deardaniel/secdata-raw huggingface dataset:
Metasploit Module: DoubleTake/HP StorageWorks Storage Mirroring Service Authentication Overflow
Type: exploit
Path: modules/exploits/windows/misc/doubletake.rb
Platform: win
Disclosure date: 2008-06-04
References: CVE-2008-1661, OSVDB-45924

Description:
This module exploits a stack buffer overflow in the authentication mechanism of
          NSI Doubletake which is also rebranded as HP Storage Works. This vulnerability
          was found by Titon of Bastard Labs.
Metasploit Module: CloudMe Sync v1.10.9
Type: exploit
Path: modules/exploits/windows/misc/cloudme_sync.rb
Platform: win
Disclosure date: 2018-01-17
References: CVE-2018-6892, EDB-44027

Description:
This module exploits a stack-based buffer overflow vulnerability
          in CloudMe Sync v1.10.9 client application. This module has been
          tested successfully on Windows 7 SP1 x86.
Metasploit Module: eIQNetworks ESA Topology DELETEDEVICE Overflow
Type: exploit
Path: modules/exploits/windows/misc/eiqnetworks_esa_topology.rb
Platform: win
Disclosure date: 2006-07-25
Authors: MC
References: CVE-2006-3838, OSVDB-27528, BID-19164

Description:
This module exploits a stack buffer overflow in eIQnetworks
          Enterprise Security Analyzer. During the processing of
          long arguments to the DELETEDEVICE command in the Topology
          server, a stack-based buffer overflow occurs.

          This module has only been tested against ESA v2.1.13.
Metasploit Module: HPE iMC dbman RestoreDBase Unauthenticated RCE
Type: exploit
Path: modules/exploits/windows/misc/hp_imc_dbman_restoredbase_unauth_rce.rb
Platform: win
Disclosure date: 2017-05-15
References: CVE-2017-5817, EDB-43195, ZDI-17-341, BID-98469, URL-https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03745en_us

Description:
This module exploits a remote command execution vulnerablity in
          Hewlett Packard Enterprise Intelligent Management Center before
          version 7.3 E0504P04.

          The dbman service allows unauthenticated remote users to restore
          a user-specified database (OpCode 10007), however the database
          connection username is not sanitized resulting in command injection,
          allowing execution of arbitrary operating system commands as SYSTEM.
          This service listens on TCP port 2810 by default.

          This module has been tested successfully on iMC PLAT v7.2 (E0403)
          on Windows 7 SP1 (EN).

Check method (fingerprinting):
# empty RestoreDBase packet
    pkt = [10007].pack('N')

    connect
    sock.put pkt
    res = sock.get_once
    disconnect

    # Expected reply:
    # "\x00\x00\x00\x01\x00\x00\x00:08\x02\x01\xFF\x043Dbman deal msg error, please to see dbman_debug.log"
    return CheckCode::Detected('HP IMC dbman service detected') if res =~ /dbman/i

    CheckCode::Safe('HP IMC dbman service not detected')
  end
Metasploit Module: POP Peeper v3.4 UIDL Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/poppeeper_uidl.rb
Platform: win
Disclosure date: 2009-02-27
References: OSVDB-53559, CVE-2009-1029, BID-33926

Description:
This module exploits a stack buffer overflow in POP Peeper v3.4.
          When a specially crafted UIDL string is sent to a client,
          an attacker may be able to execute arbitrary code. This
          module is based off of krakowlabs code.
Metasploit Module: Wifi Mouse RCE
Type: exploit
Path: modules/exploits/windows/misc/wifi_mouse_rce.rb
Platform: win
Disclosure date: 2021-02-25
References: EDB-50972, EDB-49601, CVE-2022-3218, URL-http://wifimouse.necta.us/, URL-https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py

Description:
The WiFi Mouse (Mouse Server) from Necta LLC contains an auth bypass as the
          authentication is completely implemented entirely on the client side. By utilizing
          this vulnerability, is possible to open a program on the server
          (cmd.exe in our case) and type commands that will be executed as the user running
          WiFi Mouse (Mouse Server), resulting in remote code execution.

