deardaniel/secdata-raw huggingface dataset:
Metasploit Module: elFinder Archive Command Injection
Type: exploit
Path: modules/exploits/linux/http/elfinder_archive_cmd_injection.rb
Platform: linux
Disclosure date: 2021-06-13
References: CVE-2021-32682, URL-https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities
Targets: Automatic Target

Description:
elFinder versions below 2.1.59 are vulnerable to a command injection
          vulnerability via its archive functionality.

          When creating a new zip archive, the `name` parameter is sanitized
          with the `escapeshellarg()` php function and then passed to the
          `zip` utility. Despite the sanitization, supplying the `-TmTT`
          argument as part of the `name` parameter is still permitted and
          enables the execution of arbitrary commands as the `www-data` user.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => upload_uri
    )

    return CheckCode::Unknown('Failed to retrieve a response') unless res
    return CheckCode::Safe('Failed to detect elFinder') unless res.body.include?('["errUnknownCmd"]')

    vprint_status('Attempting to check the changelog for elFinder version')
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'Changelog')
    )

    unless res
      return CheckCode::Detected('elFinder is running, but cannot detect version through the changelog')
    end

    # * elFinder (2.1.58)
    vers_str = res.body.match(/\*\s+elFinder\s+\((\d+\.\d+\.\d+)\)/)
    if vers_str.nil? || vers_str.length <= 1
      return CheckCode::Detected('elFinder is running, but couldn\'t retrieve the version')
    end

    version_found = Rex::Version.new(vers_str[1])
    if version_found < Rex::Version.new('2.1.59')
      return CheckCode::Appears("elFinder running version #{vers_str[1]}")
    end

    CheckCode::Safe("Detected elFinder version #{vers_str[1]}, which is not vulnerable")
  end
Metasploit Module: Unitrends UEB http api remote code execution
Type: exploit
Path: modules/exploits/linux/http/ueb_api_rce.rb
Platform: linux
Disclosure date: 2017-08-08
References: URL-https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000TO5PAAW/000005756, URL-https://support.unitrends.com/UnitrendsBackup/s/article/000006002, URL-https://nvd.nist.gov/vuln/detail/CVE-2017-12478, URL-http://blog.redactedsec.net/exploits/2018/01/29/UEB9.html, EDB-44297, CVE-2017-12478, CVE-2018-6328

Description:
It was discovered that the api/storage web interface in Unitrends Backup (UB)
          before 10.0.0 has an issue in which one of its input parameters was not validated.
          A remote attacker could use this flaw to bypass authentication and execute arbitrary
          commands with root privilege on the target system.
          UEB v9 runs the api under root privileges and api/storage is vulnerable.
          UEB v10 runs the api under limited privileges and api/hosts is vulnerable.

Check method (fingerprinting):
res = send_request_cgi!({
      'method' => 'GET',
      'uri' => '/api/systems/details',
      'ctype' => 'application/json',
      'headers' =>
        { 'AuthToken' => auth_token }
    })
    if res && res.code == 200
      print_good("Good news, looks like a vulnerable version of UEB.")
      return CheckCode::Appears('The target appears to be vulnerable')
    else
      print_bad('Host does not appear to be vulnerable.')
    end
    return CheckCode::Safe('The target is not vulnerable')
  end

  # substitue some charactes
Metasploit Module: PeerCast URL Handling Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/peercast_url.rb
Platform: linux
Disclosure date: 2006-03-08
References: CVE-2006-1148, OSVDB-23777, BID-17040

Description:
This module exploits a stack buffer overflow in PeerCast <= v0.1216.
          The vulnerability is caused due to a boundary error within the
          handling of URL parameters.
Metasploit Module: Nagios XI Chained Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_chained_rce_2_electric_boogaloo.rb
Platform: linux
Disclosure date: 2018-04-17
References: EDB-44560, CVE-2018-8733, CVE-2018-8734, CVE-2018-8735, CVE-2018-8736, URL-http://blog.redactedsec.net/exploits/2018/04/26/nagios.html

Description:
This module exploits a few different vulnerabilities in Nagios XI 5.2.6-5.4.12 to gain remote root access.
          The steps are:
          1. Issue a POST request to /nagiosql/admin/settings.php which sets the database user to root.
          2. SQLi on /nagiosql/admin/helpedit.php allows us to enumerate API keys.
          3. The API keys are then used to add an administrative user.
          4. An authenticated session is established with the newly added user
          5. Command Injection on /nagiosxi/backend/index.php allows us to execute the payload with nopasswd sudo,
          giving us a root shell.
          6. Remove the added admin user and reset the database user.

