deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Plex Unpickle Dict Windows RCE
Type: exploit
Path: modules/exploits/windows/http/plex_unpickle_dict_rce.rb
Platform: python
Disclosure date: 2020-05-07
References: URL-https://github.com/tenable/poc/blob/master/plex/plex_media_server/auth_dict_unpickle_rce_exploit_tra_2020_32.py, URL-https://www.tenable.com/security/research/tra-2020-32, URL-http://support.plex.tv/articles/201105343-advanced-hidden-server-settings/, URL-https://forums.plex.tv/t/security-regarding-cve-2020-5741/586819, CVE-2020-5741

Description:
This module exploits an authenticated Python unsafe pickle.load of a Dict file.  An authenticated attacker
          can create a photo library and add arbitrary files to it.  After setting the Windows only Plex variable
          LocalAppDataPath to the newly created photo library, a file named Dict will be unpickled, which causes
          an RCE as the user who started Plex.
          Plex_Token is required, to get it you need to log-in through a web browser, then check the requests to grab
          the X-Plex-Token header.  See info -d for additional details.
          If an exploit fails, or is cancelled, Dict is left on disk, a new ALBUM_NAME will be required
          as subsuquent writes will make Dict-1, and not execute.

Check method (fingerprinting):
server = ret_server_info
    if server.nil?
      return CheckCode::Safe('Could not connect to the web service, check URI Path and IP')
    end

    store_loot('plex.json', 'application/json', datastore['RHOST'], server.to_s, 'plex.json', 'Plex Server Configuration')

    report_host({
      host: datastore['RHOST'],
      os_name: server['MediaContainer']['platform'],
      os_flavor: server['MediaContainer']['platformVersion']
    })
    print_status("Server Name: #{server['MediaContainer']['friendlyName']}")
    unless server['MediaContainer']['platform'] == 'Windows'
      print_bad("Server OS: #{server['MediaContainer']['platform']} (#{server['MediaContainer']['platformVersion']})")
      return CheckCode::Safe('Only Windows OS is exploitable')
    end
    print_good("Server OS: #{server['MediaContainer']['platform']} (#{server['MediaContainer']['platformVersion']})")
    v = Rex::Version.new(server['MediaContainer']['version'])
    if v >= Rex::Version.new('1.19.3')
      print_bad("Server Version: #{v}")
      return CheckCode::Safe('Only < 1.19.3 is exploitable')
    end
    print_good("Server Version: #{server['MediaContainer']['version']}")
    unless server['MediaContainer']['allowCameraUpload']
      print_bad("Camera Upload: #{server['MediaContainer']['allowCameraUpload']}")
      return CheckCode::Safe('Camera Upload not enabled')
    end
    print_good("Camera Upload: #{server['MediaContainer']['allowCameraUpload']}")
    CheckCode::Vulnerable("Version #{v} is
Metasploit Module: Telerik UI ASP.NET AJAX RadAsyncUpload Deserialization
Type: exploit
Path: modules/exploits/windows/http/telerik_rau_deserialization.rb
Platform: win
Disclosure date: 2019-12-09
References: CVE-2017-11317, URL-https://github.com/bao7uo/RAU_crypto, URL-https://www.telerik.com/support/kb/aspnet-ajax/upload-(async)/details/unrestricted-file-upload, URL-https://github.com/straightblast/UnRadAsyncUpload/wiki, CVE-2019-18935, URL-https://github.com/noperator/CVE-2019-18935, URL-https://www.telerik.com/support/kb/aspnet-ajax/details/allows-javascriptserializer-deserialization, URL-https://codewhitesec.blogspot.com/2019/02/telerik-revisited.html, URL-https://labs.bishopfox.com/tech-blog/cve-2019-18935-remote-code-execution-in-telerik-ui

Description:
This module exploits the .NET deserialization vulnerability within the RadAsyncUpload (RAU) component of Telerik
          UI ASP.NET AJAX that is identified as CVE-2019-18935. In order to do so the module must upload a mixed mode .NET
          assembly DLL which is then loaded through the deserialization flaw. Uploading the file requires knowledge of the
          cryptographic keys used by RAU. The default values used by this module are related to CVE-2017-11317, which once
          patched randomizes these keys. It is also necessary to know the version of Telerik UI ASP.NET that is running.
          This version number is in the format YYYY.#(.###)? where YYYY is the year of the release (e.g. '2020.3.915').

