deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Decrypt Citrix NetScaler Config Secrets
Type: auxiliary
Path: modules/auxiliary/admin/citrix/citrix_netscaler_config_decrypt.rb
Disclosure date: 2022-05-19
Authors: npm[at]cesium137.io
References: URL-https://dozer.nz/posts/citrix-decrypt/, URL-https://www.ferroquesystems.com/resource/citrix-adc-security-kek-files/

Description:
This module takes a Citrix NetScaler ns.conf configuration file as
          input and extracts secrets that have been stored with reversible
          encryption. The module supports legacy NetScaler encryption (RC4)
          as well as the newer AES-256-ECB and AES-256-CBC encryption types.
          It is also possible to decrypt secrets protected by the Key
          Encryption Key (KEK) method, provided the key fragment files F1.key
          and F2.key are provided.
Metasploit Module: Launches Hosts in AWS
Type: auxiliary
Path: modules/auxiliary/admin/aws/aws_launch_instances.rb
References: URL-https://drive.google.com/open?id=0B2Ka7F_6TetSNFdfbkI1cnJHUTQ, URL-https://published-prd.lanyonevents.com/published/rsaus17/sessionsFiles/4721/IDY-W10-DevSecOps-on-the-Offense-Automating-Amazon-Web-Services-Account-Takeover.pdf

Description:
This module will attempt to launch an AWS instances (hosts) in EC2.
Metasploit Module: Apple TV Image Remote Control
Type: auxiliary
Path: modules/auxiliary/admin/appletv/appletv_display_image.rb
References: URL-http://nto.github.io/AirPlay.html

Description:
This module will show an image on an AppleTV device for a period of time.
          Some AppleTV devices are actually password-protected, in that case please
          set the PASSWORD datastore option. For password brute forcing, please see
          the module auxiliary/scanner/http/appletv_login.
Metasploit Module: Apple TV Video Remote Control
Type: auxiliary
Path: modules/auxiliary/admin/appletv/appletv_display_video.rb
References: URL-http://nto.github.io/AirPlay.html

Description:
This module plays a video on an AppleTV device. Note that
          AppleTV can be somewhat picky about the server that hosts the video.
          Tested servers include default IIS, default Apache, and Ruby's WEBrick.
          For WEBrick, the default MIME list may need to be updated, depending on
          what media file is to be played. Python SimpleHTTPServer is not
          recommended. Also, if you're playing a video, the URL must be an IP
          address. Some AppleTV devices are actually password-protected; in that
          case please set the PASSWORD datastore option. For password
          brute forcing, please see the module auxiliary/scanner/http/appletv_login.
Metasploit Module: SAP MaxDB cons.exe Remote Command Injection
Type: auxiliary
Path: modules/auxiliary/admin/maxdb/maxdb_cons_exec.rb
Disclosure date: 2008-01-09
References: OSVDB-40210, BID-27206, CVE-2008-0244

Description:
SAP MaxDB is prone to a remote command-injection vulnerability
          because the application fails to properly sanitize user-supplied input.
Metasploit Module: Microsoft SQL Server SQLi Escalate Db_Owner
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb
References: URL-http://technet.microsoft.com/en-us/library/ms188676(v=sql.105).aspx

Description:
This module can be used to escalate SQL Server user privileges to sysadmin through a web
          SQL Injection. In order to escalate, the database user must to have the db_owner role in
          a trustworthy database owned by a sysadmin user. Once the database user has the sysadmin
          role, the mssql_payload_sqli module can be used to obtain a shell on the system.

          The syntax for injection URLs is: /testing.asp?id=1+and+1=[SQLi];--
Metasploit Module: Microsoft SQL Server SQLi SUSER_SNAME Windows Domain Account Enumeration
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_enum_domain_accounts_sqli.rb
References: URL-https://docs.microsoft.com/en-us/sql/t-sql/functions/suser-sname-transact-sql

Description:
This module can be used to bruteforce RIDs associated with the domain of the SQL Server
          using the SUSER_SNAME function via Error Based SQL injection. This is similar to the
          smb_lookupsid module, but executed through SQL Server queries as any user with the PUBLIC
          role (everyone). Information that can be enumerated includes Windows domain users, groups,
          and computer accounts.  Enumerated accounts can then be used in online dictionary attacks.
          The syntax for injection URLs is: /testing.asp?id=1+and+1=[SQLi];--
Metasploit Module: Microsoft SQL Server SUSER_SNAME Windows Domain Account Enumeration
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_enum_domain_accounts.rb
References: URL-https://docs.microsoft.com/en-us/sql/t-sql/functions/suser-sname-transact-sql

