deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Jasmin Ransomware Web Server Unauthenticated Directory Traversal
Type: auxiliary
Path: modules/auxiliary/gather/jasmin_ransomware_dir_traversal.rb
Disclosure date: 2023-04-08
References: CVE-2024-30851, URL-https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc, URL-https://github.com/codesiddhant/Jasmin-Ransomware

Description:
The Jasmin Ransomware web server contains an unauthenticated directory traversal vulnerability
          within the download functionality. As of April 15, 2024 this was still unpatched, so all
          versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path)
    )
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    return Exploit::CheckCode::Detected('Jasmin Login page detected') if res.body.include? '<title>Jasmin Dashboard</title>'

    Exploit::CheckCode::Safe("#{peer} - Jasmin login page not found")
  end
Metasploit Module: IBM Lotus Sametime Version Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/ibm_sametime_version.rb
Disclosure date: 2013-12-27
References: CVE-2013-3982, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Description:
This module scans an IBM Lotus Sametime web interface to enumerate
          the application's version and configuration information.
Metasploit Module: Archer C7 Directory Traversal Vulnerability
Type: auxiliary
Path: modules/auxiliary/gather/tplink_archer_c7_traversal.rb
Disclosure date: 2015-04-08
References: BID-74050 , CVE-2015-3035

Description:
This module exploits a directory traversal vulnerability in the PATH_INFO found at /login/
          on TP-Link Archer C5, C7, and C9 routers of varying versions.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/'
    })
    return Exploit::CheckCode::Unknown('No response received from target') unless res

    device_title = res.get_html_document&.at('//title')&.text
    if device_title =~ /Archer C\d/
      return Exploit::CheckCode::Appears("Target device '#{device_title}'")
    end

    Exploit::CheckCode::Safe('Target does not appear to be an Archer Cx router.')
  end
Metasploit Module: Snare Lite for Windows Registry Access
Type: auxiliary
Path: modules/auxiliary/gather/snare_registry.rb
Platform: win
References: URL-https://www.intersectalliance.com/wp-content/uploads/user_guides/Guide_to_Snare_for_Windows-4.2.pdf

Description:
This module uses the Registry Dump feature of the Snare Lite
          for Windows service on 6161/TCP to retrieve the Windows registry.
          The Dump Registry functionality is unavailable in Snare Enterprise.

          Note: The Dump Registry functionality accepts only one connected
          client at a time. Requesting a large key/hive will cause the service
          to become unresponsive until the server completes the request.
Metasploit Module: Lansweeper Credential Collector
Type: auxiliary
Path: modules/auxiliary/gather/lansweeper_collector.rb
References: URL-http://www.lansweeper.com, URL-http://www.praudit.hu/prauditeng/index.php/blog/a-lansweeper-es-a-tea

Description:
Lansweeper stores the credentials it uses to scan the computers
          in its Microsoft SQL database.  The passwords are XTea-encrypted with a
          68 character long key, in which the first 8 characters are stored with
          the password in the database and the other 60 is static. Lansweeper, by
          default, creates an MSSQL user "lansweeperuser" with the password is
          "mysecretpassword0*", and stores its data in a database called
          "lansweeperdb". This module will query the MSSQL database for the
          credentials.
Metasploit Module: Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera
Type: auxiliary
Path: modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb
Disclosure date: 2017-09-23
References: CVE-2017-7921, URL-https://ipvm.com/reports/hik-exploit, URL-https://attackerkb.com/topics/PlLehGSmxT/cve-2017-7921, URL-http://seclists.org/fulldisclosure/2017/Sep/23

Description:
Many Hikvision IP cameras have improper authorization logic that allows unauthenticated information disclosure of camera information,
          such as detailed hardware and software configuration, user credentials, and camera snapshots.
          The vulnerability has been present in Hikvision products since 2014.
          In addition to Hikvision-branded devices, it affects many white-labeled camera products sold under a variety of brand names.
          Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time of publishing (shodan search: "App-webs" "200 OK").
          This module allows the attacker to retrieve this information without any authentication. The information is stored in loot for future use.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path, 'System', 'time')
    res = get_info(uri)

    if res.nil?
      return Exploit::CheckCode::Unknown('No response received from the target')
    elsif res.code == 200
      return Exploit::CheckCode::Vulnerable('Unauthenticated access to system time endpoint succeeded')
    else
      return Exploit::CheckCode::Safe("System time endpoint returned HTTP #{res.code}")
    end
  end
Metasploit Module: Misconfigured Certificate Template Finder
Type: auxiliary
Path: modules/auxiliary/gather/ldap_esc_vulnerable_cert_finder.rb
Disclosure date: 2021-06-17

