deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Microsoft Exchange Server ChainedSerializationBinder RCE
Type: exploit
Path: modules/exploits/windows/http/exchange_chainedserializationbinder_rce.rb
Platform: win
Disclosure date: 2021-12-09
References: CVE-2021-42321, URL-https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-42321, URL-https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2019-2016-and-2013-november-9-2021-kb5007409-7e1f235a-d41b-4a76-bcc4-3db90cd161e7, URL-https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169, URL-https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398, URL-https://peterjson.medium.com/some-notes-about-microsoft-exchange-deserialization-rce-cve-2021-42321-110d04e8852, CVE-2022-23277, URL-https://codewhitesec.blogspot.com/2022/06/bypassing-dotnet-serialization-binders.html, URL-https://testbnull.medium.com/note-nhanh-v%E1%BB%81-binaryformatter-binder-v%C3%A0-cve-2022-23277-6510d469604c
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits vulnerabilities within the ChainedSerializationBinder as used in
          Exchange Server 2019 CU10, Exchange Server 2019 CU11, Exchange Server 2016 CU21, and
          Exchange Server 2016 CU22 all prior to Mar22SU.

          Note that authentication is required to exploit these vulnerabilities.

Check method (fingerprinting):
# Note we are only checking official releases here to reduce requests when checking versions with exchange_get_version
    current_build_rex = exchange_get_version(exchange_builds: cve_2021_42321_vuln_builds + cve_2022_23277_vuln_builds)
    if current_build_rex.nil?
      return CheckCode::Unknown("Couldn't retrieve the target Exchange Server version!")
    end

    @exchange_build = current_build_rex.to_s

    if cve_2021_42321_vuln_builds.include?(@exchange_build)
      CheckCode::Appears("Exchange Server #{@exchange_build} is vulnerable to CVE-2021-42321")
    elsif cve_2022_23277_vuln_builds.include?(@exchange_build)
      CheckCode::Appears("Exchange Server #{@exchange_build} is vulnerable to CVE-2022-23277")
    else
      CheckCode::Safe("Exchange Server #{@exchange_build} does not appear to be a vulnerable version!")
    end
  end
Metasploit Module: Gladinet CentreStack/Triofox ASP.NET ViewState Deserialization
Type: exploit
Path: modules/exploits/windows/http/gladinet_viewstate_deserialization_cve_2025_30406.rb
Platform: win
Disclosure date: 2025-04-03
References: CVE-2025-30406, URL-https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild, URL-https://attackerkb.com/topics/7ebXn71J6O/cve-2025-30406
Targets: Windows Command

Description:
A vulnerability in Gladinet CentreStack and Triofox application using hardcoded
          cryptographic keys for ViewState could allow an attacker to forge ViewState data.
          This can lead to unauthorized actions such as remote code execution.
          Both applications make use of a hardcoded machineKey in the IIS web.config file,
          which is responsible for securing ASP.NET ViewState data. If an attacker obtains
          the machineKey, they can forge ViewState payloads that pass integrity checks.
          This can result in ViewState deserialization attacks, potentially leading to
          remote code execution (RCE) on the web server.

          Gladinet CentreStack versions up to 16.4.10315.56368 are vulnerable (fixed in 16.4.10315.56368).
          Gladinet Triofox versions up to 16.4.10317.56372 are vulnerable (fixed in 16.4.10317.56372).
          NOTE: There are other rebranded services that might be vulnerable and can be detected by this module.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'portal', 'loginpage.aspx')
    })
    return CheckCode::Safe('Failed to identify that Gladinet CentreStack/Triofox or similar service is running.') unless res&.code == 200 && res.body.include?('id="__VIEWSTATEGENERATOR" value="3FE2630A"')

    check_app = detect_app_type(res.body)
    version = gladinet_version

    return CheckCode::Detected("Service #{check_app} (Build not detected)") if version.nil?

    rex_version = Rex::Version.new(version)

    suggest_auxiliary_modules(version)
    check_viewstate_vulnerability(check_app, rex_version, version)
  end
Metasploit Module: Cogent DataHub Command Injection
Type: exploit
Path: modules/exploits/windows/http/cogent_datahub_command.rb
Platform: win
Disclosure date: Apr 29 2014
References: ZDI-14-136, CVE-2014-3789, BID-67486