Description:
This module can be used to bruteforce RIDs associated with the domain of the SQL Server
          using the SUSER_SNAME function. This is similar to the smb_lookupsid module, but executed
          through SQL Server queries as any user with the PUBLIC role (everyone). Information that
          can be enumerated includes Windows domain users, groups, and computer accounts. Enumerated
          accounts can then be used in online dictionary attacks.
Metasploit Module: Microsoft SQL Server SQLi NTLM Stealer
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_ntlm_stealer_sqli.rb
References: URL-https://en.wikipedia.org/wiki/SMBRelay

Description:
This module can be used to help capture or relay the LM/NTLM credentials of the
          account running the remote SQL Server service. The module will use the SQL
          injection from GET_PATH to connect to the target SQL Server instance and execute
          the native "xp_dirtree" or stored procedure.   The stored procedures will then
          force the service account to authenticate to the system defined in the SMBProxy
          option. In order for the attack to be successful, the SMB capture or relay module
          must be running on the system defined as the SMBProxy. The database account used to
          connect to the database should only require the "PUBLIC" role to execute.
          Successful execution of this attack usually results in local administrative access
          to the Windows system.  Specifically, this works great for relaying credentials
          between two SQL Servers using a shared service account to get shells.  However, if
          the relay fails, then the LM hash can be reversed using the Halflm rainbow tables
          and john the ripper.
Metasploit Module: Microsoft SQL Server Escalate Db_Owner
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_escalate_dbowner.rb
References: URL-http://technet.microsoft.com/en-us/library/ms188676(v=sql.105).aspx

Description:
This module can be used to escalate privileges to sysadmin if the user has
          the db_owner role in a trustworthy database owned by a sysadmin user.  Once
          the user has the sysadmin role the msssql_payload module can be used to obtain
          a shell on the system.
Metasploit Module: Microsoft SQL Server Find and Sample Data
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_findandsampledata.rb
References: URL-http://www.netspi.com/blog/author/ssutherland/

Description:
This script will search through all of the non-default databases
          on the SQL Server for columns that match the keywords defined in the TSQL KEYWORDS
          option. If column names are found that match the defined keywords and data is present
          in the associated tables, the script will select a sample of the records from each of
          the affected tables.  The sample size is determined by the SAMPLE_SIZE option, and results
          output in a CSV format.
Metasploit Module: Microsoft SQL Server Configuration Enumerator
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_enum.rb

Description:
This module will perform a series of configuration audits and
          security checks against a Microsoft SQL Server database. For this
          module to work, valid administrative user credentials must be
          supplied.
Metasploit Module: Microsoft SQL Server Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_exec.rb
References: URL-http://msdn.microsoft.com/en-us/library/cc448435(PROT.10).aspx, URL-https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-oacreate-transact-sql

Description:
This module will execute a Windows command on a MSSQL/MSDE instance via the xp_cmdshell (default) or the
          sp_oacreate procedure (more opsec safe, no output, no temporary data table). A valid username and password is
          required to use this module.
Metasploit Module: Microsoft SQL Server SUSER_SNAME SQL Logins Enumeration
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_enum_sql_logins.rb
Authors: nullbind <scott.sutherland[at]netspi.com>
References: URL-https://docs.microsoft.com/en-us/sql/t-sql/functions/suser-sname-transact-sql

Description:
This module can be used to obtain a list of all logins from a SQL Server with any login.
          Selecting all of the logins from the master..syslogins table is restricted to sysadmins.
          However, logins with the PUBLIC role (everyone) can quickly enumerate all SQL Server
          logins using the SUSER_SNAME function by fuzzing the principal_id parameter. This is
          pretty simple, because the principal IDs assigned to logins are incremental.  Once logins
          have been enumerated they can be verified via sp_defaultdb error analysis. This is
          important, because not all of the principal IDs resolve to SQL logins (some resolve to
          roles instead). Once logins have been enumerated, they can be used in dictionary attacks.
Metasploit Module: Microsoft SQL Server Generic Query
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_sql.rb
References: URL-http://www.attackresearch.com, URL-http://msdn.microsoft.com/en-us/library/cc448435(PROT.10).aspx

Description:
This module will allow for simple SQL statements to be executed against a
          MSSQL/MSDE instance given the appropriate credentials.
Metasploit Module: Microsoft SQL Server Interesting Data Finder
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_idf.rb
References: URL-http://www.digininja.org/metasploit/mssql_idf.php

Description:
This module will search the specified MSSQL server for
          'interesting' columns and data.

