deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Ghostscript Type Confusion Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/fileformat/ghostscript_type_confusion.rb
Platform: unix
Disclosure date: 2017-04-27

Description:
This module exploits a type confusion vulnerability in Ghostscript that can
          be exploited to obtain arbitrary command execution. This vulnerability affects
          Ghostscript versions 9.21 and earlier and can be exploited through libraries
          such as ImageMagick and Pillow.
Metasploit Module: Rapid7 Metasploit Framework msfvenom APK Template Command Injection
Type: exploit
Path: modules/exploits/unix/fileformat/metasploit_msfvenom_apk_template_cmd_injection.rb
Platform: unix
Disclosure date: 2020-10-29
References: URL-https://github.com/justinsteven/advisories/blob/master/2020_metasploit_msfvenom_apk_template_cmdi.md, CVE-2020-7384

Description:
This module exploits a command injection vulnerability in Metasploit Framework's msfvenom
          payload generator when using a crafted APK file as an Android payload template. Affects
          Metasploit Framework <= 6.0.11 and Metasploit Pro <= 4.18.0. The file produced by this
          module is a relatively empty yet valid-enough APK file. To trigger the vulnerability,
          the victim user should do the following:

          msfvenom -p android/<...> -x <crafted_file.apk>
Metasploit Module: Metasploit Libnotify Plugin Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/fileformat/metasploit_libnotify_cmd_injection.rb
Platform: unix
Disclosure date: 2020-03-04
References: CVE-2020-7350, URL-https://github.com/rapid7/metasploit-framework/issues/13026

Description:
This module exploits a shell command injection vulnerability in the
          libnotify plugin. This vulnerability affects Metasploit versions
          5.0.79 and earlier.
Metasploit Module: ExifTool DjVu ANT Perl injection
Type: exploit
Path: modules/exploits/unix/fileformat/exiftool_djvu_ant_perl_injection.rb
Platform: unix
Disclosure date: 2021-05-24

Description:
This module exploits a Perl injection vulnerability in the DjVu ANT
          parsing code of ExifTool versions 7.44 through 12.23 inclusive. The
          injection is used to execute a shell command using Perl backticks.
          The DjVu image can be embedded in a wrapper image using the
          HasselbladExif EXIF field.
Metasploit Module: ImageMagick Delegate Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/fileformat/imagemagick_delegate.rb
Platform: unix
Disclosure date: 2016-05-03

Description:
This module exploits a shell command injection in the way "delegates"
          (commands for converting files) are processed in ImageMagick versions
          <= 7.0.1-0 and <= 6.9.3-9 (legacy).

          Since ImageMagick uses file magic to detect file format, you can create
          a .png (for example) which is actually a crafted SVG (for example) that
          triggers the command injection.

          The PostScript (PS) target leverages a Ghostscript -dSAFER bypass
          (discovered by taviso) to achieve RCE in the Ghostscript delegate.
          Ghostscript versions 9.18 and later are affected. This target is
          provided as is and will not be updated to track additional vulns.

          If USE_POPEN is set to true, a |-prefixed command will be used for the
          exploit. No delegates are involved in this exploitation.
Metasploit Module: Irix LPD tagprinter Command Execution
Type: exploit
Path: modules/exploits/irix/lpd/tagprinter_exec.rb
Platform: %w[irix unix
Disclosure date: 2001-09-01
References: CVE-2001-0800, OSVDB-8573

Description:
This module exploits an arbitrary command execution flaw in
          the in.lpd service shipped with all versions of Irix.

Check method (fingerprinting):
connect
    sock.put("T;uname -a;\n")
    resp = sock.get_once
    disconnect

    if resp =~ /IRIX/
      vprint_status("Response: #{resp.strip}")
      return CheckCode::Vulnerable('IRIX system detected via lpd tagprinter')
    end

    CheckCode::Safe('IRIX system not detected')
  end
Metasploit Module: Android ADB Debug Server Remote Payload Execution
Type: exploit
Path: modules/exploits/android/adb/adb_server_exec.rb
Platform: linux
Disclosure date: 2016-01-01
Authors: joev
Targets: armle, x86, x64, mipsle

Description:
Writes and spawns a native payload on an Android device that is listening
          for adb debug messages.