Description:
This module allows users to query a LDAP server for vulnerable certificate
          templates and will print these certificates out in a table along with which
          attack they are vulnerable to and the SIDs that can be used to enroll in that
          certificate template.

          Additionally the module will also print out a list of known certificate servers
          along with info about which vulnerable certificate templates the certificate server
          allows enrollment in and which SIDs are authorized to use that certificate server to
          perform this enrollment operation.

          Currently the module is capable of checking for certificates that are vulnerable to ESC1, ESC2, ESC3, ESC4,
          ESC13, and ESC15. The module is limited to checking for these techniques due to them being identifiable
          remotely from a normal user account by analyzing the objects in LDAP.

          The module can also check for ESC9, ESC10 and ESC16 but this requires an Administrative WinRM session to be
          established to definitively check for these techniques.
Metasploit Module: BMC / Numara Track-It! Domain Administrator and SQL Server User Password Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/trackit_sql_domain_creds.rb
Disclosure date: 2014-10-07
References: CVE-2014-4872, OSVDB-112741, US-CERT-VU-121036, URL-https://seclists.org/fulldisclosure/2014/Oct/34

Description:
This module exploits an unauthenticated configuration retrieval .NET remoting
          service in Numara / BMC Track-It! v9 to v11.X, which can be abused to retrieve the Domain
          Administrator and the SQL server user credentials.
          This module has been tested successfully on versions 11.3.0.355, 10.0.51.135, 10.0.50.107,
          10.0.0.143 and 9.0.30.248.
Metasploit Module: HTTP SSL Certificate Impersonation
Type: auxiliary
Path: modules/auxiliary/gather/impersonate_ssl.rb
Authors: Chris John Riley
References: URL-https://www.slideshare.net/ChrisJohnRiley/ssl-certificate-impersonation-for-shits-andgiggles

Description:
This module request a copy of the remote SSL certificate and creates a local
          (self.signed) version using the information from the remote version. The module
          then Outputs (PEM|DER) format private key / certificate and a combined version
          for use in Apache or other Metasploit modules requiring SSLCert Inputs for private
          key / CA cert have been provided for those with DigiNotar certs hanging about!
Metasploit Module: EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/emc_cta_xxe.rb
Disclosure date: 2014-03-31
References: CVE-2014-0644, EDB-32623

Description:
EMC CTA v10.0 is susceptible to an unauthenticated XXE attack
          that allows an attacker to read arbitrary files from the file system
          with the permissions of the root user.
Metasploit Module: WordPress W3-Total-Cache Plugin 0.9.2.4 (or before) Username and Hash Extract
Type: auxiliary
Path: modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb
References: OSVDB-88744, URL-https://seclists.org/fulldisclosure/2012/Dec/242

Description:
The W3-Total-Cache Wordpress Plugin <= 0.9.2.4 can cache database statements
        and its results in files for fast access. Version 0.9.2.4 has been fixed afterwards
        so it can be vulnerable. These cache files are in the webroot of the Wordpress
        installation and can be downloaded if the name is guessed. This module tries to
        locate them with brute force in order to find usernames and password hashes in these
        files. W3 Total Cache must be configured with Database Cache enabled and Database
        Cache Method set to Disk to be vulnerable
Metasploit Module: Peplink Balance routers SQLi
Type: auxiliary
Path: modules/auxiliary/gather/peplink_bauth_sqli.rb
Platform: %w[linux
References: EDB-42130, CVE-2017-8835, URL-https://gist.github.com/red0xff/c4511d2f427efcb8b018534704e9607a

Description:
Firmware versions up to 7.0.0-build1904 of Peplink Balance routers are affected by an unauthenticated
          SQL injection vulnerability in the bauth cookie, successful exploitation of the vulnerability allows an
          attacker to retrieve the cookies of authenticated users, bypassing the web portal authentication.