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'Telerik.Web.UI.WebResource.axd'),
      'vars_get' => { 'type' => 'rau' }
    })
    return CheckCode::Safe('Target did not return HTTP 200') unless res&.code == 200
    return CheckCode::Safe('RadAsyncUpload handler not detected') unless res.get_json_document&.dig('message') =~ /RadAsyncUpload handler is registered succesfully/

    if datastore['VERSION'].blank?
      @version = enumerate_version
    else
      begin
        upload_file('', datastore['VERSION'])
      rescue Msf::Exploit::Failed
        return CheckCode::Safe("Target is not vulnerable based on version: #{datastore['VERSION']}")
      end

      @version = datastore['VERSION']
    end

    if !@version.nil? && datastore['RAU_SIGNING_KEY'] == DEFAULT_RAU_SIGNING_KEY && datastore['RAU_ENCRYPTION_KEY'] == DEFAULT_RAU_ENCRYPTION_KEY
      print_status('Server is using default crypto keys and is vulnerable to CVE-2017-11317')
      report_vuln({
        host: rhost,
        port: rport,
        proto: 'tcp',
        name: 'Unrestricted File Upload via Weak Encryption',
        refs: CVE_2017_11317_REFERENCES.map { |ctx_id, ctx_val| SiteReference.new(ctx_id, ctx_val) }
      })
    end

    # with custom errors enabled (which is the default), it's not possible to test for the serialization flaw without triggering it
    CheckCode::Detected("Target detected with version: #{@version}")
  end
Metasploit Module: ColdFusion 8.0.1 Arbitrary File Upload and Execute
Type: exploit
Path: modules/exploits/windows/http/coldfusion_fckeditor.rb
Platform: win
Disclosure date: 2009-07-03
References: CVE-2009-2265, OSVDB-55684
Targets: Universal Windows Target

Description:
This module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload
          and Execute vulnerability.
Metasploit Module: Rejetto HttpFileServer Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/rejetto_hfs_exec.rb
Platform: win
Disclosure date: 2014-09-11
References: CVE-2014-6287, OSVDB-111386, URL-https://seclists.org/bugtraq/2014/Sep/85, URL-http://www.rejetto.com/wiki/index.php?title=HFS:_scripting_commands

Description:
Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a
          poor regex in the file ParserLib.pas. This module exploits the HFS scripting commands by
          using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b
          over Windows XP SP3, Windows 7 SP1 and Windows 8.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/'
    })

    if res && res.headers['Server'] && res.headers['Server'] =~ /HFS ([\d.]+)/
      version = $1
      if Rex::Version.new(version) <= Rex::Version.new("2.3")
        return Exploit::CheckCode::Detected("Target detected with version: #{version}")
      else
        return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
      end
    else
      return Exploit::CheckCode::Safe('HFS not detected')
    end
  end
Metasploit Module: PRTG Network Monitor Authenticated RCE
Type: exploit
Path: modules/exploits/windows/http/prtg_authenticated_rce.rb
Platform: win
Disclosure date: 2018-06-25
References: CVE-2018-9276, URL-https://www.codewatch.org/blog/?p=453

