deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Server 2012 SrClient DLL hijacking
Type: exploit
Path: modules/exploits/windows/local/srclient_dll_hijacking.rb
Platform: win
Disclosure date: 2021-02-19
References: URL-https://blog.vonahi.io/srclient-dll-hijacking
Targets: Windows Server 2012 (x64)

Description:
All editions of Windows Server 2012 (but not 2012 R2) are vulnerable to DLL
          hijacking due to the way TiWorker.exe will try to call the non-existent
          `SrClient.dll` file when Windows Update checks for updates. This issue can be
          leveraged for privilege escalation if %PATH% includes directories that are
          writable by low-privileged users. The attack can be triggered by any
          low-privileged user and does not require a system reboot.

          This module has been successfully tested on Windows Server 2012 (x64).

Check method (fingerprinting):
version = get_version_info
    unless version.build_number == Msf::WindowsVersion::Server2012 && version.windows_server?
      return Exploit::CheckCode::Safe('Target is not Windows Server 2012.')
    end

    print_status("Target is #{version.product_name}")

    # obtain the Windows Update setting to see if exploitation could work at all
    @wupdate_setting = registry_getvaldata('HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update', 'AUOptions')

    if @wupdate_setting.nil?
      # if this is true, Windows Update has probably never been configured on the target, and the attack most likely won't work.
      return Exploit::CheckCode::Safe('Target is Windows Server 2012, but cannot be exploited because Windows Update has not been configured.')
    end

    unless (1..4).include?(@wupdate_setting)
      return Exploit::CheckCode::Unknown('Received unexpected reply when trying to obtain the Windows Update setting.')
    end

    # get groups for the current user, this is necessary to verify write permissions
    current_user = session.sys.config.getuid
    user_groups = grab_user_groups(current_user)

    # get %PATH% dirs and check if the current user can write to them
    print_status('Checking for writable directories in %PATH%...')
    # we can't use get_envs('PATH') here because that returns all PATH directories, but we only need those in the SYSTEM PATH
    path_dirs = registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Mana
Metasploit Module: MQAC.sys Arbitrary Write Privilege Escalation
Type: exploit
Path: modules/exploits/windows/local/mqac_write.rb
Platform: win
Disclosure date: 2014-07-22
References: CVE-2014-4971, EDB-34112, URL-https://www.korelogic.com/Resources/Advisories/KL-001-2014-003.txt

Description:
A vulnerability within the MQAC.sys module allows an attacker to
          overwrite an arbitrary location in kernel memory.

          This module will elevate itself to SYSTEM, then inject the payload
          into another SYSTEM process.

Check method (fingerprinting):
handle = open_device('\\\\.\\MQAC', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
    if handle.nil?
      print_error('MSMQ installation not found')
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
    session.railgun.kernel32.CloseHandle(handle)

    version = get_version_info
    if version.build_number == Msf::WindowsVersion::XP_SP3
      return Exploit::CheckCode::Appears("Version #{version} appears vulnerable")
    elsif version.xp_or_2003? && !version.windows_server?
      vprint_error('Unsupported version of Windows XP detected')
      return Exploit::CheckCode::Detected("Version #{version} detected but not confirmed vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Windows 10 UAC Protection Bypass Via Windows Store (WSReset.exe)
Type: exploit
Path: modules/exploits/windows/local/bypassuac_windows_store_filesys.rb
Platform: win
Disclosure date: 2019-08-22
References: URL-https://heynowyouseeme.blogspot.com/2019/08/windows-10-lpe-uac-bypass-in-windows.html, URL-https://github.com/sailay1996/UAC_bypass_windows_store, URL-https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e

Description:
This module exploits a flaw in the WSReset.exe Windows Store Reset Tool. The tool
          is run with the "autoElevate" property set to true, however it can be moved to
          a new Windows directory containing a space (C:\Windows \System32\) where, upon
          execution, it will load our payload dll (propsys.dll).