Check method (fingerprinting):
vprint_status "STEP 0: Get Nagios XI version string."
    res = send_request_cgi!({
      'method' => 'GET',
      'uri' => '/nagiosxi/'
    })

    if !res || !res.get_html_document
      fail_with(Failure::Unknown, 'Could not check nagios version')
    end

    if (@version = res.get_html_document.at('//input[@name = "version"]/@value').text)
      @version = Rex::Version.new(@version)
      vprint_good("STEP 0: Found Nagios XI version: #{@version.to_s}")
      if @version < target[:lower_version]
        vprint_bad('Try nagios_xi_chained for this version.')
      elsif (@version <= target[:upper_version] && @version >= target[:lower_version])
        return CheckCode::Appears("Version #{@version} appears to be vulnerable")
      end
    end
    CheckCode::Safe("Version #{@version} is not vulnerable")
  end
Metasploit Module: Netsweeper WebAdmin unixlogin.php Python Code Injection
Type: exploit
Path: modules/exploits/linux/http/netsweeper_webadmin_unixlogin.rb
Platform: python
Disclosure date: 2020-04-28
References: CVE-2020-13167, URL-https://ssd-disclosure.com/ssd-advisory-netsweeper-preauth-rce/, URL-https://portswigger.net/daily-swig/severe-rce-vulnerability-in-content-filtering-system-has-been-patched-netsweeper-says

Description:
This module exploits a Python code injection in the Netsweeper
          WebAdmin component's unixlogin.php script, for versions 6.4.4 and
          prior, to execute code as the root user.

          Authentication is bypassed by sending a random whitelisted Referer
          header in each request.

          Tested on the CentOS Linux-based Netsweeper 6.4.3 and 6.4.4 ISOs.
          Though the advisory lists 6.4.3 and prior as vulnerable, 6.4.4 has
          been confirmed exploitable.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path,
                             '/webadmin/tools/systemstatus_remote.php'),
      'headers' => {
        'Referer' => rand_referer(:check) # Auth bypass via Referer header
      }
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200
      return CheckCode::Unknown('Target is not running Netsweeper.')
    end

    if res.body.include?('Permission Denied: Unauthorized access.')
      return CheckCode::Safe('Target has rejected our Referer auth bypass.')
    end

    # Example version information from /webadmin/tools/systemstatus_remote.php:
    #   Version: 6.4.3
    #   Build Date: 2020-03-27 14:15:19
    #   Database Version: 139
    unless (version = res.body.scan(/^Version: ([\d.]+)$/).flatten.first)
      return CheckCode::Detected(
        'Target did not respond with Netsweeper version.'
      )
    end

    if Rex::Version.new(version) <= Rex::Version.new('6.4.4')
      return CheckCode::Appears(
        "Netsweeper #{version} is a vulnerable version."
      )
    end

    CheckCode::Safe("Netsweeper #{version} is NOT a vulnerable version.")
  end
Metasploit Module: Linksys WRT160nv2 apply.cgi Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/linksys_wrt160nv2_apply_exec.rb
Platform: unix
Disclosure date: 2013-02-11
References: CVE-2013-10058, BID-57887, EDB-24478, OSVDB-90093, URL-http://www.s3cur1ty.de/m1adv2013-012
Targets: CMD, Linux mipsel Payload