          By default, a session expires 4 hours after login (the setting can be changed by the admin), for this
          reason, the module attempts to retrieve the most recently created sessions.

Check method (fingerprinting):
@sqli = create_sqli(dbms: SQLitei::BooleanBasedBlind) do |payload|
      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'MANGA', 'admin.cgi'),
        'method' => 'GET',
        'cookie' => "bauth=' or #{payload}--"
      })
      return Exploit::CheckCode::Unknown("Unable to connect to #{target_uri.path}") unless res

      res.get_cookies.empty? # no Set-Cookie header means the session cookie is valid
    end
    if @sqli.test_vulnerable
      Exploit::CheckCode::Vulnerable('SQL injection in bauth cookie confirmed')
    else
      Exploit::CheckCode::Safe('SQL injection test did not succeed')
    end
  end
Metasploit Module: Jasmin Ransomware Web Server Unauthenticated SQL Injection
Type: auxiliary
Path: modules/auxiliary/gather/jasmin_ransomware_sqli.rb
Disclosure date: 2023-04-08
References: CVE-2025-6095, URL-https://github.com/chebuya/CVE-2024-30851-jasmin-ransomware-path-traversal-poc, URL-https://github.com/codesiddhant/Jasmin-Ransomware

Description:
The Jasmin Ransomware web server contains an unauthenticated SQL injection vulnerability
          within the login functionality. As of April 15, 2024 this was still unpatched, so all
          versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched.

          Retrieving the victim's data may take a long amount of time. It is much quicker to
          get the logins, then just login to the site.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path)
    )
    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    return Exploit::CheckCode::Detected('Jasmin Login page detected') if res.body.include? '<title>Jasmin Dashboard</title>'

    Exploit::CheckCode::Safe("#{peer} - Jasmin login page not found")
  end
Metasploit Module: Prometheus API Information Gather
Type: auxiliary
Path: modules/auxiliary/gather/prometheus_api_gather.rb
Disclosure date: 2016-07-01
References: URL-https://jfrog.com/blog/dont-let-prometheus-steal-your-fire/, URL-https://www.aquasec.com/blog/300000-prometheus-servers-and-exporters-exposed-to-dos-attacks/

Description:
This module utilizes Prometheus' API calls to gather information about
          the server's configuration, and targets. Fields which may contain
          credentials, or credential file names are then pulled out and printed.

          Targets may have a wealth of information, this module will print the following
          values when found:
          __meta_gce_metadata_ssh_keys, __meta_gce_metadata_startup_script,
          __meta_gce_metadata_kube_env, kubernetes_sd_configs,
          _meta_kubernetes_pod_annotation_kubectl_kubernetes_io_last_applied_configuration,
          __meta_ec2_tag_CreatedBy, __meta_ec2_tag_OwnedBy

          Shodan search: "http.favicon.hash:[PII_REDACTED]"
Metasploit Module: ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/eventlog_cred_disclosure.rb
Disclosure date: 2014-11-05
References: CVE-2014-6038, CVE-2014-6039, OSVDB-114342, OSVDB-114344, URL-https://seclists.org/fulldisclosure/2014/Nov/12

Description:
ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that
          allow an unauthenticated user to obtain the superuser password of any managed Windows and
          AS/400 hosts. This module abuses both vulnerabilities to collect all the available
          usernames and passwords. First the agentHandler servlet is abused to get the hostid and
          slid of each device (CVE-2014-6038); then these numeric IDs are used to extract usernames
          and passwords by abusing the hostdetails servlet (CVE-2014-6039). Note that on version 7,
          the TARGETURI has to be prepended with /event.
Metasploit Module: Mac OS X Safari file:// Redirection Sandbox Escape
Type: auxiliary
Path: modules/auxiliary/gather/safari_file_url_navigation.rb
Platform: osx
Disclosure date: 2014-01-16
References: ZDI-15-228, CVE-2015-1155, URL-https://support.apple.com/en-us/HT204826

Description:
Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a
          "state management issue" that allows a browser window to be navigated
          to a file:// URL. By dropping and loading a malicious .webarchive file,
          an attacker can read arbitrary files, inject cross-domain Javascript, and
          silently install Safari extensions.
Metasploit Module: Gather PDF Authors
Type: auxiliary
Path: modules/auxiliary/gather/http_pdf_authors.rb
Authors: bcoles

Description:
This module downloads PDF documents and extracts the author's
          name from the document metadata.