Description:
This module exploits an injection vulnerability in Cogent DataHub prior
        to 7.3.5. The vulnerability exists in the GetPermissions.asp page, which
        makes insecure use of the datahub_command function with user controlled
        data, allowing execution of arbitrary datahub commands and scripts. This
        module has been tested successfully with Cogent DataHub 7.3.4 on
        Windows 7 SP1. Please also note that after exploitation, the remote service
        will most likely hang and restart manually.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri('/', 'Silverlight', 'GetPermissions.asp'),
      'vars_post' =>
        {
          'username' => rand_text_alpha(4 + rand(4)),
          'password' => rand_text_alpha(4 + rand(4))
        }
    })

    if res && res.code == 200 && res.body =~ /PermissionRecord/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Sysax Multi Server 5.64 Create Folder Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/sysax_create_folder.rb
Platform: win
Disclosure date: 2012-07-29
References: CVE-2012-6530, OSVDB-82329, EDB-20676, EDB-18420, URL-http://www.pwnag3.com/2012/01/sysax-multi-server-550-exploit.html, URL-http://www.mattandreko.com/2012/07/sysax-564-http-remote-buffer-overflow.html

Description:
This module exploits a stack buffer overflow in the create folder function in
          Sysax Multi Server 5.64. This issue was fixed in 5.66. In order to trigger the
          vulnerability valid credentials with the create folder permission must be provided.
          The HTTP option must be enabled on Sysax too.

          This module will log into the server, get a SID token, find the root folder, and
          then proceed to exploit the server. Successful exploits result in SYSTEM access.
          This exploit works on XP SP3, and Server 2003 SP1-SP2.
Metasploit Module: HP Intelligent Management Center Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/hp_imc_mibfileupload.rb
Platform: win
Disclosure date: 2013-03-07
References: CVE-2012-5201, OSVDB-91026, BID-58385, ZDI-13-050, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03689276

Description:
This module exploits a code execution flaw in HP Intelligent Management Center.
          The vulnerability exists in the mibFileUpload which is accepting unauthenticated
          file uploads and handling zip contents in an insecure way. Combining both weaknesses
          a remote attacker can accomplish arbitrary file upload. This module has been tested
          successfully on HP Intelligent Management Center 5.1 E0202 over Windows 2003 SP2.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path.to_s, "login.jsf"),
      'method' => 'GET'
    })

    if res and res.code == 200 and res.body =~ /HP Intelligent Management Center/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb
Platform: win
Disclosure date: 2025-06-17
References: CVE-2025-34510, URL-https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform, URL-https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
Targets: Windows

Description:
This module exploits CVE-2025-34510, path traversal leading to remote code execution. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown('Could not log in, application might not be Sitecore') unless login_identitysrv('ServicesAPI', 'b')

    @is_logged = true

    return Exploit::CheckCode::Safe('Could not get elevated cookies') unless get_identity_cookies

    @is_elevated = true

    sitecore_version = get_version

    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version.between?(Rex::Version.new('10.0.0'), Rex::Version.new('10.4'))

    Exploit::CheckCode::Safe("Detected Sitecore version #{sitecore_version}, which is not vulnerable")
  end
Metasploit Module: CA Total Defense Suite reGenerateReports Stored Procedure SQL Injection
Type: exploit
Path: modules/exploits/windows/http/ca_totaldefense_regeneratereports.rb
Platform: win
Disclosure date: 2011-04-13
References: ZDI-11-134, OSVDB-74968, CVE-2011-1653
Targets: Windows Universal

Description:
This module exploits a SQL injection flaw in CA Total Defense Suite R12.
          When supplying a specially crafted soap request to '/UNCWS/Management.asmx', an
          attacker can abuse the reGenerateReports stored procedure by injecting arbitrary sql
          statements into the ReportIDs element.
Metasploit Module: Cyclope Employee Surveillance Solution v6 SQL Injection
Type: exploit
Path: modules/exploits/windows/http/cyclope_ess_sqli.rb
Platform: win
Disclosure date: 2012-08-08
References: CVE-2012-10047, OSVDB-84517, EDB-20393

Description:
This module exploits a SQL injection found in Cyclope Employee Surveillance
          Solution.  Because the login script does not properly handle the user-supplied
          username parameter, a malicious user can manipulate the SQL query, and allows
          arbitrary code execution under the context of 'SYSTEM'.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"
    path = File.dirname("#{target_uri.path}/.")
    b64_version = get_version(path)
    if b64_version.empty?
      vprint_error("Unable to determine the version number")
      return Exploit::CheckCode::Unknown('Could not determine the target version')
    else
      b64_version = Rex::Text.decode_base64(b64_version)
      if b64_version =~ /^[0-6]\.1/
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{b64_version}")
      end
    end

    return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{b64_version}")
  end
Metasploit Module: HP OpenView Network Node Manager execvp_nc Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb
Platform: win
Disclosure date: 2010-07-20
References: CVE-2010-2703, OSVDB-66514, BID-41829, ZDI-10-137, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
          prior to NNM_01207 or NNM_01206 without the SSRT100025 hotfix. By specifying a long 'sel'
          parameter when calling methods within the 'webappmon.exe' CGI program, an attacker can
          cause a stack-based buffer overflow and execute arbitrary code.