          This module has been tested against the latest SQL Server 2019 docker container image (22/04/2021).
Metasploit Module: Microsoft SQL Server Generic Query from File
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_sql_file.rb

Description:
This module will allow for multiple SQL queries contained within a specified
          file to be executed against a Microsoft SQL (MSSQL) Server instance, given
          the appropriate credentials.
Metasploit Module: Microsoft SQL Server Escalate EXECUTE AS
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_escalate_execute_as.rb
Authors: nullbind <scott.sutherland[at]netspi.com>
References: URL-http://msdn.microsoft.com/en-us/library/ms178640.aspx

Description:
This module can be used escalate privileges if the IMPERSONATION privilege has been
          assigned to the user. In most cases, this results in additional data access, but in
          some cases it can be used to gain sysadmin privileges.
Metasploit Module: Microsoft SQL Server NTLM Stealer
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_ntlm_stealer.rb
References: URL-https://en.wikipedia.org/wiki/SMBRelay

Description:
This module can be used to help capture or relay the LM/NTLM credentials of the
          account running the remote SQL Server service. The module will use the supplied
          credentials to connect to the target SQL Server instance and execute the native
          "xp_dirtree" or "xp_fileexist" stored procedure.   The stored procedures will then
          force the service account to authenticate to the system defined in the SMBProxy
          option. In order for the attack to be successful, the SMB capture or relay module
          must be running on the system defined as the SMBProxy.  The database account used
          to connect to the database should only require the "PUBLIC" role to execute.
          Successful execution of this attack usually results in local administrative access
          to the Windows system.  Specifically, this works great for relaying credentials
          between two SQL Servers using a shared service account to get shells.  However, if
          the relay fails, then the LM hash can be reversed using the Halflm rainbow tables
          and john the ripper. Thanks to "Sh2kerr" who wrote the ora_ntlm_stealer for the
          inspiration.
Metasploit Module: Microsoft SQL Server SQLi Escalate Execute AS
Type: auxiliary
Path: modules/auxiliary/admin/mssql/mssql_escalate_execute_as_sqli.rb
Authors: nullbind <scott.sutherland[at]netspi.com>
References: URL-http://msdn.microsoft.com/en-us/library/ms178640.aspx

Description:
This module can be used escalate privileges if the IMPERSONATION privilege has been
          assigned to the user via error based SQL injection.  In most cases, this results in
          additional data access, but in some cases it can be used to gain sysadmin privileges.
          The syntax for injection URLs is: /testing.asp?id=1+and+1=[SQLi];--
Metasploit Module: Zend Server Java Bridge Design Flaw Remote Code Execution
Type: auxiliary
Path: modules/auxiliary/admin/zend/java_bridge.rb
Disclosure date: 2011-03-28
References: OSVDB-71420, ZDI-11-113, EDB-17078

Description:
This module abuses a flaw in the Zend Java Bridge Component of
          the Zend Server Framework. By sending a specially crafted packet, an
          attacker may be able to execute arbitrary code.

          NOTE: This module has only been tested with the Win32 build of the software.
Metasploit Module: VMware vCenter Forge SAML Authentication Credentials
Type: auxiliary
Path: modules/auxiliary/admin/vmware/vcenter_forge_saml_token.rb
Disclosure date: 2022-04-20
Authors: npm[at]cesium137.io
References: URL-https://www.horizon3.ai/compromising-vcenter-via-saml-certificates/

Description:
This module forges valid SAML credentials for vCenter server
          using the vCenter SSO IdP certificate, IdP private key, and
          VMCA certificates as input objects; you must also  provide
          the vCenter SSO domain name and vCenter FQDN. The module will
          return a session cookie for the /ui path that grants access to
          the SSO domain as a vSphere administrator. The IdP trusted
          certificate chain can be retrieved using Metasploit post
          exploitation modules or extracted manually from
          /storage/db/vmware-vmdir/data.mdb using binwalk.
Metasploit Module: VMware vCenter Extract Secrets from vmdir / vmafd DB File
Type: auxiliary
Path: modules/auxiliary/admin/vmware/vcenter_offline_mdb_extract.rb
Disclosure date: 2022-05-10
Authors: npm[at]cesium137.io
References: URL-https://www.horizon3.ai/compromising-vcenter-via-saml-certificates/