          This module expects a URL to be provided using the URL option.
          Alternatively, multiple URLs can be provided by supplying the
          path to a file containing a list of URLs in the URL_LIST option.

          The URL_TYPE option is used to specify the type of URLs supplied.

          By specifying 'pdf' for the URL_TYPE, the module will treat
          the specified URL(s) as PDF documents. The module will
          download the documents and extract the authors' names from the
          document metadata.

          By specifying 'html' for the URL_TYPE, the module will treat
          the specified URL(s) as HTML pages. The module will scrape the
          pages for links to PDF documents, download the PDF documents,
          and extract the author's name from the document metadata.
Metasploit Module: Cisco RV320/RV326 Configuration Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/cisco_rv320_config.rb
Disclosure date: 2019-01-24
References: EDB-46262, BID-106732, CVE-2019-1653, URL-https://seclists.org/fulldisclosure/2019/Jan/52, URL-https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg42801, URL-https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110330-acs.html

Description:
A vulnerability in the web-based management interface of Cisco Small Business
          RV320 and RV325 Dual Gigabit WAN VPN routers could allow an unauthenticated,
          remote attacker to retrieve sensitive information. The vulnerability is due
          to improper access controls for URLs. An attacker could exploit this
          vulnerability by connecting to an affected device via HTTP or HTTPS and
          requesting specific URLs. A successful exploit could allow the attacker to
          download the router configuration or detailed diagnostic information. Cisco
          has released firmware updates that address this vulnerability.
Metasploit Module: IBM Lotus Notes Sametime User Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/ibm_sametime_enumerate_users.rb
Disclosure date: 2013-12-27
References: CVE-2013-3975, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Description:
This module extracts usernames using the IBM Lotus Notes Sametime web
          interface using either a dictionary attack (which is preferred), or a
          bruteforce attack trying all usernames of MAXDEPTH length or less.
Metasploit Module: JVC/Siemens/Vanderbilt IP-Camera Readfile Password Disclosure
Type: auxiliary
Path: modules/auxiliary/gather/ipcamera_password_disclosure.rb
Disclosure date: Aug 16 2016
References: EDB-40254, EDB-40263, EDB-40264

Description:
SIEMENS IP-Camera (CVMS2025-IR + CCMS2025), JVC IP-Camera (VN-T216VPRU),
        and Vanderbilt IP-Camera (CCPW3025-IR + CVMW3025-IR)
        allow an unauthenticated user to disclose the username & password by
        requesting the javascript page 'readfile.cgi?query=ADMINID'.
        Siemens firmwares affected: x.2.2.1798, CxMS2025_V2458_SP1, x.2.2.1798, x.2.2.1235
Metasploit Module: ThinManager Path Traversal (CVE-2023-27856) Arbitrary File Download
Type: auxiliary
Path: modules/auxiliary/gather/thinmanager_traversal_download.rb
Disclosure date: 2023-04-05
References: CVE-2023-27856, URL-https://www.tenable.com/security/research/tra-2023-13, URL-https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640

Description:
This module exploits a path traversal vulnerability (CVE-2023-27856) in
          ThinManager <= v13.0.1 to retrieve arbitrary files from the system.
          The affected service listens by default on TCP port 2031 and runs in the
          context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
begin
      connect
    rescue Rex::ConnectionTimeout
      print_error("Connection to #{datastore['RHOSTS']}:#{datastore['RPORT']} failed.")
      return Exploit::CheckCode::Unknown('Connection to target timed out')
    end

    vprint_status('Sending handshake...')
    handshake = [0x100].pack('V')
    vprint_status(Rex::Text.to_hex_dump(handshake))
    sock.put(handshake)

    res = sock.get_once(4096, 5)
    expected_header = "\x00\x04\x00\x01\x00\x00\x00\x08".b

    if res&.start_with?(expected_header)
      vprint_status('Received handshake response.')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Detected('ThinManager ThinServer accepted the handshake')
    elsif res
      vprint_status('Received unexpected handshake response:')
      vprint_status(Rex::Text.to_hex_dump(res))
      disconnect
      return Exploit::CheckCode::Safe('Unexpected handshake response from target')
    else
      disconnect
      return Exploit::CheckCode::Unknown('No handshake response received.')
    end
  end
Metasploit Module: Shodan Host Port
Type: auxiliary
Path: modules/auxiliary/gather/shodan_host.rb
References: URL-https://honeyscore.shodan.io/