          This vulnerability is not triggerable via a GET request due to limitations on the
          request size. The buffer being targeted is 16384 bytes in size. There are actually two
          adjacent buffers that both get overflowed (one into the other), and strcat is used.

          The vulnerable code is within the "execvp_nc" function within "ov.dll" prior to
          v 1.30.12.69. There are no stack cookies, so exploitation is easily achieved by
          overwriting the saved return address or SEH frame.

          This vulnerability might also be triggerable via other CGI programs, however this was
          not fully investigated.
Metasploit Module: MaxDB WebDBM GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/maxdb_webdbm_get_overflow.rb
Platform: win
Disclosure date: 2005-04-26
References: CVE-2005-0684, OSVDB-15816, URL-http://www.idefense.com/application/poi/display?id=234&type=vulnerabilities, BID-13368

Description:
This module exploits a stack buffer overflow in the MaxDB WebDBM
          service. This service is included with many recent versions
          of the MaxDB and SAPDB products. This particular module is
          capable of exploiting Windows systems through the use of an
          SEH frame overwrite. The offset to the SEH frame may change
          depending on where MaxDB has been installed, this module
          assumes a web root path with the same length as:

          C:\Program Files\sdb\programs\web\Documents
Metasploit Module: Dell SonicWALL (Plixer) Scrutinizer 9 SQL Injection
Type: exploit
Path: modules/exploits/windows/http/sonicwall_scrutinizer_sqli.rb
Platform: php
Disclosure date: 2012-07-22
References: CVE-2012-2962, OSVDB-84232, EDB-20033, BID-54625, URL-http://www.sonicwall.com/shared/download/Dell_SonicWALL_Scrutinizer_Service_Bulletin_for_SQL_injection_vulnerability_CVE.pdf

Description:
This module exploits a vulnerability found in Dell SonicWall Scrutinizer.
          While handling the 'q' parameter, the PHP application does not properly filter
          the user-supplied data, which can be manipulated to inject SQL commands, and
          then gain remote code execution.  Please note that authentication is NOT needed
          to exploit this vulnerability.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => '/' }) # Check the base path for version regex
    if res and res.body =~ /\<title\>Scrutinizer\<\/title\>/ and
       res.body =~ /\<div id\=\'.+\'\>Scrutinizer 9\.[0-5]\.[0-1]\<\/div\>/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: LANDesk Lenovo ThinkManagement Console Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/landesk_thinkmanagement_upload_asp.rb
Platform: win
Disclosure date: Feb 15 2012
References: CVE-2012-1195, CVE-2012-1196, OSVDB-79276, OSVDB-79277, BID-52023, EDB-18622, EDB-18623

Description:
This module can be used to execute a payload on LANDesk Lenovo
        ThinkManagement Suite 9.0.2 and 9.0.3.

        The payload is uploaded as an ASP script by sending a specially crafted
        SOAP request to "/landesk/managementsuite/core/core.anonymous/ServerSetup.asmx"
        , via a "RunAMTCommand" operation with the command '-PutUpdateFileCore'
        as the argument.

        After execution, the ASP script with the payload is deleted by sending
        another specially crafted SOAP request to "WSVulnerabilityCore/VulCore.asmx"
        via a "SetTaskLogByFile" operation.
Metasploit Module: HTTPDX h_handlepeer() Function Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/httpdx_handlepeer.rb
Platform: win
Disclosure date: 2009-10-08
References: OSVDB-58714, CVE-2009-3711, URL-http://www.pank4j.com/exploits/httpdxb0f.php, URL-http://www.rec-sec.com/2009/10/16/httpdx-buffer-overflow-exploit/

Description:
This module exploits a stack-based buffer overflow vulnerability in HTTPDX HTTP server 1.4. The
          vulnerability is caused due to a boundary error within the "h_handlepeer()" function in http.cpp.
          By sending an overly long HTTP request, an attacker can overrun a buffer and execute arbitrary code.

Check method (fingerprinting):
info = http_fingerprint # check method
    if info and (info =~ /httpdx\/(.*) \(Win32\)/)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Oracle Business Transaction Management FlashTunnelService Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/oracle_btm_writetofile.rb
Platform: win
Disclosure date: 2012-08-07
References: OSVDB-85087, BID-54839, EDB-20318
Targets: Oracle BTM 12.1.0.7 / Windows 2003 SP2 through WMI

Description:
This module exploits abuses the FlashTunnelService SOAP web service on Oracle
          Business Transaction Management 12.1.0.7 to upload arbitrary files, without
          authentication, using the WriteToFile method. The same method contains a directory
          traversal vulnerability, which allows to upload the files to arbitrary locations.