Description:
Grab certificates from the vCenter server vmdird and vmafd
          database files and adds them to loot. The vmdird MDB database file
          can be found on the live appliance under the path
          /storage/db/vmware-vmdir/data.mdb, and the DB vmafd is under path
          /storage/db/vmware-vmafd/afd.db. The vmdir database contains the
          IdP signing credential, and vmafd contains the vCenter certificate
          store. This module will accept either file from a live vCenter
          appliance, or from a vCenter appliance backup archive; either or
          both files can be supplied.
Metasploit Module: NetBIOS Response Brute Force Spoof (Direct)
Type: auxiliary
Path: modules/auxiliary/admin/netbios/netbios_spoof.rb

Description:
This module continuously spams NetBIOS responses to a target for given hostname,
        causing the target to cache a malicious address for this name. On high-speed local
        networks, the PPSRATE value should be increased to speed up this attack. As an
        example, a value of around 30,000 is almost 100% successful when spoofing a
        response for a 'WPAD' lookup. Distant targets may require more time and lower
        rates for a successful attack.
Metasploit Module: Chromecast Factory Reset DoS
Type: auxiliary
Path: modules/auxiliary/admin/chromecast/chromecast_reset.rb
Authors: wvu
References: URL-http://www.google.com/intl/en/chrome/devices/chromecast/index.html

Description:
This module performs a factory reset on a Chromecast, causing a denial of service (DoS).
          No user authentication is required.
Metasploit Module: Chromecast YouTube Remote Control
Type: auxiliary
Path: modules/auxiliary/admin/chromecast/chromecast_youtube.rb
Authors: wvu
References: URL-http://www.google.com/intl/en/chrome/devices/chromecast/index.html

Description:
This module acts as a simple remote control for Chromecast YouTube.

          Only the deprecated DIAL protocol is supported by this module.
          Casting via the newer CASTV2 protocol is unsupported at this time.
Metasploit Module: MySQL SQL Generic Query
Type: auxiliary
Path: modules/auxiliary/admin/mysql/mysql_sql.rb

Description:
This module allows for simple SQL statements to be executed
          against a MySQL instance given the appropriate credentials.
Metasploit Module: MySQL Enumeration Module
Type: auxiliary
Path: modules/auxiliary/admin/mysql/mysql_enum.rb
References: URL-https://cisecurity.org/benchmarks.html

Description:
This module allows for simple enumeration of MySQL Database Server
          provided proper credentials to connect remotely.
Metasploit Module: 2Wire Cross-Site Request Forgery Password Reset Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/2wire/xslt_password_reset.rb
Disclosure date: 2007-08-15
References: CVE-2007-4387, OSVDB-37667, BID-36075, URL-https://seclists.org/bugtraq/2007/Aug/225

Description:
This module will reset the admin password on a 2Wire wireless router.  This is
          done by using the /xslt page where authentication is not required, thus allowing
          configuration changes (such as resetting the password) as administrators.
Metasploit Module: Moxa Device Credential Retrieval
Type: auxiliary
Path: modules/auxiliary/admin/scada/moxa_credentials_recovery.rb
Disclosure date: 2015-07-28
References: CVE-2016-9361, BID-85965, URL-https://www.digitalbond.com/blog/2016/10/25/serial-killers/, URL-https://github.com/reidmefirst/MoxaPass/blob/master/moxa_getpass.py, URL-https://ics-cert.us-cert.gov/advisories/ICSA-16-336-02

Description:
The Moxa protocol listens on 4800/UDP and will respond to broadcast
          or direct traffic.  The service is known to be used on Moxa devices
          in the NPort, OnCell, and MGate product lines.  Many devices with
          firmware versions older than 2017 or late 2016 allow admin credentials
          and SNMP read and read/write community strings to be retrieved without
          authentication.

          This module is the work of Patrick DeSantis of Cisco Talos and K. Reid
          Wightman.

          Tested on: Moxa NPort 6250 firmware v1.13, MGate MB3170 firmware 2.5,
          and NPort 5110 firmware 2.6.

