

          This module uses an attacker provided "admin" account to insert the malicious
          payload into the custom script fields. When a user resets their password or
          unlocks their account, the payload in the custom script will be executed.
          The payload will be executed as SYSTEM if ADSelfService Plus is installed as
          a service, which we believe is the normal operational behavior.

          This is a passive module because user interaction is required to trigger the
          payload. This module also does not automatically remove the malicious code from
          the remote target. Use the "TARGET_RESET" operation to remove the malicious
          custom script when you are done.

          ADSelfService Plus uses default credentials of "admin":"admin"

Check method (fingerprinting):
res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/selfservice/index.html'))
    unless res
      return CheckCode::Unknown('The target failed to respond to check.')
    end

    unless res.code == 200
      return CheckCode::Safe('Failed to retrieve /selfservice/index.html')
    end

    ver = res.body[/\.css\?buildNo=(?<build_id>[0-9]+)/, :build_id]
    if ver.nil?
      return CheckCode::Safe('Could not extract a version number')
    end

    if Rex::Version.new(ver) < Rex::Version.new('6122')
      return CheckCode::Appears("This determination is based on the version string: #{ver}.")
    end

    CheckCode::Safe("This determination is based on the version string: #{ver}.")
  end

  ##
  # Authenticate with the remote target. Login requires four steps:
  #
  # 1. Grab a CSRF token
  # 2. Post credentials to /ServletAPI/accounts/login
  # 3. Post credentials to /j_security_check
  # 4. Grab another CSRF token for authenticated requests
  #
  # @return a new CSRF token to use with authenticated requests
  ##
Metasploit Module: ManageEngine Desktop Central StatusUpdate Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb
Platform: win
Disclosure date: 2014-08-31
References: CVE-2014-5005, OSVDB-110643, URL-https://seclists.org/fulldisclosure/2014/Aug/88

Description:
This module exploits an arbitrary file upload vulnerability in ManageEngine DesktopCentral
          v7 to v9 build 90054 (including the MSP versions).
          A malicious user can upload a JSP file into the web root without authentication, leading to
          arbitrary code execution as SYSTEM. Some early builds of version 7 are not exploitable as
          they do not ship with a bundled Java compiler.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("configurations.do"),
      'method' => 'GET'
    })

    if res && res.code == 200
      build = nil

      if res.body.to_s =~ /ManageEngine Desktop Central 7/ ||
         res.body.to_s =~ /ManageEngine Desktop Central MSP 7/ # DC v7

        print_status("Detected Desktop Central v7")
      elsif res.body.to_s =~ /ManageEngine Desktop Central 8/ ||
            res.body.to_s =~ /ManageEngine Desktop Central MSP 8/

        if res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/  # DC v8 (later versions)
          build = $1
          print_status("Detected Desktop Central v8 #{build}")
        else                                                     # DC v8 (earlier versions)
          print_status("Detected Desktop Central v8")
        end
      elsif res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/ # DC v9 (and higher?)
        build = $1
      end

      if build.nil?
        return Exploit::CheckCode::Unknown('Could not determine the target status')
      elsif Rex::Version.new(build) < Rex::Version.new("90055")
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{build}")
      else
        return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{build}")
      end
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Ivanti EPM RecordGoodApp SQLi RCE
Type: exploit
Path: modules/exploits/windows/http/ivanti_epm_recordgoodapp_sqli_rce.rb
Platform: windows
Disclosure date: 2024-05-24
References: URL-https://forums.ivanti.com/s/article/Security-Advisory-May-2024, URL-https://www.zerodayinitiative.com/advisories/ZDI-24-507, URL-https://github.com/horizon3ai/CVE-2024-29824, URL-https://www.horizon3.ai/attack-research/attack-blogs/cve-2024-29824-deep-dive-ivanti-epm-sql-injection-remote-code-execution-vulnerability/, CVE-2024-29824

Description:
Ivanti Endpoint Manager (EPM) 2022 SU5 and prior are vulnerable to unauthenticated SQL injection which can be leveraged to achieve unauthenticated remote code execution.