Description:
Notifications can be created by an authenticated user and can execute scripts when triggered.
          Due to a poorly validated input on the script name, it is possible to chain it with a user-supplied command allowing command execution under the context of privileged user.
          The module uses provided credentials to log in to the web interface, then creates and triggers a malicious notification to perform RCE using a Powershell payload.
          It may require a few tries to get a shell because notifications are queued up on the server.
          This vulnerability affects versions prior to 18.2.39. See references for more details about the vulnerability allowing RCE.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(datastore['URI'], '/index.htm')
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
      return CheckCode::Unknown('Could not determine the target status')
    ensure
      disconnect
    end

    if res && res.code == 200
      # checks for PRTG version in http headers first, if not found looks for it in html
      version_match = /\d{1,2}\.\d{1}\.\d{1,2}\.\d*/
      prtg_server_header = res.headers['Server']
      if prtg_server_header && prtg_server_header =~ version_match
        prtg_version = prtg_server_header[version_match]
      else
        html = res.get_html_document
        prtg_version_html = html.at('span[@class="prtgversion"]')
        if prtg_version_html && prtg_version_html.text =~ version_match
          prtg_version = prtg_version_html.text[version_match]
        end
      end

      if prtg_version
        vprint_status("Identified PRTG Network Monitor Version #{prtg_version}")
        if Rex::Version.new(prtg_version) < Rex::Version.new('18.2.39')
          return CheckCode::Appears("Detected vulnerable version: #{prtg_version}")
        else
          return CheckCode::Safe("Target is not vulnerable based on version: #{prtg_version}")
        end
      elsif (prtg_server_header.include? 'PRTG') || (html.to_s.include? 'PRTG')
        return CheckCode::Detected('PRTG Network Monitor detected bu
Metasploit Module: HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload
Type: exploit
Path: modules/exploits/windows/http/hp_pcm_snac_update_domain.rb
Platform: win
Disclosure date: 2013-09-09
References: CVE-2013-4811, OSVDB-97154, BID-62349, ZDI-13-226

Description:
This module exploits a path traversal flaw in the HP ProCurve Manager SNAC Server. The
          vulnerability in the UpdateDomainControllerServlet allows an attacker to upload arbitrary
          files, just having into account binary writes aren't allowed. Additionally, authentication
          can be bypassed in order to upload the file. This module has been tested successfully on
          the SNAC server installed with HP ProCurve Manager 4.0.

Check method (fingerprinting):
session = get_session
    if session.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    res = send_request_cgi({
      'uri' => "/RegWeb/RegWeb/GetDomainControllerServlet",
      'cookie' => session
    })

    if res and res.code == 200 and res.body =~ /domainName/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: IBM Tivoli Storage Manager Express CAD Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ibm_tsm_cad_header.rb
Platform: win
Disclosure date: 2007-09-24
References: CVE-2007-4880, OSVDB-38161, BID-25743

Description:
This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service (5.3.3).
          By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code.
Metasploit Module: Microsoft SharePoint Server ToolPane Unauthenticated Remote Code Execution (aka ToolShell)
Type: exploit
Path: modules/exploits/windows/http/sharepoint_toolpane_rce.rb
Platform: win
Disclosure date: 2025-07-08
References: CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, URL-https://blog.viettelcybersecurity.com/sharepoint-toolshell/, URL-https://blog.leakix.net/2025/07/using-their-own-weapons-for-defense-a-sharepoint-story/, URL-https://securelist.com/toolshell-explained/, URL-https://www.zerodayinitiative.com/advisories/ZDI-25-580/, URL-https://www.zerodayinitiative.com/advisories/ZDI-25-581/, URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49704

Description:
This module exploits the authentication bypass vulnerabilities CVE-2025-49706 and CVE-2025-53771, and an unsafe
          deserialization vulnerability CVE-2025-49704, to achieve unauthenticated RCE against a vulnerable Microsoft
          SharePoint Server. The vulnerability CVE-2025-53770 was disclosed as being a patch bypass of CVE-2025-49704,
          and as described by the finders, CVE-2025-53770 targets a different endpoint within the /_vti_bin/ URI path.
          As this exploit module does not target the endpoint associated with CVE-2025-53770 (per the original finders),
          we believe this module is best described as exploiting CVE-2025-49704 and not CVE-2025-53770.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'start.aspx')
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown("Unexpected response code #{res.code}") unless res.code == 200