          Tested against versions 1.8.3.4 (current as of module writing) and
          1.8.2.3.
Metasploit Module: IBM Cognos tm1admsd.exe Overflow
Type: exploit
Path: modules/exploits/windows/misc/ibm_cognos_tm1admsd_bof.rb
Platform: win
Disclosure date: 2012-04-02
References: CVE-2012-0202, OSVDB-80876, BID-52847, ZDI-12-101, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21590314

Description:
This module exploits a stack buffer overflow in IBM Cognos Analytic Server
          Admin service. The vulnerability exists in the tm1admsd.exe component, due to a
          dangerous copy of user controlled data to the stack, via memcpy, without validating
          the supplied length and data. The module has been tested successfully on IBM Cognos
          Express 9.5 over Windows XP SP3.
Metasploit Module: GIMP script-fu Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/gimp_script_fu.rb
Platform: win
Disclosure date: 2012-05-18
References: CVE-2012-2763, OSVDB-82429, BID-53741, EDB-18956, URL-http://www.reactionpenetrationtesting.co.uk/advisories/scriptfu-buffer-overflow-GIMP-2.6.html

Description:
This module exploits a buffer overflow in the script-fu server
          component on GIMP <= 2.6.12. By sending a specially crafted packet, an
          attacker may be able to achieve remote code execution under the context
          of the user.

          This module has been tested on GIMP for Windows from installers
          provided by Jernej Simoncic.
Metasploit Module: Nvidia Mental Ray Satellite Service Arbitrary DLL Injection
Type: exploit
Path: modules/exploits/windows/misc/nvidia_mental_ray.rb
Platform: win
Disclosure date: 2013-12-10
References: URL-http://revuln.com/files/ReVuln_NVIDIA_mental_ray.pdf, OSVDB-100827
Targets: Windows x64

Description:
The Nvidia Mental Ray Satellite Service listens for control commands on port 7414.
          When it receives the command to load a DLL (via an UNC path) it will try to
          connect back to the host on port 7514. If a TCP connection is successful it will
          then attempt to load the DLL. This module has been tested successfully on Win7 x64
          with Nvidia Mental Ray Satellite Service v3.11.1.
Metasploit Module: Realtek Media Player Playlist Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/realtek_playlist.rb
Platform: win
Disclosure date: 2008-12-16
References: CVE-2008-5664, OSVDB-50715, BID-32860

Description:
This module exploits a stack buffer overflow in Realtek Media Player(RtlRack) A4.06.
          When a Realtek Media Player client opens a specially crafted playlist, an
          attacker may be able to execute arbitrary code.
Metasploit Module: BigAnt Server 2.50 SP1 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/bigant_server_250.rb
Platform: win
Disclosure date: 2008-04-15
References: CVE-2008-1914, OSVDB-44454, EDB-9673, EDB-9690

Description:
This exploits a stack buffer overflow in the BigAnt Messaging Service,
          part of the BigAnt Server product suite. This module was tested
          successfully against version 2.50 SP1.
Metasploit Module: Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020006 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/citrix_streamprocess_get_objects.rb
Platform: win
Disclosure date: 2011-11-04
References: OSVDB-75780, BID-49803, URL-http://support.citrix.com/article/CTX130846, ZDI-12-010

Description:
This module exploits a remote buffer overflow in the Citrix Provisioning Services
          5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode
          0x40020006 (GetObjetsRequest) to the 6905/UDP port. The module, which allows code execution
          under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP2
          and Windows XP SP3.
Metasploit Module: Mercury/32 PH Server Module Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/mercury_phonebook.rb
Platform: win
Disclosure date: 2005-12-19
Authors: MC
References: CVE-2005-4411, OSVDB-22103, BID-16396

Description:
This module exploits a stack-based buffer overflow in
          Mercury/32 <= v4.01b PH Server Module. This issue is
          due to a failure of the application to properly bounds check
          user-supplied data prior to copying it to a fixed size memory buffer.
Metasploit Module: HP Data Protector Backup Client Service Remote Code Execution
Type: exploit
Path: modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
Platform: win
Disclosure date: 2014-01-02
References: CVE-2013-2347, BID-64647, ZDI-14-008, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422, URL-http://ddilabs.blogspot.com/2014/02/fun-with-hp-data-protector-execbar.html

Description:
This module abuses the Backup Client Service (OmniInet.exe) to achieve remote code
          execution. The vulnerability exists in the EXEC_BAR operation, which allows to
          execute arbitrary processes. This module has been tested successfully on HP Data
          Protector 6.20 on Windows 2003 SP2 and Windows 2008 R2.