Check method (fingerprinting):
print_status("Checking if the target is vulnerable using time-based SQLi (delay=#{datastore['DELAY']})")

    _res, elapsed1 = Rex::Stopwatch.elapsed_time { soap_request("';WAITFOR DELAY '0:0:0';select 1--") }
    vprint_status("Baseline query elapsed time: #{elapsed1}")

    _res, elapsed2 = Rex::Stopwatch.elapsed_time { soap_request("';WAITFOR DELAY '0:0:#{datastore['DELAY']}';select 2--") }
    vprint_status("Delayed query elapsed time: #{elapsed2}")

    if elapsed2.to_i > elapsed1.to_i && elapsed2 >= datastore['DELAY']
      return CheckCode::Vulnerable('SQLi executed')
    else
      return CheckCode::Safe('SQLi not executed')
    end
  rescue IvantiEpmRequestError => e
    return CheckCode::Unknown(e.to_s)
  end
Metasploit Module: ManageEngine ADSelfService Plus CVE-2021-40539
Type: exploit
Path: modules/exploits/windows/http/manageengine_adselfservice_plus_cve_2021_40539.rb
Platform: java
Disclosure date: 2021-09-07
References: CVE-2021-40539, URL-https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html, URL-https://attackerkb.com/topics/DMSNq5zgcW/cve-2021-40539/rapid7-analysis, URL-https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html, URL-https://github.com/synacktiv/CVE-2021-40539/blob/main/exploit.py

Description:
This module exploits CVE-2021-40539, a REST API authentication bypass
          vulnerability in ManageEngine ADSelfService Plus, to upload a JAR and
          execute it as the user running ADSelfService Plus - which is SYSTEM if
          started as a service.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, '/RestAPI/LogonCustomization'),
      'vars_post' => {
        'methodToCall' => 'previewMobLogo'
      }
    )

    unless res
      return CheckCode::Unknown('Target failed to respond to check.')
    end

    unless res.code == 200 && res.body.match?(%r{mobLogo.*/temp/tempMobPreview\.jpeg})
      return CheckCode::Safe('Failed to bypass REST API authentication.')
    end

    CheckCode::Vulnerable('Successfully bypassed REST API authentication.')
  end
Metasploit Module: HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_toolbar_01.rb
Platform: win
Disclosure date: 2009-01-07
References: CVE-2008-0067, OSVDB-53222, BID-33147

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
          By sending a specially crafted CGI request to Toolbar.exe, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Adobe RoboHelp Server 8 Arbitrary File Upload and Execute
Type: exploit
Path: modules/exploits/windows/http/adobe_robohelper_authbypass.rb
Platform: win
Disclosure date: 2009-09-23
References: CVE-2009-3068, OSVDB-57896, URL-http://www.intevydis.com/blog/?p=69, ZDI-09-066
Targets: Universal Windows Target

Description:
This module exploits an authentication bypass vulnerability which
          allows remote attackers to upload and execute arbitrary code.
Metasploit Module: Novell eDirectory NDS Server Host Header Overflow
Type: exploit
Path: modules/exploits/windows/http/edirectory_host.rb
Platform: win
Disclosure date: 2006-10-21
Authors: MC
References: CVE-2006-5478, OSVDB-29993, BID-20655

Description:
This module exploits a stack buffer overflow in Novell eDirectory 8.8.1.
          The web interface does not validate the length of the
          HTTP Host header prior to using the value of that header in an
          HTTP redirect.
Metasploit Module: Streamcast HTTP User-Agent Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/steamcast_useragent.rb
Platform: win
Disclosure date: 2008-01-24
References: CVE-2008-0550, OSVDB-42670, URL-http://aluigi.altervista.org/adv/steamcazz-adv.txt, BID-33898

Description:
This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending
          an overly long User-Agent in an HTTP GET request, an attacker may be able to
          execute arbitrary code.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.0\r\n\r\n")
    res = sock.get_once
    disconnect

    if (res.to_s =~ /Steamcast\/0\.9\.75/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: ManageEngine ADAudit Plus CVE-2022-28219
Type: exploit
Path: modules/exploits/windows/http/manageengine_adaudit_plus_cve_2022_28219.rb
Platform: win
Disclosure date: 2022-06-29
References: CVE-2022-28219, URL-https://www.horizon3.ai/red-team-blog-cve-2022-28219/, URL-https://attackerkb.com/topics/Zx3qJlmRGY/cve-2022-28219/rapid7-analysis, URL-https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html
Targets: Windows Command

Description:
This module exploits CVE-2022-28219, which is a pair of
          vulnerabilities in ManageEngine ADAudit Plus versions before build
          7060: a path traversal in the /cewolf endpoint, and a blind XXE in,
          to upload and execute an executable file.