Description:
Some Linksys Routers are vulnerable to an authenticated OS command injection on
          their web interface where default credentials are admin/admin or admin/password.
          Since it is a blind OS command injection vulnerability, there is no output for the
          executed command when using the cmd generic payload. This module has been tested on
          a Linksys WRT160n version 2 - firmware version v2.0.03. A ping command against a
          controlled system could be used for testing purposes. The exploit uses the tftp
          client from the device to stage to native payloads from the command injection.
Metasploit Module: D-Link Devices Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_command_php_exec_noauth.rb
Platform: unix
Disclosure date: 2013-02-04
References: CVE-2013-10048, OSVDB-89861, EDB-24453, BID-57734, URL-http://web.archive.org/web/[PII_REDACTED]1418/http://www.dlink.com/uk/en/home-solutions/connect/routers/dir-600-wireless-n-150-home-router, URL-http://www.s3cur1ty.de/home-network-horror-days, URL-http://www.s3cur1ty.de/m1adv2013-003

Description:
Various D-Link Routers are vulnerable to OS command injection via the web
          interface. The vulnerability exists in command.php, which is accessible without
          authentication. This module has been tested with the versions DIR-600 2.14b01,
          DIR-300 rev B 2.13.
Metasploit Module: Tiki-Wiki CMS Calendar Command Execution
Type: exploit
Path: modules/exploits/linux/http/tiki_calendar_exec.rb
Platform: %w(php)
Disclosure date: 2016-06-06
References: CVE-2025-34113, EDB-39965, URL-https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tiki

Description:
Tiki-Wiki CMS's calendar module contains a remote code execution
          vulnerability within the viewmode GET parameter.
          The calendar module is NOT enabled by default.  If enabled,
          the default permissions are set to NOT allow anonymous users
          to access.

          Vulnerable versions: <=14.1, <=12.4 LTS, <=9.10 LTS and <=6.14
          Verified/Tested against 14.1

Check method (fingerprinting):
if datastore['USERNAME'] && !datastore['USERNAME'].blank?
      cookie = authenticate
    end

    flag = Rex::Text.rand_text_alpha(10)
    res = send_calendar_packet(cookie, "print(#{flag})")

    if res
      if res.body =~ /You do not have permission to view the calendar/i
        fail_with(Failure::NoAccess, "#{peer} - Additional Permissions Required")
      elsif res.body =~ />#{flag}</
        Exploit::CheckCode::Vulnerable('The target is vulnerable')
      else
        Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    end
  end
Metasploit Module: Nagios XI Magpie_debug.php Root Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_magpie_debug.rb
Platform: linux
Disclosure date: 2018-11-14
References: CVE-2018-15708, CVE-2018-15710, EDB-46221, URL-https://medium.com/tenable-techblog/rooting-nagios-via-outdated-libraries-bb79427172, URL-https://www.tenable.com/security/research/tra-2018-37

Description:
This module exploits two vulnerabilities in Nagios XI <= 5.5.6:
          CVE-2018-15708 which allows for unauthenticated remote code execution
          and CVE-2018-15710 which allows for local privilege escalation.
          When combined, these two vulnerabilities allow execution of arbitrary
          commands as root.

Check method (fingerprinting):
res = magpie_debug

    unless res
      return CheckCode::Safe('No reply.')
    end

    if res.code == 200 && res.body.include?('MagpieRSS')
      return CheckCode::Appears('Found MagpieRSS.')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: TAR Path Traversal in Zimbra (CVE-2022-41352)
Type: exploit
Path: modules/exploits/linux/http/zimbra_cpio_cve_2022_41352.rb
Platform: linux
Disclosure date: 2022-06-28
References: CVE-2022-41352, URL-https://forums.zimbra.org/viewtopic.php?t=71153&p=306532, URL-https://blog.zimbra.com/2022/09/security-update-make-sure-to-install-pax-spax/, URL-https://www.openwall.com/lists/oss-security/2015/01/18/7, URL-https://lists.gnu.org/archive/html/bug-cpio/2015-01/msg00000.html, URL-https://attackerkb.com/topics/1DDTvUNFzH/cve-2022-41352/rapid7-analysis, URL-https://attackerkb.com/topics/FdLYrGfAeg/cve-2015-1197/rapid7-analysis, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P27, URL-https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P34

Description:
This module creates a .tar file that can be emailed to a Zimbra server
          to exploit CVE-2022-41352. If successful, it plants a JSP-based
          backdoor in the public web directory, then executes that backdoor.