    # The returned HTML will have a blob of JavaScript that contains a hash object called _spPageContextInfo. A key
    # called siteClientTag will have a value of the current SharePoint Server patch level. We cannot rely on the HTTP
    # header value MicrosoftSharePointTeamServices as this may not reflect the actual patch level.
    site_client_tag = res.body.match(/"*siteClientTag"*\s*:\s*"\d*[$]+([^"]+)",/)

    return CheckCode::Unknown('Unable to extract the siteClientTag') unless site_client_tag

    version = Rex::Version.new(site_client_tag[1])

    # We compare the version we pull from the target, against a table of known vulnerable SharePoint editions. We
    # compare the target version against the RTM version (i.e. the first version of an edition) and the version *before*
    # the patch for CVE-2025-53770 and CVE-2025-53771 (which supersedes patches for CVE-2025-49704 and CVE-2025-49706
    # from July 2025).
    # Note: A SharePoint server that has the patch for CVE-2025-49704 applied, may still be vulnerable if a SharePoint
    # configuration update has not also manually occurred.
    # https://learn.microsoft.com/en-us/sharepoint/product-servicing-policy/updated-product-se
Metasploit Module: Belkin Bulldog Plus Web Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/belkin_bulldog.rb
Platform: win
Disclosure date: 2009-03-08
References: CVE-2009-20009, OSVDB-54395, BID-34033, EDB-8173

Description:
This module exploits a stack buffer overflow in Belkin Bulldog Plus
          4.0.2 build 1219. When sending a specially crafted http request,
          an attacker may be able to execute arbitrary code.
Metasploit Module: HP Intelligent Management Center BIMS UploadServlet Directory Traversal
Type: exploit
Path: modules/exploits/windows/http/hp_imc_bims_upload.rb
Platform: win
Disclosure date: 2013-10-08
References: CVE-2013-4822, OSVDB-98247, BID-62895, ZDI-13-238, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03943425

Description:
This module exploits a directory traversal vulnerability on the version 5.2 of the BIMS
          component from the HP Intelligent Management Center. The vulnerability exists in the
          UploadServlet, allowing the user to download and upload arbitrary files. This module has
          been tested successfully on HP Intelligent Management Center with BIMS 5.2 E0401 on Windows
          2003 SP2.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("/", "upload", "upload"),
      'method' => 'GET',
      'vars_get' => { 'fileName' => "WEB-INF/web.xml" },
    })

    if res.nil?
      vprint_error("Unable to determine, because the request timed out.")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 200 and res.headers['Content-Type'] =~ /application\/doc/ and res.body =~ /com\.h3c\.imc\.bims\.acs\.server\.UploadServlet/
      vprint_status("Upload interface found. Must be tested to verify vulnerable state.")
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    elsif res.code == 405 and res.message =~ /Method Not Allowed/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: HP OpenView Network Node Manager getnnmdata.exe (MaxAge) CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_getnnmdata_maxage.rb
Platform: win
Disclosure date: 2010-05-11
References: CVE-2010-1553, OSVDB-64976

Description:
This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
          By sending specially crafted MaxAge parameter to the getnnmdata.exe CGI,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Oracle BeeHive 2 voice-servlet prepareAudioToPlay() Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb
Platform: win
Disclosure date: 2015-11-10
References: ZDI-15-550, URL-http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html

Description:
This module exploits a vulnerability found in Oracle BeeHive. The prepareAudioToPlay method
          found in voice-servlet can be abused to write a malicious file onto the target machine, and
          gain remote arbitrary code execution under the context of SYSTEM. Authentication is not
          required to exploit this vulnerability.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa/'))

    if res.nil?
      vprint_error("Connection timed out.")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res && (res.code == 403 || res.code == 200)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: HP OpenView Network Node Manager getnnmdata.exe (Hostname) CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_getnnmdata_hostname.rb
Platform: win
Disclosure date: 2010-05-11
References: CVE-2010-1555, OSVDB-64976

Description:
This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
          By sending specially crafted Hostname parameter to the getnnmdata.exe CGI,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Oracle 9i XDB HTTP PASS Overflow (win32)
Type: exploit
Path: modules/exploits/windows/http/oracle9i_xdb_pass.rb
Platform: win
Disclosure date: 2003-08-18
References: CVE-2003-0727, OSVDB-2449, BID-8375, URL-http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-litchfield-paper.pdf