Check method (fingerprinting):
connect_udp

    begin
      # send the identify command
      udp_sock.put("\x01\x00\x00\x08\x00\x00\x00\x00")
      response = udp_sock.get(3)
    end

    unless response
      vprint_error('Unknown response')
      return Exploit::CheckCode::Unknown('No response from target')
    end

    # A valid response is 24 bytes, starts with 0x81, and contains the values
    # 0x00, 0x90, 0xe8 (the Moxa OIU) in bytes 14, 15, and 16.
    if response[0] == "\x81" && response[14..16] == "\x00\x90\xe8" && response.length == 24
      format_output(response)
      return Exploit::CheckCode::Appears('Moxa device detected via proprietary protocol')
    end

    cleanup

    Exploit::CheckCode::Safe('Target does not appear to be a Moxa device')
  end
Metasploit Module: PhoenixContact PLC Remote START/STOP Command
Type: auxiliary
Path: modules/auxiliary/admin/scada/phoenix_command.rb
Disclosure date: 2015-05-20
Authors: Tijl Deneut <tijl.deneut[at]howest.be>
References: URL-https://github.com/tijldeneut/ICSSecurityScripts, CVE-2014-9195

Description:
PhoenixContact Programmable Logic Controllers are built upon a variant of
          ProConOS. Communicating using a proprietary protocol over ports TCP/1962
          and TCP/41100 or TCP/20547.
          It allows a remote user to read out the PLC Type, Firmware and
          Build number on port TCP/1962.
          And also to read out the CPU State (Running or Stopped) AND start
          or stop the CPU on port TCP/41100 (confirmed ILC 15x and 17x series)
          or on port TCP/20547 (confirmed ILC 39x series)
Metasploit Module: Schneider Modicon Quantum Password Recovery
Type: auxiliary
Path: modules/auxiliary/admin/scada/modicon_password_recovery.rb
Disclosure date: 2012-01-19
References: URL-http://www.digitalbond.com/tools/basecamp/metasploit-modules/

Description:
The Schneider Modicon Quantum series of Ethernet cards store usernames and
          passwords for the system in files that may be retrieved via backdoor access.

          This module is based on the original 'modiconpass.rb' Basecamp module from
          DigitalBond.

Check method (fingerprinting):
is_modicon = false
    vprint_status "#{ip}:#{rport} - FTP - Checking fingerprint"
    begin
      connect
    rescue StandardError
      nil
    end
    if sock
      # It's a weak fingerprint, but it's something
      is_modicon = check_banner
      disconnect
    else
      vprint_error "#{ip}:#{rport} - FTP - Cannot connect, skipping"
      return Exploit::CheckCode::Unknown('Failed to connect via FTP')
    end

    if is_modicon
      vprint_status "#{ip}:#{rport} - FTP - Matches Modicon fingerprint"
      return Exploit::CheckCode::Detected('FTP banner matches Modicon fingerprint')
    end

    vprint_error "#{ip}:#{rport} - FTP - Skipping due to fingerprint mismatch"

    return Exploit::CheckCode::Safe('FTP banner does not match Modicon fingerprint')
  end
Metasploit Module: Yokogawa BKBCopyD.exe Client
Type: auxiliary
Path: modules/auxiliary/admin/scada/yokogawa_bkbcopyd_client.rb
Disclosure date: 2014-08-09
References: CVE-2014-5208, URL-https://www.rapid7.com/blog/post/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access

Description:
This module allows an unauthenticated user to interact with the Yokogawa
          CENTUM CS3000 BKBCopyD.exe service through the PMODE, RETR and STOR
          operations.
Metasploit Module: Schneider Modicon Ladder Logic Upload/Download
Type: auxiliary
Path: modules/auxiliary/admin/scada/modicon_stux_transfer.rb
Disclosure date: 2012-04-05
References: URL-http://www.digitalbond.com/tools/basecamp/metasploit-modules/

Description:
The Schneider Modicon with Unity series of PLCs use Modbus function
          code 90 (0x5a) to send and receive ladder logic.  The protocol is
          unauthenticated, and allows a rogue host to retrieve the existing
          logic and to upload new logic.

          Two modes are supported: "SEND" and "RECV," which behave as one might
          expect -- use 'set mode ACTIONAME' to use either mode of operation.

          In either mode, FILENAME must be set to a valid path to an existing
          file (for SENDing) or a new file (for RECVing), and the directory must
          already exist.  The default, 'modicon_ladder.apx' is a blank
          ladder logic file which can be used for testing.

          This module is based on the original 'modiconstux.rb' Basecamp module from
          DigitalBond.