Check method (fingerprinting):
version = get_version_info
    if version.build_number > Msf::WindowsVersion::Win10_InitialRelease && !version.windows_server? && exists?('C:\\Windows\\System32\\WSReset.exe')
      return CheckCode::Appears("Version #{version} appears vulnerable")
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Kerio Firewall 2.1.4 Authentication Packet Overflow
Type: exploit
Path: modules/exploits/windows/firewall/kerio_auth.rb
Platform: win
Disclosure date: 2003-04-28
Authors: MC
References: CVE-2003-0220, OSVDB-6294, BID-7180

Description:
This module exploits a stack buffer overflow in Kerio Personal Firewall
          administration authentication process. This module has only been tested
          against Kerio Personal Firewall 2 (2.1.4).
Metasploit Module: ISS PAM.dll ICQ Parser Buffer Overflow
Type: exploit
Path: modules/exploits/windows/firewall/blackice_pam_icq.rb
Platform: win
Disclosure date: 2004-03-18
Authors: spoonm
References: CVE-2004-0362, OSVDB-4355, URL-http://www.eeye.com/html/Research/Advisories/AD20040318.html

Description:
This module exploits a stack buffer overflow in the ISS products that use
          the iss-pam1.dll ICQ parser (Blackice/RealSecure). Successful exploitation
          will result in arbitrary code execution as LocalSystem. This exploit
          only requires 1 UDP packet, which can be both spoofed and sent to a broadcast
          address.

          The ISS exception handler will recover the process after each overflow, giving
          us the ability to bruteforce the service and exploit it multiple times.
Metasploit Module: MS02-056 Microsoft SQL Server Hello Overflow
Type: exploit
Path: modules/exploits/windows/mssql/ms02_056_hello.rb
Platform: win
Disclosure date: 2002-08-05
References: CVE-2002-1123, OSVDB-10132, BID-5411, MSB-MS02-056

Description:
By sending malformed data to TCP port 1433, an
          unauthenticated remote attacker could overflow a buffer and
          possibly execute code on the server with SYSTEM level
          privileges. This module should work against any vulnerable
          SQL Server 2000 or MSDE install (< SP3).

Check method (fingerprinting):
info = mssql_ping
    if (info['ServerName'])
      print_status("SQL Server Information:")
      info.each_pair { |k, v|
        print_status("   #{k + (" " * (15 - k.length))} = #{v}")
      }
      return Exploit::CheckCode::Detected('MSSQL Server detected via ping')
    end
    return Exploit::CheckCode::Safe('MSSQL Server not detected via ping')
  end
Metasploit Module: Microsoft SQL Server Clr Stored Procedure Payload Execution
Type: exploit
Path: modules/exploits/windows/mssql/mssql_clr_payload.rb
Platform: win
Disclosure date: 1999-01-01
References: URL-https://web.archive.org/web/[PII_REDACTED]1536/http://sekirkity.com/command-execution-in-sql-server-via-fileless-clr-based-custom-stored-procedure/

Description:
This module executes an arbitrary native payload on a Microsoft SQL
          server by loading a custom SQL CLR Assembly into the target SQL
          installation, and calling it directly with a base64-encoded payload.

          The module requires working credentials in order to connect directly to the
          MSSQL Server.

          This method requires the user to have sufficient privileges to install a custom
          SQL CRL DLL, and invoke the custom stored procedure that comes with it.

          This exploit does not leave any binaries on disk.

          Tested on MS SQL Server versions: 2005, 2012, 2016 (all x64).

Check method (fingerprinting):
unless mssql_login_datastore(datastore['DATABASE'])
      vprint_status('Invalid SQL Server credentials')
      return Exploit::CheckCode::Detected('Connected to SQL Server but credentials may be invalid')
    end

    version = get_sql_version_string

    unless version =~ /Server 20(05|08|12|14|16)/
      vprint_status('Unsupported version of SQL Server')
      return Exploit::CheckCode::Safe("SQL Server version #{version} is not supported")
    end

    if mssql_is_sysadmin
      vprint_good "User #{datastore['USERNAME']} is a sysadmin"
      Exploit::CheckCode::Vulnerable("User #{datastore['USERNAME']} is a sysadmin on #{version}")
    else
      Exploit::CheckCode::Safe("User #{datastore['USERNAME']} is not a sysadmin")
    end
  ensure
    disconnect
  end
Metasploit Module: Microsoft SQL Server Database Link Crawling Command Execution
Type: exploit
Path: modules/exploits/windows/mssql/mssql_linkcrawler.rb
Disclosure date: 2000-01-01
References: URL-http://www.slideshare.net/nullbind/sql-server-exploitation-escalation-pilfering-appsec-usa-2012, URL-http://msdn.microsoft.com/en-us/library/ms188279.aspx, URL-http://www.exploit-monday.com/2011_10_16_archive.html

Description:
This module can be used to crawl MS SQL Server database links and deploy
          Metasploit payloads through links configured with sysadmin privileges using a
          valid SQL Server Login.