Description:
This module uses the shodan API to return all port information found on a given host IP.
Metasploit Module: IBM Lotus Notes Sametime Room Name Bruteforce
Type: auxiliary
Path: modules/auxiliary/gather/ibm_sametime_room_brute.rb
Disclosure date: 2013-12-27
References: CVE-2013-3977, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Description:
This module bruteforces Sametime meeting room names via the IBM
          Lotus Notes Sametime web interface.
Metasploit Module: OpenNMS Authenticated XXE
Type: auxiliary
Path: modules/auxiliary/gather/opennms_xxe.rb
Disclosure date: 2015-01-08
References: CVE-2015-0975

Description:
OpenNMS is vulnerable to XML External Entity Injection in the Real-Time Console interface.
          Although this attack requires authentication, there are several factors that increase the
          severity of this vulnerability.

          1. OpenNMS runs with root privileges, taken from the OpenNMS FAQ: "The difficulty with the
          core of OpenNMS is that these components need to run as root to be able to bind to low-numbered
          ports or generate network traffic that requires root"

          2. The user that you must authenticate as is the "rtc" user which has the default password of
          "rtc". There is no mention of this user in the installation guides found here:
          http://www.opennms.org/wiki/Tutorial_Installation, only mention that you should change the default
          admin password of "admin" for security purposes.
Metasploit Module: Xerox Administrator Console Password Extractor
Type: auxiliary
Path: modules/auxiliary/gather/xerox_pwd_extract.rb

Description:
This module will extract the management console's admin password from the
          Xerox file system using firmware bootstrap injection.
Metasploit Module: MongoDB Ops Manager Diagnostic Archive Sensitive Information Retriever
Type: auxiliary
Path: modules/auxiliary/gather/mongodb_ops_manager_diagnostic_archive_info.rb
Disclosure date: 2023-06-09
References: URL-https://www.mongodb.com/docs/ops-manager/current/reference/configuration/#mongodb-setting-mms.https.PEMKeyFilePassword, CVE-2023-0342

Description:
MongoDB Ops Manager Diagnostics Archive does not redact SAML SSL Pem Key File Password
          field (mms.saml.ssl.PEMKeyFilePassword) within app settings. Archives do not include
          the PEM files themselves. This module extracts that unredacted password and stores
          the diagnostic archive for additional manual review.

          This issue affects MongoDB Ops Manager v5.0 prior to 5.0.21 and
          MongoDB Ops Manager v6.0 prior to 6.0.12.

          API credentials with the role of GLOBAL_MONITORING_ADMIN or GLOBAL_OWNER are required.

          Successfully tested against MongoDB Ops Manager v6.0.11.

Check method (fingerprinting):
url = normalize_uri(target_uri.path, 'api', 'public', 'v1.0')
    auth_response = digest_auth(url)
    # https://www.mongodb.com/docs/ops-manager/current/tutorial/update-om-with-latest-version-manifest-with-api/
    res = send_request_cgi(
      'uri' => url,
      'headers' => {
        'accept' => 'application/json',
        'authorization' => auth_response
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return Exploit::CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    roles = res.get_json_document.dig('apiKey', 'roles')
    return Exploit::CheckCode::Unknown("#{peer} - Unable to retrieve roles") if roles.nil?

    roles = roles.map { |hash| hash['roleName'] }
    return Exploit::CheckCode::Safe("API key requires GLOBAL_MONITORING_ADMIN or GLOBAL_OWNER permissions. Current permissions: #{permission.join(', ')}") unless roles.include?('GLOBAL_MONITORING_ADMIN') || roles.include?('GLOBAL_OWNER')

    Exploit::CheckCode::Detected('API key has correct roles but version detection not possible')
  end