Check method (fingerprinting):
setup_adb_connection do
      device_info = @adb_client.connect.data
      print_good("Detected device:\n#{device_info}")
      return CheckCode::Vulnerable('ADB service detected and accessible')
    end

    CheckCode::Unknown('Could not connect to ADB service')
  end
Metasploit Module: Android get_user/put_user Exploit
Type: exploit
Path: modules/exploits/android/local/put_user_vroot.rb
Disclosure date: 2013-09-06
References: CVE-2013-6282, URL-https://forum.xda-developers.com/t/root-share-vroot-1-6-0-3690-1-click-root-method-lenovo-a706-walkman-f800-etc.2434453/, URL-https://github.com/fi01/libget_user_exploit, URL-https://forum.xda-developers.com/t/root-saferoot-root-for-vruemj7-mk2-and-android-4-3.2565758/

Description:
This module exploits a missing check in the get_user and put_user API functions
          in the linux kernel before 3.5.5. The missing checks on these functions
          allow an unprivileged user to read and write kernel memory.
          This exploit first reads the kernel memory to identify the commit_creds and
          ptmx_fops address, then uses the write primitive to execute shellcode as uid 0.
          The exploit was first discovered in the wild in the vroot rooting application.
Metasploit Module: Android Janus APK Signature bypass
Type: exploit
Path: modules/exploits/android/local/janus.rb
Disclosure date: 2017-07-31
References: CVE-2017-13156, URL-https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures, URL-https://github.com/V-E-O/PoC/tree/master/CVE-2017-13156

Description:
This module exploits CVE-2017-13156 in Android to install a payload into another
            application. The payload APK will have the same signature and can be installed
            as an update, preserving the existing data.
            The vulnerability was fixed in the 5th December 2017 security patch, and was
            additionally fixed by the APK Signature scheme v2, so only APKs signed with
            the v1 scheme are vulnerable.
            Payload handler is disabled, and a multi/handler must be started first.

Check method (fingerprinting):
os = cmd_exec('getprop ro.build.version.release')

    unless Rex::Version.new(os).between?(Rex::Version.new('5.1.1'), Rex::Version.new('8.0.0'))
      return CheckCode::Safe("Android version #{os} is not vulnerable.")
    end

    vprint_good("Android version #{os} appears to be vulnerable.")

    patch = cmd_exec('getprop ro.build.version.security_patch')

    if patch.empty?
      return CheckCode::Appears('Unable to determine patch level. Pre-5.0 this is unaccessible.')
    end

    if patch > '2017-12-05'
      return CheckCode::Safe("Android security patch level #{patch} is patched.")
    end

    CheckCode::Appears("Android security patch level #{patch} is vulnerable.")
  end
Metasploit Module: Android Binder Use-After-Free Exploit
Type: exploit
Path: modules/exploits/android/local/binder_uaf.rb
Disclosure date: 2019-09-26
References: CVE-2019-2215, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1942, URL-https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html, URL-https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/, URL-https://github.com/grant-h/qu1ckr00t/blob/master/native/poc.c

Description:
This module exploits CVE-2019-2215, which is a use-after-free in Binder in the
          Android kernel. The bug is a local privilege escalation vulnerability that
          allows for a full compromise of a vulnerable device. If chained with a browser
          renderer exploit, this bug could fully compromise a device through a malicious
          website.
          The freed memory is replaced with an iovec structure in order to leak a pointer
          to the task_struct. Finally the bug is triggered again in order to overwrite
          the addr_limit, making all memory (including kernel memory) accessible as part
          of the user-space memory range in our process and allowing arbitrary reading
          and writing of kernel memory.
Metasploit Module: Android 'su' Privilege Escalation
Type: exploit
Path: modules/exploits/android/local/su_exec.rb
Disclosure date: 2017-08-31
Authors: timwr
Targets: aarch64, armle, x86, x64, mipsle

Description:
This module uses the su binary present on rooted devices to run
            a payload as root.

            A rooted Android device will contain a su binary (often linked with
            an application) that allows the user to run commands as root.
            This module will use the su binary to execute a command stager
            as root. The command stager will write a payload binary to a
            temporary directory, make it executable, execute it in the background,
            and finally delete the executable.