          The core vulnerability is a path-traversal issue in the cpio command-
          line utlity that can extract an arbitrary file to an arbitrary
          location on a Linux system (CVE-2015-1197). Most Linux distros have
          chosen not to fix it.

          This issue is exploitable on Red Hat-based systems (and other hosts
          without pax installed) running versions:

          * Zimbra Collaboration Suite 9.0.0 Patch 26 (and earlier)
          * Zimbra Collaboration Suite 8.8.15 Patch 33 (and earlier)

          The patch simply makes "pax" a pre-requisite.
Metasploit Module: Symantec Web Gateway 5.0.2.8 Arbitrary PHP File Upload Vulnerability
Type: exploit
Path: modules/exploits/linux/http/symantec_web_gateway_file_upload.rb
Platform: php
Disclosure date: 2012-05-17
References: CVE-2012-0299, OSVDB-82025, BID-53443, ZDI-12-091, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

Description:
This module exploits a file upload vulnerability found in Symantec Web Gateway's
          HTTP service. Due to the incorrect use of file extensions in the upload_file()
          function, attackers may to abuse the spywall/blocked_file.php file in order to
          upload a malicious PHP file without any authentication, which results in arbitrary
          code execution.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/spywall/login.php'
    })

    if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Webmin Package Updates RCE
Type: exploit
Path: modules/exploits/linux/http/webmin_package_updates_rce.rb
Platform: unix
Disclosure date: 2022-07-26
References: EDB-50998, URL-https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165, CVE-2022-36446
Targets: Unix In-Memory, Linux Dropper (x86 & x64), Linux Dropper (ARM64)

Description:
This module exploits an arbitrary command injection in Webmin
          versions prior to 1.997.

          Webmin uses the OS package manager (`apt`, `yum`, etc.) to perform
          package updates and installation. Due to a lack of input
          sanitization, it is possibe to inject arbitrary command that will be
          concatenated to the package manager call.

          This exploit requires authentication and the account must have access
          to the Software Package Updates module.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") unless res

    if res.body.include?('This web server is running in SSL mode.')
      return CheckCode::Unknown("#{peer} - Please enable the SSL option to proceed")
    end

    version = res.headers['Server'].to_s.scan(%r{MiniServ/([\d.]+)}).flatten.first

    return CheckCode::Unknown("#{peer} - Webmin version not detected") unless version

    version = Rex::Version.new(version)

    vprint_status("Webmin #{version} detected")

    unless version < Rex::Version.new('1.997')
      return CheckCode::Safe("#{peer} - Webmin #{version} is not a supported target")
    end

    vprint_good("Webmin #{version} is a supported target")

    CheckCode::Appears("Version #{version} appears to be vulnerable")
  rescue ::Rex::ConnectionError
    return CheckCode::Unknown("#{peer} - Could not connect to web service")
  end
Metasploit Module: GLPI htmLawed php command injection
Type: exploit
Path: modules/exploits/linux/http/glpi_htmlawed_php_injection.rb
Platform: linux
Disclosure date: 2022-01-26
References: CVE-2022-35914, URL-https://github.com/cosad3s/CVE-2022-35914-poc
Targets: Nix Command, Linux (Dropper)

Description:
This exploit takes advantage of a unauthenticated php command injection available
          from GLPI versions 10.0.2 and below to execute a command.