Check method (fingerprinting):
# Make sure it's ADAudit Plus by requesting the root and checking the title
    res1 = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    unless res1
      return CheckCode::Unknown('Target failed to respond to check.')
    end

    unless res1.code == 200 && res1.body.match?(/<title>ADAudit Plus/)
      return CheckCode::Safe('Does not appear to be ADAudit Plus')
    end

    # Check if it's a vulnerable version (the patch removes the /cewolf endpoint
    # entirely)
    res2 = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri("#{datastore['TARGETURI_DESERIALIZATION']}?img=abc")
    )

    unless res2
      return CheckCode::Unknown('Target failed to respond to check.')
    end

    unless res2.code == 200
      return CheckCode::Safe('Target does not have vulnerable endpoint (likely patched).')
    end

    CheckCode::Vulnerable('The vulnerable endpoint responds with HTTP/200.')
  end
Metasploit Module: MaxDB WebDBM Database Parameter Overflow
Type: exploit
Path: modules/exploits/windows/http/maxdb_webdbm_database.rb
Platform: win
Disclosure date: 2006-08-29
References: CVE-2006-4305, OSVDB-28300, BID-19660

Description:
This module exploits a stack buffer overflow in the MaxDB WebDBM
          service. By sending a specially-crafted HTTP request that contains
          an overly long database name. A remote attacker could overflow a buffer
          and execute arbitrary code on the system with privileges of the wahttp process.

          This module has been tested against MaxDB 7.6.00.16 and MaxDB 7.6.00.27.
Metasploit Module: Trend Micro OfficeScan Remote Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/trendmicro_officescan.rb
Platform: win
Disclosure date: 2007-06-28
References: CVE-2008-1365, OSVDB-42499

Description:
This module exploits a stack buffer overflow in Trend Micro OfficeScan
          cgiChkMasterPwd.exe (running with SYSTEM privileges).
Metasploit Module: SharePoint Workflows XOML Injection
Type: exploit
Path: modules/exploits/windows/http/sharepoint_workflows_xoml.rb
Platform: win
Disclosure date: 2020-03-02
References: CVE-2020-0646, URL-https://www.mdsec.co.uk/2020/01/code-injection-in-workflows-leading-to-sharepoint-rce-cve-2020-0646/
Targets: Windows EXE Dropper, Windows Command, Windows Powershell

Description:
This module exploits a vulnerability within SharePoint and its .NET backend
          that allows an attacker to execute commands using specially crafted XOML data
          sent to SharePoint via the Workflows functionality.

Check method (fingerprinting):
res = execute_command("echo #{Rex::Text.rand_text_alphanumeric(rand(4..11))}")
    return CheckCode::Unknown('Did not receive an HTTP 200 OK response') unless res&.code == 200

    compiler_errors = extract_compiler_errors(res)
    return CheckCode::Unknown('No compiler errors were reported') unless compiler_errors&.length&.> 0

    # once patched you get a specific compiler error message about the type name
    return CheckCode::Safe('Target appears to be patched') if compiler_errors[0].to_s =~ /is not a valid language-independent type name/

    CheckCode::Vulnerable('Target is vulnerable')
  end
Metasploit Module: Oracle Weblogic Apache Connector POST Request Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/bea_weblogic_post_bof.rb
Platform: win
Disclosure date: 2008-07-17
References: CVE-2008-3257, OSVDB-47096, BID-30273

Description:
This module exploits a stack based buffer overflow in the BEA
          Weblogic Apache plugin.