Description:
This module exploits a stack buffer overflow in the authorization
          code of the Oracle 9i HTTP XDB service. David Litchfield,
          has illustrated multiple vulnerabilities in the Oracle
          9i XML Database (XDB), during a seminar on "Variations
          in exploit methods between Linux and Windows" presented
          at the Blackhat conference.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.0\r\n\r\n")
    resp = sock.get_once
    disconnect

    if (resp =~ /9\.2\.0\.1\.0/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Now SMS/MMS Gateway Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/nowsms.rb
Platform: win
Disclosure date: 2008-02-19
References: CVE-2008-0871, OSVDB-42953, BID-27896

Description:
This module exploits a stack buffer overflow in Now SMS/MMS Gateway v2007.06.27.
          By sending a specially crafted GET request, an attacker may be able to execute
          arbitrary code.
Metasploit Module: Sitecore CVE-2025-27218 BinaryFormatter Deserialization Exploit
Type: exploit
Path: modules/exploits/windows/http/sitecore_xp_cve_2025_27218.rb
Platform: win
Disclosure date: 2025-01-06
References: CVE-2025-27218, URL-https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535, URL-https://attackerkb.com/topics/Dyo4zUm2tv/cve-2025-27218
Targets: Windows Command, PowerShell Stager

Description:
This module exploits a .NET deserialization vulnerability in Sitecore Experience Manager (XM) and Experience
          Platform (XP) 10.4 by injecting a malicious Base64-encoded BinaryFormatter payload into an HTTP header.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    })

    if res&.code == 200 && res&.get_html_document&.at('//title')&.text&.strip == 'Welcome to Sitecore'
      CheckCode::Detected('The target is running SiteCore.')
    else
      CheckCode::Safe('The target does not appear to be running SiteCore.')
    end
  end
Metasploit Module: Novell ZENworks Configuration Management Remote Execution
Type: exploit
Path: modules/exploits/windows/http/zenworks_uploadservlet.rb
Platform: java
Disclosure date: 2010-03-30
References: CVE-2010-5324, OSVDB-63412, BID-39114, ZDI-10-078, URL-http://tucanalamigo.blogspot.com/2010/04/pdc-de-zdi-10-078.html, URL-http://www.novell.com/support/kb/doc.php?id=7005573
Targets: Java Universal, Windows x86

Description:
This module exploits a code execution flaw in Novell ZENworks Configuration Management 10.2.0.
          By exploiting the UploadServlet, an attacker can upload a malicious file outside of the TEMP directory
          and then make a secondary request that allows for arbitrary code execution.
Metasploit Module: NorthStar C2 XSS to Agent RCE
Type: exploit
Path: modules/exploits/windows/http/northstar_c2_xss_to_agent_rce.rb
Platform: win
Disclosure date: 2024-03-12
References: URL-https://blog.chebuya.com/posts/discovering-cve-2024-28741-remote-code-execution-on-northstar-c2-agents-via-pre-auth-stored-xss/, URL-https://github.com/chebuya/CVE-2024-28741-northstar-agent-rce-poc, URL-https://github.com/EnginDemirbilek/NorthStarC2/commit/7674a4457fca83058a157c03aa7bccd02f4a213c, CVE-2024-28741

Description:
NorthStar C2, prior to commit 7674a44 on March 11 2024, contains a vulnerability where the logs page is
          vulnerable to a stored xss.
          An unauthenticated user can simulate an agent registration to cause the XSS and take over a users session.
          With this access, it is then possible to run a new payload on all of the NorthStar C2 compromised hosts
          (agents), and kill the original agent.

          Successfully tested against NorthStar C2 commit e7fdce148b6a81516e8aa5e5e037acd082611f73 running on
          Ubuntu 22.04. The agent was running on Windows 10 19045.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'getin.php'),
      'method' => 'GET'
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    return CheckCode::Detected('NorthStar Login page detected') if res.body.include? '<title>The NorthStar Login</title>'

    CheckCode::Safe('NorthStar C2 Login page not detected')
  end