Check method (fingerprinting):
fingerprint = get_fingerprint

    if fingerprint.nil?
      return Exploit::CheckCode::Unknown('Unable to fingerprint target')
    end

    print_status("HP Data Protector version #{fingerprint}")

    if fingerprint =~ /HP Data Protector A\.06\.(\d+)/
      minor = $1.to_i
    else
      return Exploit::CheckCode::Safe("#{fingerprint} is not a vulnerable version")
    end

    if minor < 21
      return Exploit::CheckCode::Appears("HP Data Protector A.06.#{minor} appears vulnerable")
    elsif minor == 21
      return Exploit::CheckCode::Detected("HP Data Protector A.06.#{minor} detected")
    else
      return Exploit::CheckCode::Detected("HP Data Protector A.06.#{minor} detected")
    end
  end
Metasploit Module: Netcat v1.10 NT Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/netcat110_nt.rb
Platform: win
Disclosure date: 2004-12-27
Authors: aushack
References: CVE-2004-1317, OSVDB-12612, BID-12106, EDB-726

Description:
This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending
          an overly long string we are able to overwrite SEH. The vulnerability
          exists when netcat is used to bind (-e) an executable to a port in doexec.c.
          This module tested successfully using "c:\>nc -L -p 31337 -e ftp".
Metasploit Module: CoCSoft StreamDown 6.8.0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/stream_down_bof.rb
Platform: win
Disclosure date: 2011-12-27
Authors: Fady Mohamed Osman <fady.mohamed.osman[at]gmail.com>
References: CVE-2011-5052, OSVDB-78043, BID-51190, URL-http://www.dark-masters.tk/, URL-http://web.archive.org/web/[PII_REDACTED]1958/http://secunia.com/advisories/47343, EDB-18283

Description:
Stream Down 6.8.0 seh based buffer overflow triggered when processing
          the server response packet. During the overflow a structured exception
          handler is overwritten.
Metasploit Module: ShixxNOTE 6.net Font Field Overflow
Type: exploit
Path: modules/exploits/windows/misc/shixxnote_font.rb
Platform: win
Disclosure date: 2004-10-04
Authors: MC
References: CVE-2004-1595, OSVDB-10721, BID-11409

Description:
This module exploits a buffer overflow in ShixxNOTE 6.net.
          The vulnerability is caused due to boundary errors in the
          handling of font fields.
Metasploit Module: Borland Interbase Create-Request Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/borland_interbase.rb
Platform: win
Disclosure date: 2007-07-24
Authors: MC
References: CVE-2007-3566, OSVDB-38602, URL-http://dvlabs.tippingpoint.com/advisory/TPTI-07-13

Description:
This module exploits a stack buffer overflow in Borland Interbase 2007.
          By sending a specially crafted create-request packet, a remote
          attacker may be able to execute arbitrary code.
Metasploit Module: Citrix Provisioning Services 5.6 SP1 Streamprocess Opcode 0x40020002 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/citrix_streamprocess_get_footer.rb
Platform: win
Disclosure date: 2011-11-04
References: OSVDB-75780, BID-49803, URL-http://support.citrix.com/article/CTX130846

Description:
This module exploits a remote buffer overflow in the Citrix Provisioning Services
          5.6 SP1 (without Hotfix CPVS56SP1E043) by sending a malformed packet with the opcode
          0x40020002 (GetFooterRequest) to the 6905/UDP port. The module, which allows code execution
          under the context of SYSTEM, has been successfully tested on Windows Server 2003 SP2
          and Windows XP SP3.
Metasploit Module: BakBone NetVault Remote Heap Overflow
Type: exploit
Path: modules/exploits/windows/misc/bakbone_netvault_heap.rb
Platform: win
Disclosure date: 2005-04-01
References: CVE-2005-1009, OSVDB-15234, BID-12967

Description:
This module exploits a heap overflow in the BakBone NetVault
          Process Manager service. This code is a direct port of the netvault.c
          code written by nolimit and BuzzDee.