          If you are attempting to obtain multiple reverse shells using this module we
          recommend setting the "DisablePayloadHandler" advanced option to "true", and setting
          up a exploit/multi/handler to run in the background as a job to support multiple incoming
          shells.

          If you are interested in deploying payloads to specific servers this module also
          supports that functionality via the "DEPLOYLIST" option.

          Currently, the module is capable of delivering payloads to both 32bit and 64bit
          Windows systems via powershell memory injection methods based on Matthew Graeber's
          work. As a result, the target server must have powershell installed. By default,
          all of the crawl information is saved to a CSV formatted log file and MSF loot so
          that the tool can also be used for auditing without deploying payloads.
Metasploit Module: Microsoft SQL Server Payload Execution
Type: exploit
Path: modules/exploits/windows/mssql/mssql_payload.rb
Platform: win
Disclosure date: 2000-05-30
References: CVE-2000-0402, OSVDB-557, BID-1281, CVE-2000-1209, OSVDB-15757, BID-4797

Description:
This module executes an arbitrary payload on a Microsoft SQL Server by using
          the "xp_cmdshell" stored procedure. Currently, three delivery methods are supported.

          First, the original method uses Windows 'debug.com'. File size restrictions are
          avoided by incorporating the debug bypass method presented by SecureStat at
          Defcon 17. Since this method invokes ntvdm, it is not available on x64 systems.

          A second method takes advantage of the Command Stager subsystem. This allows using
          various techniques, such as using a TFTP server, to send the executable. By default
          the Command Stager uses 'wcsript.exe' to generate the executable on the target.

          Finally, ReL1K's latest method utilizes PowerShell to transmit and recreate the
          payload on the target.

          NOTE: This module will leave a payload executable on the target system when the
          attack is finished.

Check method (fingerprinting):
if session
      set_mssql_session(session.client)
    end

    unless session || mssql_login_datastore
      vprint_status("Invalid SQL Server credentials")
      return Exploit::CheckCode::Detected('Connected to SQL Server but credentials may be invalid')
    end

    mssql_query("select @@version", true)
    if mssql_is_sysadmin
      vprint_good "User #{datastore['USERNAME']} is a sysadmin"
      Exploit::CheckCode::Vulnerable("User #{datastore['USERNAME']} is a sysadmin")
    else
      Exploit::CheckCode::Safe("User #{datastore['USERNAME']} is not a sysadmin")
    end
  ensure
    disconnect
  end

  # This is method required for the CmdStager to work...
Metasploit Module: MS02-039 Microsoft SQL Server Resolution Overflow
Type: exploit
Path: modules/exploits/windows/mssql/ms02_039_slammer.rb
Platform: win
Disclosure date: 2002-07-24
References: CVE-2002-0649, OSVDB-4578, BID-5310, MSB-MS02-039

Description:
This is an exploit for the SQL Server 2000 resolution
          service buffer overflow. This overflow is triggered by
          sending a udp packet to port 1434 which starts with 0x04 and
          is followed by long string terminating with a colon and a
          number. This module should work against any vulnerable SQL
          Server 2000 or MSDE install (pre-SP3).