            On most devices the su binary will pop-up a prompt on the device
            asking the user for permission.
Metasploit Module: Android 'Towelroot' Futex Requeue Kernel Exploit
Type: exploit
Path: modules/exploits/android/local/futex_requeue.rb
Disclosure date: 2014-05-03
References: CVE-2014-3153, URL-http://tinyhack.com/2014/07/07/exploiting-the-futex-bug-and-uncovering-towelroot/, URL-http://web.archive.org/web/[PII_REDACTED]4145/http://blog.nativeflow.com:80/the-futex-vulnerability

Description:
This module exploits a bug in futex_requeue in the Linux kernel, using
            similar techniques employed by the towelroot exploit. Any Android device
            with a kernel built before June 2014 is likely to be vulnerable.

Check method (fingerprinting):
os = cmd_exec('getprop ro.build.version.release')
    unless Rex::Version.new(os) < Rex::Version.new('4.5.0')
      vprint_error "Android version #{os} does not appear to be vulnerable"
      return CheckCode::Safe("Android version #{os} does not appear to be vulnerable")
    end
    vprint_good "Android version #{os} appears to be vulnerable"

    CheckCode::Appears("Android version #{os} appears vulnerable to futex_requeue")
  end
Metasploit Module: Samsung Galaxy KNOX Android Browser RCE
Type: exploit
Path: modules/exploits/android/browser/samsung_knox_smdm_url.rb
Platform: android
Disclosure date: 2014-11-12
References: URL-https://blog.quarkslab.com/abusing-samsung-knox-to-remotely-install-a-malicious-application-story-of-a-half-patched-vulnerability.html, OSVDB-114590

Description:
A vulnerability exists in the KNOX security component of the Samsung Galaxy
          firmware that allows a remote webpage to install an APK with arbitrary
          permissions by abusing the 'smdm://' protocol handler registered by the KNOX
          component.

          The vulnerability has been confirmed in the Samsung Galaxy S4, S5, Note 3,
          and Ace 4.
Metasploit Module: Android Stagefright MP4 tx3g Integer Overflow
Type: exploit
Path: modules/exploits/android/browser/stagefright_mp4_tx3g_64bit.rb
Platform: linux
Disclosure date: 2015-08-13
References: CVE-2015-3864, URL-https://blog.exodusintel.com/2015/08/13/stagefright-mission-accomplished/, URL-https://googleprojectzero.blogspot.com/2015/09/stagefrightened.html, URL-https://raw.githubusercontent.com/NorthBit/Public/master/NorthBit-Metaphor.pdf, URL-https://github.com/NorthBit/Metaphor, URL-https://web.archive.org/web/[PII_REDACTED]2350/http://drops.wooyun.org/papers/7558, URL-https://web.archive.org/web/[PII_REDACTED]5650/http://translate.wooyun.io/2015/08/08/Stagefright-Vulnerability-Disclosure.html, URL-https://web.archive.org/web/[PII_REDACTED]5534/https://www.nccgroup.trust/globalassets/our-research/uk/whitepapers/2016/01/libstagefright-exploit-notespdf/

Description:
This module exploits an integer overflow vulnerability in the Stagefright
          Library (libstagefright.so). The vulnerability occurs when parsing specially
          crafted MP4 files. While a wide variety of remote attack vectors exist, this
          particular exploit is designed to work within an HTML5 compliant browser.

          Exploitation is done by supplying a specially crafted MP4 file with two
          tx3g atoms that, when their sizes are summed, cause an integer overflow when
          processing the second atom. As a result, a temporary buffer is allocated
          with insufficient size and a memcpy call leads to a heap overflow.

          This version of the exploit uses a two-stage information leak based on
          corrupting the MetaData that the browser reads from mediaserver. This method
          is based on a technique published in NorthBit's Metaphor paper. First,
          we use a variant of their technique to read the address of a heap buffer
          located adjacent to a SampleIterator object as the video HTML element's
          videoHeight. Next, we read the vtable pointer from an empty Vector within
          the SampleIterator object using the video element's duration. This gives
          us a code address that we can use to determine the base address of
          libstagefright and construct a ROP chain dynamically.