Check method (fingerprinting):
populate_values if @html_doc.nil?
    if @token.nil? || @sid.nil? || @html.nil?
      return Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')
    end
    return Exploit::CheckCode::Appears('The target appears to be vulnerable') if @html.to_s.include?('htmLawed')

    return Exploit::CheckCode::Safe('Unable to determine htmLawed status')
  end
Metasploit Module: Docker Daemon - Unprotected TCP Socket Exploit
Type: exploit
Path: modules/exploits/linux/http/docker_daemon_tcp.rb
Platform: linux
Disclosure date: 2017-07-25
Authors: Martin Pizala
References: URL-https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface, URL-https://docs.docker.com/engine/reference/commandline/dockerd/#bind-docker-to-another-hostport-or-a-unix-socket
Targets: Linux x64, Python

Description:
Utilizing Docker via unprotected tcp socket (2375/tcp, maybe 2376/tcp
          with tls but without tls-auth), an attacker can create a Docker
          container with the '/' path mounted with read/write permissions on the
          host server that is running the Docker container. As the Docker
          container executes command as uid 0 it is honored by the host operating
          system allowing the attacker to edit/create files owned by root. This
          exploit abuses this to creates a cron job in the '/etc/cron.d/' path of
          the host server.

          The Docker image should exist on the target system or be a valid image
          from hub.docker.com.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri('containers', 'json'),
      'ctype' => 'application/json',
      'headers' => { 'Accept' => 'application/json' }
    )

    if res.nil?
      print_error('Failed to connect to the target')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res && res.code == 200 && res.headers['Server'].include?('Docker')
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: F5 iControl iCall::Script Root Command Execution
Type: exploit
Path: modules/exploits/linux/http/f5_icall_cmd.rb
Platform: unix
Disclosure date: 2015-09-03
References: CVE-2015-3628, URL-https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html, URL-https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.html

Description:
This module exploits an authenticated privilege escalation
          vulnerability in the iControl API on the F5 BIG-IP LTM (and likely
          other F5 devices). This requires valid credentials and the Resource
          Administrator role. The exploit should work on BIG-IP 11.3.0
          - 11.6.0, (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references
          for more details)

Check method (fingerprinting):
# strategy: we'll send a create_script request, with empty name:
    # if everything is ok, the server return a 500 error saying it doesn't like empty names
    # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'.
    # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable
    # any other response is considered not vulnerable
    res = create_script('', '')
    if res && res.code == 500 && res.body =~ /path is empty/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    elsif res && res.code == 401
      print_warning("HTTP/#{res.proto} #{res.code} #{res.message} -- incorrect USERNAME or PASSWORD?")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Webmin password_change.cgi Backdoor
Type: exploit
Path: modules/exploits/linux/http/webmin_backdoor.rb
Platform: unix
Disclosure date: 2019-08-10
References: CVE-2019-15107, URL-http://www.webmin.com/exploit.html, URL-https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html, URL-https://blog.firosolutions.com/exploits/webmin/, URL-https://github.com/webmin/webmin/issues/947
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits a backdoor in Webmin versions 1.890 through 1.920.
          Only the SourceForge downloads were backdoored, but they are listed as
          official downloads on the project's site.

          Unknown attacker(s) inserted Perl qx statements into the build server's
          source code on two separate occasions: once in April 2018, introducing
          the backdoor in the 1.890 release, and in July 2018, reintroducing the
          backdoor in releases 1.900 through 1.920.

          Only version 1.890 is exploitable in the default install. Later affected
          versions require the expired password changing feature to be enabled.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    unless res
      vprint_error('Server did not respond')
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.body.include?('This web server is running in SSL mode.')
      print_error('Please enable the SSL option to proceed')
      return CheckCode::Unknown('Could not determine the target status')
    end

    version =
      res.headers['Server'].to_s.scan(%r{MiniServ/([\d.]+)}).flatten.first

    unless version
      vprint_error('Webmin version not detected')
      return CheckCode::Unknown('Could not determine the target status')
    end

    version = Rex::Version.new(version)

    vprint_status("Webmin #{version} detected")

    unless version.between?(*target['Version'])
      vprint_error("Webmin #{version} is not a supported target")
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    vprint_good("Webmin #{version} is a supported target")
    checkcode = CheckCode::Appears("Version #{version} appears to be vulnerable")

    res = execute_command("echo #{token}")

    unless res
      vprint_error('Webmin did not respond to check command')
      return checkcode
    end

    if res.body.include?('Password changing is not enabled!')
      vprint_error('Expired password changing disabled')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    if res.body.include?(token