          The connector fails to properly handle specially crafted HTTP POST
          requests, resulting a buffer overflow due to the insecure usage
          of sprintf.  Currently, this module works over Windows systems without DEP,
          and has been tested with Windows 2000 / XP.

          In addition, the Weblogic Apache plugin version is fingerprinted with a POST
          request containing a specially crafted Transfer-Encoding header.

Check method (fingerprinting):
fingerprint = fingerprint_mod_wl
    print_status "#{rhost}:#{rport} - #{fingerprint}"

    case fingerprint
    when /Version found/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    when /BEA WebLogic connector vulnerable/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    when /BEA WebLogic connector undefined/
      return Exploit::CheckCode::Detected('Target service detected')
    when /BEA WebLogic connector no vulnerable/, /BEA WebLogic connector not found/
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Sharepoint Dynamic Proxy Generator Unauth RCE
Type: exploit
Path: modules/exploits/windows/http/sharepoint_dynamic_proxy_generator_auth_bypass_rce.rb
Platform: win
Disclosure date: 2023-05-01
References: URL-https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-server-2019-may-9-2023-kb5002389-e2b77a46-2946-495f-8948-8abdc44aacc3, URL-https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-server-2019-june-13-2023-kb5002402-c5d58925-f7be-4d16-a61b-8ce871bbe34d, URL-https://testbnull.medium.com/p2o-vancouver-2023-v%C3%A0i-d%C3%B2ng-v%E1%BB%81-sharepoint-pre-auth-rce-chain-cve-2023-29357-cve-2023-24955-ed97dcab131e, CVE-2023-29357, CVE-2023-24955
Targets: Windows Command

Description:
This module exploits two vulnerabilities in Sharepoint 2019, an auth bypass CVE-2023-29357 which was patched
          in June of 2023 and CVE-2023-24955, an RCE which was patched in May of 2023.

          The auth bypass allows attackers to impersonate the Sharepoint Admin user. This vulnerability stems from the
          signature validation check used to verify JSON Web Tokens (JWTs) used for OAuth authentication. If the signing
          algorithm of the user-provided JWT is set to none, SharePoint skips the signature validation step due to a logic
          flaw in the ReadTokenCore() method.

          After impersonating the administrator user, the attacker has access to the Sharepoint API and is able to
          exploit CVE-2023-24955. This authenticated RCE vulnerability leverages the impersonated privileged account to
          replace the "/BusinessDataMetadataCatalog/BDCMetadata.bdcm" file in the webroot directory with a payload. The
          payload is then compiled and executed by Sharepoint allowing attackers to remotely execute commands via the API.

Check method (fingerprinting):
version = sharepoint_get_version
    return CheckCode::Unknown('Could not determine the Sharepoint version') if version.nil?

    print_status("Sharepoint version detected: #{version}")

    begin
      CheckCode::Vulnerable('Authentication was successfully bypassed via CVE-2023-29357 indicating this target is vulnerable to RCE via CVE-2023-24955.') if do_auth_bypass
    rescue SharepointInvalidResponseError => e
      return CheckCode::Safe(e)
    end
  end
Metasploit Module: Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/amlibweb_webquerydll_app.rb
Platform: win
Disclosure date: 2010-08-03
References: CVE-2010-20112, OSVDB-66814, BID-42293, URL-http://www.aushack.com/advisories/

Description:
This module exploits a stack buffer overflow in Amlib's Amlibweb
          Library Management System (NetOpacs). The webquery.dll
          API is available through IIS requests. By specifying
          an overly long string to the 'app' parameter, SeH can be
          reliably overwritten allowing for arbitrary remote code execution.
          In addition, it is possible to overwrite EIP by specifying
          an arbitrary parameter name with an '=' terminator.