Check method (fingerprinting):
info = mssql_ping
    if (info['ServerName'])
      print_status("SQL Server Information:")
      info.each_pair { |k, v|
        print_status("   #{k + (" " * (15 - k.length))} = #{v}")
      }
      return Exploit::CheckCode::Detected('MSSQL Server detected via ping')
    end
    return Exploit::CheckCode::Safe('MSSQL Server not detected via ping')
  end
Metasploit Module: Lyris ListManager MSDE Weak sa Password
Type: exploit
Path: modules/exploits/windows/mssql/lyris_listmanager_weak_pass.rb
Platform: win
Disclosure date: 2005-12-08
References: CVE-2005-4145, OSVDB-21559

Description:
This module exploits a weak password vulnerability in the
          Lyris ListManager MSDE install. During installation, the 'sa'
          account password is set to 'lminstall'. Once the install
          completes, it is set to 'lyris' followed by the process
          ID of the installer. This module brute forces all possible
          process IDs that would be used by the installer.
Metasploit Module: Microsoft SQL Server Payload Execution via SQL Injection
Type: exploit
Path: modules/exploits/windows/mssql/mssql_payload_sqli.rb
Platform: win
Disclosure date: 2000-05-30
References: CVE-2000-0402, OSVDB-557, BID-1281, CVE-2000-1209, OSVDB-15757, BID-4797, URL-http://www.secforce.co.uk/blog/2011/01/penetration-testing-sql-injection-and-metasploit/

Description:
This module will execute an arbitrary payload on a Microsoft SQL
          Server, using a SQL injection vulnerability.

          Once a vulnerability is identified this module
          will use xp_cmdshell to upload and execute Metasploit payloads.
          It is necessary to specify the exact point where the SQL injection
          vulnerability happens. For example, given the following injection:

          http://www.example.com/show.asp?id=1;exec xp_cmdshell 'dir';--&cat=electrical

          you would need to set the following path:
          set GET_PATH /showproduct.asp?id=1;[SQLi];--&cat=foobar

          In regard to the payload, unless there is a closed port in the web server,
          you dont want to use any "bind" payload, specially on port 80, as you will
          stop reaching the vulnerable web server host. You want a "reverse" payload, probably to
          your port 80 or to any other outbound port allowed on the firewall.
          For privileged ports execute Metasploit msfconsole as root.

          Currently, three delivery methods are supported.

          First, the original method uses Windows 'debug.com'. File size restrictions are
          avoided by incorporating the debug bypass method presented by SecureStat at
          Defcon 17. Since this method invokes ntvdm, it is not available on x64 systems.

          A second method takes advantage of the Command Stager subsystem. This allows using
          various techniques, such as using a TFTP server, to send the executable. By default
          the Command Stager uses 'wcsript.exe' to generate the executable on the target.

          Finally, ReL1K's latest method utilizes PowerShell to transmit and recreate the
          payload on the target.

          NOTE: This module will leave a payload executable on the target system when the
          attack is finished.
Metasploit Module: Arkeia Backup Client Type 77 Overflow (Win32)
Type: exploit
Path: modules/exploits/windows/arkeia/type77.rb
Platform: win
Disclosure date: 2005-02-18
References: CVE-2005-0491, OSVDB-14011, BID-12594, URL-http://lists.netsys.com/pipermail/full-disclosure/2005-February/031831.html

Description:
This module exploits a stack buffer overflow in the Arkeia backup
          client for the Windows platform. This vulnerability affects
          all versions up to and including 5.3.3.

Check method (fingerprinting):
info = arkeia_info
    if !(info and info['Version'])
      return Exploit::CheckCode::Safe('Could not retrieve Arkeia server version')
    end

    vprint_status('Arkeia Server Information:')
    info.each_pair do |k, v|
      vprint_status("   #{k + (' ' * (30 - k.length))} = #{v}")
    end

    if (info['System'] !~ /Windows/)
      vprint_status('This module only supports Windows targets')
      return Exploit::CheckCode::Detected("Arkeia detected on #{info['System']} but this module only supports Windows")
    end

    if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
      return Exploit::CheckCode::Appears("Arkeia #{info['Version']} appears vulnerable")
    end

    return Exploit::CheckCode::Safe("Arkeia #{info['Version']} does not appear to be vulnerable")
  end
Metasploit Module: Windows Persistent Startup Folder
Type: exploit
Path: modules/exploits/windows/persistence/startup_folder.rb
Disclosure date: 1995-01-01
References: URL-https://support.microsoft.com/en-us/windows/configure-startup-applications-in-windows-115a420a-0bff-4a6f-90e0-1934c844e473

Description:
This module establishes persistence by creating a payload in the user or system startup folder.
          Works on Vista and newer systems.