          NOTE: the mediaserver process on many Android devices (Nexus, for example) is
          constrained by SELinux and thus cannot use the execve system call. To avoid
          this problem, the original exploit uses a kernel exploit payload that disables
          SELinux and spawns a shell as root. Work is underway to make the framework
          more amenable to these types of situations. Until that work is complete, this
          exploit will only yield a shell on devices without SELinux or with SELinux in
          permissive mode.
Metasploit Module: Android Browser and WebView addJavascriptInterface Code Execution
Type: exploit
Path: modules/exploits/android/browser/webview_addjavascriptinterface.rb
Platform: android
Disclosure date: 2012-12-21
References: URL-http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/, URL-https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/, URL-http://50.56.33.56/blog/?p=314, URL-https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/, URL-https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py, CVE-2012-6636, CVE-2013-4710, EDB-31519, OSVDB-97520

Description:
This module exploits a privilege escalation issue in Android < 4.2's WebView component
          that arises when untrusted JavaScript code is executed by a WebView that has one or more
          Interfaces added to it. The untrusted JavaScript code can call into the Java Reflection
          APIs exposed by the Interface and execute arbitrary commands.

          Some distributions of the Android Browser app have an addJavascriptInterface
          call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs
          4.1.2 release of Android is known to be vulnerable.

          A secondary attack vector involves the WebViews embedded inside a large number
          of Android applications. Ad integrations are perhaps the worst offender here.
          If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS
          into the page displayed in the WebView, then you can inject the html/js served
          by this module and get a shell.

          Note: Adding a .js to the URL will return plain javascript (no HTML markup).
Metasploit Module: Adobe Reader for Android addJavascriptInterface Exploit
Type: exploit
Path: modules/exploits/android/fileformat/adobe_reader_pdf_js_interface.rb
Platform: android
Disclosure date: 2014-04-13
References: CVE-2014-0514, EDB-32884, OSVDB-105781
Targets: Android ARM, Android MIPSLE, Android X86

Description:
Adobe Reader versions less than 11.2.0 exposes insecure native
          interfaces to untrusted javascript in a PDF. This module embeds the browser
          exploit from android/webview_addjavascriptinterface into a PDF to get a
          command shell on vulnerable versions of Reader.
Metasploit Module: Mercantec SoftCart CGI Overflow
Type: exploit
Path: modules/exploits/bsdi/softcart/mercantec_softcart.rb
Platform: bsdi
Disclosure date: 2004-08-19
References: CVE-2004-2221, OSVDB-9011, BID-10926

Description:
This is an exploit for an undisclosed buffer overflow
          in the SoftCart.exe CGI as shipped with Mercantec's shopping
          cart software.  It is possible to execute arbitrary code
          by passing a malformed CGI parameter in an HTTP GET
          request.  This issue is known to affect SoftCart version
          4.00b.
Metasploit Module: OpenBSD Dynamic Loader chpass Privilege Escalation
Type: exploit
Path: modules/exploits/openbsd/local/dynamic_loader_chpass_privesc.rb
Platform: %w[bsd unix
Disclosure date: 2019-12-11
References: CVE-2019-19726, EDB-47780, URL-https://blog.qualys.com/laws-of-vulnerabilities/2019/12/11/openbsd-local-privilege-escalation-vulnerability-cve-2019-19726, URL-https://www.qualys.com/2019/12/11/cve-2019-19726/local-privilege-escalation-openbsd-dynamic-loader.txt, URL-https://www.openwall.com/lists/oss-security/2019/12/11/9, URL-https://github.com/bcoles/local-exploits/blob/master/CVE-2019-19726/openbsd-dynamic-loader-chpass, URL-https://ftp.openbsd.org/pub/OpenBSD/patches/6.6/common/013_ldso.patch.sig

Description:
This module exploits a vulnerability in the OpenBSD `ld.so`
          dynamic loader (CVE-2019-19726).

          The `_dl_getenv()` function fails to reset the `LD_LIBRARY_PATH`
          environment variable when set with approximately `ARG_MAX` colons.

          This can be abused to load `libutil.so` from an untrusted path,
          using `LD_LIBRARY_PATH` in combination with the `chpass` set-uid
          executable, resulting in privileged code execution.