Check method (fingerprinting):
connect

    hname = "METASPLOIT"
    probe =
      "\xc9\x00\x00\x00\x01\xcb\x22\x77\xc9\x17\x00\x00\x00\x69\x3b\x69" +
      "\x3b\x69\x3b\x69\x3b\x69\x3b\x69\x3b\x69\x3b\x69\x3b\x69\x3b\x69" +
      "\x3b\x73\x3b\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00\x00" +
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00" +
      "\x03\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00" +
      [ hname.length + 1 ].pack('V') + hname + "\x00"
    probe += "\x00" * (201 - probe.length)

    sock.put(probe)
    res = sock.get_once(1, 10)

    off = (res || '').index("NVBuild")

    if off
      off += 21
      ver = res[off + 4, res[off, 4].unpack('V')[0]].to_i

      if ver > 0
        print_status("Detected NetVault Build #{ver}")
        return Exploit::CheckCode::Appears("Detected NetVault Build #{ver}")
      end
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Commvault Communications Service (cvd) Command Injection
Type: exploit
Path: modules/exploits/windows/misc/commvault_cmd_exec.rb
Platform: win
Disclosure date: 2017-12-12
References: CVE-2017-18044, URL-https://www.securifera.com/advisories/sec-2017-0001/

Description:
This module exploits a command injection vulnerability
          discovered in Commvault Service v11 SP5 and earlier versions (tested in v11 SP5
          and v10). The vulnerability exists in the cvd.exe service and allows an
          attacker to execute arbitrary commands in the context of the service. By
          default, the Commvault Communications service installs and runs as SYSTEM in
          Windows and does not require authentication. This vulnerability was discovered
          in the Windows version. The Linux version wasn't tested.
Metasploit Module: SolarWinds Information Service (SWIS) .NET Deserialization From AMQP RCE
Type: exploit
Path: modules/exploits/windows/misc/solarwinds_amqp_deserialization.rb
Platform: win
Disclosure date: 2022-10-19
References: CVE-2022-38108, URL-https://www.zerodayinitiative.com/blog/2023/2/27/cve-2022-38108-rce-in-solarwinds-network-performance-monitor, URL-https://www.solarwinds.com/trust-center/security-advisories/cve-2022-38108

Description:
The SolarWinds Information Service (SWIS) is vulnerable to RCE by way of a crafted message received through the
        AMQP message queue. A malicious user that can authenticate to the AMQP service can publish such a crafted
        message whose body is a serialized .NET object which can lead to OS command execution as NT AUTHORITY\SYSTEM.
Metasploit Module: Gh0st Client buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/gh0st.rb
Platform: win
Disclosure date: 2017-07-27
Authors: Professor Plum

Description:
This module exploits a Memory buffer overflow in the Gh0st client (C2 server)

Check method (fingerprinting):
connect
    sock.put(make_packet(101, "\x00")) # heartbeat
    if validate_response(sock.get_once || '')
      return Exploit::CheckCode::Appears('Gh0st RAT C&C server detected')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: NetTransport Download Manager 2.90.510 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/nettransport.rb
Platform: win
Disclosure date: 2010-01-02
References: CVE-2017-17968, OSVDB-61435, EDB-10911

Description:
This exploits a stack buffer overflow in NetTransport Download Manager,
          part of the NetXfer suite. This module was tested
          successfully against version 2.90.510.
Metasploit Module: Borland InterBase isc_create_database() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ib_isc_create_database.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38606, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted create request.
Metasploit Module: ALLMediaServer 0.8 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/allmediaserver_bof.rb
Platform: win
Disclosure date: 2012-07-04
References: CVE-2017-17932, OSVDB-83889, EDB-19625

Description:
This module exploits a stack buffer overflow in ALLMediaServer 0.8. The vulnerability
          is caused due to a boundary error within the handling of HTTP request.

          While the exploit supports DEP bypass via ROP, on Windows 7 the stack pivoting isn't
          reliable across virtual (VMWare, VirtualBox) and physical environments. Because of
          this the module isn't using DEP bypass on the Windows 7 SP1 target, where by default
          DEP is OptIn and AllMediaServer won't run with DEP.
Metasploit Module: DLL Side Loading Vulnerability in VMware Host Guest Client Redirector
Type: exploit
Path: modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb
Platform: win
Disclosure date: 2016-08-05
Authors: Yorick Koster
References: CVE-2016-5330, URL-https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.html, URL-https://www.vmware.com/in/security/advisories/VMSA-2016-0010.html
Targets: Windows x64, Windows x86