Check method (fingerprinting):
f = folder
    begin
      # windows only ps payloads have writable? so try that first
      return CheckCode::Safe("Unable to write to #{f}") unless writable?(f)
    rescue RuntimeError
      filename = f + '\\' + Rex::Text.rand_text_alpha((rand(6..13)))
      write_file(filename, '')
      if exists? filename
        rm_f(filename)
        return CheckCode::Appears("Likely exploitable, able to write test file to #{f}")
      else
        return CheckCode::Safe("Unable to write to #{f}")
      end
    end

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Windows Persistent Task Scheduler
Type: exploit
Path: modules/exploits/windows/persistence/task_scheduler.rb
Disclosure date: 1998-05-15
References: URL-https://learn.microsoft.com/en-us/windows/win32/taskschd/task-scheduler-start-page

Description:
This module establishes persistence by creating a scheduled task to run a payload.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesn't exist") unless exists?(writable_dir)

    begin
      get_system_privs
    rescue StandardError
      return CheckCode::Safe('You need higher privileges to create scheduled tasks ')
    end

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Windows Silent Process Exit Persistence
Type: exploit
Path: modules/exploits/windows/persistence/image_exec_options.rb
Disclosure date: 2008-06-28
References: URL-https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/

Description:
Windows allows you to set up a debug process when a process exits.
          This module uploads a payload and declares that it is the debug
          process to launch when a specified process exits.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    return CheckCode::Safe('You must be System to run this Module') unless is_system?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Accessibility Features (Sticky Keys) Persistence via Debugger Registry Key
Type: exploit
Path: modules/exploits/windows/persistence/accessibility_features_debugger.rb
Platform: win
Disclosure date: 1995-04-24
References: URL-https://web.archive.org/web/[PII_REDACTED]4448/https://social.technet.microsoft.com/Forums/windows/en-US/a3968ec9-5824-4bc2-82a2-a37ea88c273a/sticky-keys-exploit, URL-https://blog.carnal0wnage.com/2012/04/privilege-escalation-via-sticky-keys.html, URL-https://support.microsoft.com/en-us/windows/appendix-b-narrator-keyboard-commands-and-touch-gestures-8bdab3f4-b3e9-4554-7f28-8b15bd37410a, URL-https://blogs.msdn.microsoft.com/mithuns/2010/03/24/image-file-execution-options-ifeo/

Description:
This module makes it possible to apply the 'sticky keys' hack to a session with appropriate
          rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP
          login screen or via a UAC confirmation dialog. The module modifies the Debug registry setting
          for certain executables.

          The module options allow for this hack to be applied to:

          SETHC   (sethc.exe is invoked when SHIFT is pressed 5 times),
          UTILMAN (Utilman.exe is invoked by pressing WINDOWS+U),
          OSK     (osk.exe is invoked by pressing WINDOWS+U, then launching the on-screen keyboard),
          DISP    (DisplaySwitch.exe is invoked by pressing WINDOWS+P),
          NARRATOR (Narrator.exe is invoked by pressing WINDOWS+CTR+ENTER),
          ATBROKER (AtBroker.exe is invoked by launching accessibility features from the login screen, such as WINDOWS+CTR+ENTER).

          Custom payloads and binaries can be run as part of this exploit, but must be manually uploaded
          to the target prior to running the module.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    return CheckCode::Safe('You have admin rights to run this Module') unless is_admin?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Windows Persistent Service Installer
Type: exploit
Path: modules/exploits/windows/persistence/service.rb
Disclosure date: 2018-10-20
References: URL-https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-service?view=powershell-7.5, URL-https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc754599(v=ws.11)

Description:
This Module will generate and upload an executable to a remote host.
          It will create a new service which will start the payload whenever the service is running. Admin or system
          privilege is required.

Check method (fingerprinting):
print_warning('Payloads in %TEMP% will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('%TEMP%') # check the original value
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)

    return CheckCode::Safe('You must be System/Admin to run this Module') unless is_system? || is_admin?

    CheckCode::Appears('Likely exploitable')
  end