Check method (fingerprinting):
connect

    rand = Rex::Text.rand_text_alpha(10)

    sock.put("GET /amlibweb/webquery.dll?#{rand}= HTTP/1.0\r\n\r\n")
    res = sock.get_once
    disconnect

    if (res.to_s =~ /<H1>BAD REQUEST<\/H1><P>Your client sent a request that this server didn't understand.<br>Request:\s(\w+)/)
      if ($1 == rand)
        return Exploit::CheckCode::Vulnerable('Target is vulnerable')
      end
    end
    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Apache Win32 Chunked Encoding
Type: exploit
Path: modules/exploits/windows/http/apache_chunked.rb
Platform: win
Disclosure date: 2002-06-19
References: CVE-2002-0392, OSVDB-838, BID-5033

Description:
This module exploits the chunked transfer integer wrap
          vulnerability in Apache version 1.2.x to 1.3.24. This
          particular module has been tested with all versions of the
          official Win32 build between 1.3.9 and 1.3.24. Additionally,
          it should work against most co-branded and bundled versions
          of Apache (Oracle 8i, 9i, IBM HTTPD, etc).

          You will need to use the Check() functionality to determine
          the exact target version prior to launching the exploit. The
          version of Apache bundled with Oracle 8.1.7 will not
          automatically restart, so if you use the wrong target value,
          the server will crash.

Check method (fingerprinting):
response = send_request_raw({ 'uri' => '/' }, 5)
    if response.nil?
      vprint_status("No response to request")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    http_fingerprint({ :response => response })  # Custom Server header matching

    code = Exploit::CheckCode::Appears('Target appears to be vulnerable')

    case response['Server']
    when "Oracle HTTP Server Powered by Apache/1.3.12 (Win32) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22"
      vprint_status("This looks like an Oracle 8.1.7 Apache service (one-shot only)")
    when "Oracle HTTP Server Powered by Apache/1.3.12 (Win32) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.24"
      vprint_status("This looks like an Oracle 9.1.0 Apache service (multiple tries allowed)")
    when "Oracle HTTP Server Powered by Apache/1.3.22 (Win32) mod_plsql/3.0.9.8.3b mod_ssl/2.8.5 OpenSSL/0.9.6b mod_fastcgi/2.2.12 mod_oprocmgr/1.0 mod_perl/1.25"
      vprint_status("This looks like an Oracle 9.2.0 Apache service (multiple tries allowed)")
    when /IBM_HTTP_SERVER\/1\.3\.(19\.[3-9]|2[0-9]\.)/
      vprint_status("IBM backported the patch, this system is not vulnerable")
      code = Exploit::CheckCode::Safe('Target is not vulnerable')
    when /Apache(-AdvancedExtranetServer)?\/(1\.([0-2]\.[0-9]|3\.([0-9][^0-9]|[0-1][0-9]|2[0-5]))|2\.0.([0-9][^0-9]|[0-2][0-9]|3[0-8]))/
    else
      code = Exploit::CheckCode::Safe('Target is not vulnerable')
    end
Metasploit Module: GitStack Unsanitized Argument RCE
Type: exploit
Path: modules/exploits/windows/http/gitstack_rce.rb
Platform: win
Disclosure date: 2018-01-15
References: CVE-2018-5955, EDB-43777, EDB-44044, URL-https://security.szurek.pl/gitstack-2310-unauthenticated-rce.html

Description:
This module exploits a remote code execution vulnerability that
          exists in GitStack through v2.3.10, caused by an unsanitized argument
          being passed to an exec function call. This module has been tested
          on GitStack v2.3.10.
Metasploit Module: Lexmark MarkVision Enterprise Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/lexmark_markvision_gfd_upload.rb
Platform: win
Disclosure date: 2014-12-09
References: CVE-2014-8741, ZDI-14-410, URL-http://support.lexmark.com/index?page=content&id=TE666&locale=EN&userlocale=EN_US

Description:
This module exploits a code execution flaw in Lexmark MarkVision Enterprise before version 2.1.
          A directory traversal vulnerability in the GfdFileUploadServlet servlet allows an unauthenticated
          attacker to upload arbitrary files, including arbitrary JSP code. This module has been
          tested successfully on Lexmark MarkVision Enterprise 2.0 with Windows 2003 SP2.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path.to_s, 'mve', 'help', 'en', 'inventory', 'am_about.html')
    })

    version = nil
    if res && res.code == 200 && res.body && res.body.to_s =~ /MarkVision Enterprise ([\d\.]+)/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if Rex::Version.new(version) <= Rex::Version.new('2.0.0')
      return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end