          This module has been tested successfully on:

          OpenBSD 6.1 (amd64); and
          OpenBSD 6.6 (amd64)

Check method (fingerprinting):
patches = cmd_exec('syspatch -l').to_s
    patch = '013_ldso'

    return CheckCode::Safe("Patch #{patch} has been installed. Target is not vulnerable.") if patches.include?(patch)

    return CheckCode::Safe("Patch #{patch} is not present, but cc compiler is not installed.") unless command_exists?('cc')

    vprint_good('cc is installed')

    CheckCode::Detected("Patch #{patch} is not present")
  end
Metasploit Module: Local Privilege Escalation via CVE-2023-0386
Type: exploit
Path: modules/exploits/linux/local/cve_2023_0386_overlayfs_priv_esc.rb
Disclosure date: 2023-03-22
References: CVE-2023-0386, URL-https://github.com/sxlmnwb/CVE-2023-0386, URL-https://github.com/DataDog/security-labs-pocs/tree/main/proof-of-concept-exploits/overlayfs-cve-2023-0386, URL-https://securitylabs.datadoghq.com/articles/overlayfs-cve-2023-0386/, URL-https://www.vicarius.io/vsociety/posts/cve-2023-0386-a-linux-kernel-bug-in-overlayfs

Description:
This exploit targets the Linux kernel bug in OverlayFS.

          A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities
          was found in the Linux kernel's OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount.
          This uid mapping bug allows a local user to escalate their privileges on the system.

Check method (fingerprinting):
unless kernel_arch.include?('x64')
      return CheckCode::Safe("System architecture #{kernel_arch} is not supported")
    end

    kernel_version = Rex::Version.new(kernel_release.split('-').first)
    if kernel_version < Rex::Version.new('5.11') ||
       kernel_version.between?(Rex::Version.new('5.15.91'), Rex::Version.new('5.16')) ||
       Rex::Version.new('6.1.9') <= kernel_version
      return CheckCode::Safe("Linux kernel version #{kernel_version} is not vulnerable")
    end

    unless userns_enabled?
      return CheckCode::Safe('Unprivileged user namespaces are not permitted')
    end

    vprint_good('Unprivileged user namespaces are permitted')

    CheckCode::Appears("Linux kernel version found: #{kernel_version}")
  end
Metasploit Module: Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/rds_rds_page_copy_user_priv_esc.rb
Disclosure date: 2010-10-20
References: EDB-15285, CVE-2010-3904, BID-44219, URL-https://securitytracker.com/id?1024613, URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=799c10559d60f159ab2232203f222f18fa3c4a5f, URL-http://vulnfactory.org/exploits/rds-fail.c, URL-http://web.archive.org/web/[PII_REDACTED]4047/http://www.vsecurity.com/resources/advisory/20101019-1/, URL-http://web.archive.org/web/[PII_REDACTED]4048/http://www.vsecurity.com/download/tools/linux-rds-exploit.c

Description:
This module exploits a vulnerability in the `rds_page_copy_user` function
          in `net/rds/page.c` (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8
          to execute code as root (CVE-2010-3904).

          This module has been tested successfully on:

          Fedora 13 (i686) kernel version 2.6.33.3-85.fc13.i686.PAE; and
          Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic.

Check method (fingerprinting):
version = kernel_release
    unless Rex::Version.new(version.split('-').first) >= Rex::Version.new('2.6.30') &&
           Rex::Version.new(version.split('-').first) < Rex::Version.new('2.6.37')
      return CheckCode::Safe("Linux kernel version #{version} is not vulnerable")
    end

    vprint_good "Linux kernel version #{version} appears to be vulnerable"

    unless cmd_exec('/sbin/modinfo rds').to_s.include? 'Reliable Datagram Sockets'
      return CheckCode::Safe('RDS kernel module is not available')
    end

    vprint_good 'RDS kernel module is available'

    if modules_disabled?
      unless cmd_exec('/sbin/lsmod').to_s.include? 'rds'
        return CheckCode::Safe('RDS kernel module is not loadable')
      end
    end
    vprint_good 'RDS kernel module is loadable'

    CheckCode::Appears("Kernel version #{version} appears to be vulnerable")
  end