Description:
A DLL side loading vulnerability was found in the VMware Host Guest Client Redirector,
          a component of VMware Tools. This issue can be exploited by luring a victim into
          opening a document from the attacker's share. An attacker can exploit this issue to
          execute arbitrary code with the privileges of the target user. This can potentially
          result in the attacker taking complete control of the affected system. If the WebDAV
          Mini-Redirector is enabled, it is possible to exploit this issue over the internet.
Metasploit Module: Firebird Relational Database isc_create_database() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/fb_isc_create_database.rb
Platform: win
Disclosure date: 2007-10-03
References: CVE-2007-5243, OSVDB-38606, BID-25917, URL-http://www.risesecurity.org/advisories/RISE-2007002.txt

Description:
This module exploits a stack buffer overflow in Borland InterBase
          by sending a specially crafted create request.
Metasploit Module: Remote Control Collection RCE
Type: exploit
Path: modules/exploits/windows/misc/remote_control_collection_rce.rb
Platform: win
Disclosure date: 2022-09-20
References: CVE-2022-4978, URL-http://remote-control-collection.com, URL-https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/remote%20control%20collection/remote-control-collection-rce.py

Description:
This module utilizes the Remote Control Server's, part
          of the Remote Control Collection by Steppschuh, protocol
          to deploy a payload and run it from the server.  This module will only deploy
          a payload if the server is set without a password (default).
          Tested against 3.1.1.12, current at the time of module writing

Check method (fingerprinting):
@check_run = true
    @check_success = false
    upload_file
    return Exploit::CheckCode::Vulnerable('Target connected back to our server') if @check_success

    return Exploit::CheckCode::Safe('Target did not connect back')
  end
Metasploit Module: Veeam ONE Agent .NET Deserialization
Type: exploit
Path: modules/exploits/windows/misc/veeam_one_agent_deserialization.rb
Platform: win
Disclosure date: 2020-04-15
References: CVE-2020-10914, CVE-2020-10915, ZDI-20-545, ZDI-20-546, URL-https://www.veeam.com/kb3144
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a .NET deserialization vulnerability in the Veeam
          ONE Agent before the hotfix versions 9.5.5.4587 and 10.0.1.750 in the
          9 and 10 release lines.

          Specifically, the module targets the HandshakeResult() method used by
          the Agent. By inducing a failure in the handshake, the Agent will
          deserialize untrusted data.

          Tested against the pre-patched release of 10.0.0.750. Note that Veeam
          continues to distribute this version but with the patch pre-applied.

Check method (fingerprinting):
vprint_status("Checking connection to #{peer}")
    connect

    CheckCode::Detected("Connected to #{peer}.")
  rescue Rex::ConnectionError => e
    CheckCode::Unknown("#{e.class}: #{e.message}")
  ensure
    disconnect
  end
Metasploit Module: IBM Tivoli Storage Manager Express RCA Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/ibm_tsm_rca_dicugetidentify.rb
Platform: win
Disclosure date: 2009-11-04
References: CVE-2008-4828, OSVDB-54232, BID-34803

Description:
This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express Remote
          Client Agent service. By sending a "dicuGetIdentify" request packet containing a long
          NodeName parameter, an attacker can execute arbitrary code.

          NOTE: this exploit first connects to the CAD service to start the RCA service and obtain
          the port number on which it runs. This service does not restart.
Metasploit Module: Borland CaliberRM StarTeam Multicast Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/borland_starteam.rb
Platform: win
Disclosure date: 2008-04-02
Authors: MC
References: CVE-2008-0311, OSVDB-44039, BID-28602

Description:
This module exploits a stack buffer overflow in Borland CaliberRM 2006. By sending
          a specially crafted GET request to the STMulticastService, an attacker may be
          able to execute arbitrary code.
Metasploit Module: SAP NetWeaver Dispatcher DiagTraceR3Info Buffer Overflow
Type: exploit
Path: modules/exploits/windows/misc/sap_netweaver_dispatcher.rb
Platform: win
Disclosure date: 2012-05-08
References: OSVDB-81759, CVE-2012-2611, BID-53424, EDB-20705, URL-http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities, URL-http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=Uncovering_SAP_vulnerabilities_reversing_and_breaking_the_Diag_protocol

Description:
This module exploits a stack buffer overflow in the SAP NetWeaver Dispatcher
          service. The overflow occurs in the DiagTraceR3Info() function and allows a remote
          attacker to execute arbitrary code by supplying a special crafted Diag packet. The
          Dispatcher service is only vulnerable if the Developer Traces have been configured
          at levels 2 or 3. The module has been successfully tested on SAP Netweaver 7.0 EHP2
          SP6 over Windows XP SP3 and Windows 2003 SP2 (DEP bypass).