          In order to execute remote code two techniques are provided. If the Oracle app has
          been deployed in the same WebLogic Samples Domain a JSP can be uploaded to the web
          root. If a new Domain has been used to deploy the Oracle application, the Windows
          Management Instrumentation service can be used to execute arbitrary code.

          Both techniques have been successfully tested on default installs of Oracle BTM
          12.1.0.7, Weblogic 12.1.1 and Windows 2003 SP2. Default path traversal depths are
          provided, but the user can configure the traversal depth using the DEPTH option.
Metasploit Module: Easy File Sharing HTTP Server 7.2 SEH Overflow
Type: exploit
Path: modules/exploits/windows/http/easyfilesharing_seh.rb
Platform: win
Disclosure date: 2015-12-02
Authors: Starwarsfan2099 <starwarsfan2099[at]gmail.com>
References: CVE-2018-9059, EDB-39008

Description:
This module exploits a SEH overflow in the Easy File Sharing FTP Server 7.2 software.
Metasploit Module: Intrasrv 1.0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/intrasrv_bof.rb
Platform: win
Disclosure date: 2013-05-30
References: CVE-2019-17181, OSVDB-94097, EDB-18397, BID-60229

Description:
This module exploits a boundary condition error in Intrasrv Simple Web
          Server 1.0. The web interface does not validate the boundaries of an
          HTTP request string prior to copying the data to an insufficiently sized
          buffer. Successful exploitation leads to arbitrary remote code execution
          in the context of the application.

Check method (fingerprinting):
begin
      connect
    rescue
      print_error("Could not connect to target!")
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
    sock.put("GET / HTTP/1.0\r\n\r\n")
    res = sock.get_once

    if res =~ /intrasrv 1\.0/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399)
Type: exploit
Path: modules/exploits/windows/http/magicinfo_traversal.rb
Platform: %w[win
Disclosure date: 2025-04-30
References: URL-https://ssd-disclosure.com/ssd-advisory-samsung-magicinfo-unauthenticated-rce/, URL-https://security.samsungtv.com/securityUpdates, CVE-2024-7399
Targets: Java Server Page

Description:
Remote Code Execution in Samsung MagicINFO 9 Server <= 21.1050.0.
          Remote code execution can be obtained by exploiting the path traversal vulnerability (CVE-2024-7399) in the SWUpdateFileUploader servlet,
          which can be queried by an unauthenticated user to upload a JSP shell.
          By default, the application listens on TCP ports 7001 (HTTP) and 7002 (HTTPS) on all network interfaces and runs in the context of NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'config.js')
    })

    return CheckCode::Unknown('Target did not return HTTP 200') unless res&.code == 200

    js_object = res.body.to_s[/window\.globalConfig = (\{.+\})/m, 1]

    return CheckCode::Safe('Could not extract globalConfig object from response.') unless js_object

    json_b = js_object.gsub(/'/, '"') # replace ' with " so that we can use JSON.parse on the response body
    data = JSON.parse(json_b)

    full_version = data.fetch('magicInfoFrontEndVersion', nil)
    version = full_version[/Server\s+([\d.]+)/, 1]

    return CheckCode::Unknown('Could not extract version from response') unless version

    unless Rex::Version.new(version) > Rex::Version.new('21.1050.0')
      vprint_status("MagicINFO version detected: #{full_version}")
      return CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    return CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: HP OpenView Network Node Manager getnnmdata.exe (ICount) CGI Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_getnnmdata_icount.rb
Platform: win
Disclosure date: 2010-05-11
References: CVE-2010-1554, OSVDB-64976

Description:
This module exploits a buffer overflow in HP OpenView Network Node Manager 7.50/7.53.
          By sending specially crafted ICount parameter to the getnnmdata.exe CGI,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Sambar 6 Search Results Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/sambar6_search_results.rb
Platform: win
Disclosure date: 2003-06-21
References: CVE-2004-2086, OSVDB-5786, BID-9607

Description:
This module exploits a buffer overflow found in the
          /search/results.stm application that comes with Sambar 6.
          This code is a direct port of Andrew Griffiths's SMUDGE
          exploit, the only changes made were to the nops and payload.
          This exploit causes the service to die, whether you provided
          the correct target or not.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.0\r\n\r\n")
    banner = sock.get_once
    disconnect

    if (banner =~ /Server:\sSAMBAR/)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end