deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Sudoedit Extra Arguments Priv Esc
Type: exploit
Path: modules/exploits/linux/local/sudoedit_bypass_priv_esc.rb
Disclosure date: 2023-01-18
References: EDB-51217, URL-https://github.com/M4fiaB0y/CVE-2023-22809/blob/main/exploit.sh, URL-https://raw.githubusercontent.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc/main/exploit.sh, URL-https://www.vicarius.io/vsociety/blog/cve-2023-22809-sudoedit-bypass-analysis, URL-https://medium.com/@dev.nest/how-to-bypass-sudo-exploit-cve-2023-22809-vulnerability-296ef10a1466, URL-https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf, URL-https://www.sudo.ws/security/advisories/sudoedit_any/, CVE-2023-22809

Description:
This exploit takes advantage of a vulnerability in sudoedit, part of the sudo package.
          The sudoedit (aka sudo -e) feature mishandles extra arguments passed in the user-provided
          environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to
          append arbitrary entries to the list of files to process. This can lead to privilege escalation.
          by appending extra entries on /etc/sudoers allowing for execution of an arbitrary payload with root
          privileges.

          Affected versions are 1.8.0 through 1.9.12.p1. However THIS module only works against Ubuntu
          22.04 and 22.10.

          This module was tested against sudo 1.9.9-1ubuntu2 on Ubuntu 22.04, and
          1.9.11p3-1ubuntu1 on Ubuntu 22.10.

Check method (fingerprinting):
sys_info = get_sysinfo

    # Check the app is installed and the version
    if sys_info[:distro] == 'ubuntu' || sys_info[:distro] == 'debian'
      package = cmd_exec('dpkg -l sudo | grep \'^ii\'')
      package = package.split(' ')[2] # ii, package name, version, arch
      begin
        ver_no = Rex::Version.new(package)
      rescue ArgumentError
        ver_no = get_sudo_version_from_sudo
      end
    else
      ver_no = get_sudo_version_from_sudo
    end

    # according to CVE listing, but so much backporting...
    minimal_version = '1.8.0'
    maximum_version = '1.9.12p1'
    exploitable = false

    # backporting... so annoying.
    # https://ubuntu.com/security/CVE-2023-22809
    if sys_info[:distro] == 'ubuntu'
      if sys_info[:version].include? '22.10' # kinetic
        exploitable = true
        maximum_version = '1.9.11p3-1ubuntu1.1'
      elsif sys_info[:version].include? '22.04' # jammy
        exploitable = true
        maximum_version = '1.9.9-1ubuntu2.2'
      elsif sys_info[:version].include? '20.04' # focal
        maximum_version = '1.8.31-1ubuntu1.4'
      elsif sys_info[:version].include? '18.04' # bionic
        maximum_version = '1.8.21p2-3ubuntu1.5'
      elsif sys_info[:version].include? '16.04'  # xenial
        maximum_version = '1.8.16-0ubuntu1.10+esm1'
      elsif sys_info[:version].include? '14.04'  # trusty
        maximum_version = '1.8.9p5-1ubuntu1.5+esm7'
      end
    end

    if ver_no == Rex::Version.new(0)
      return Exploit::Che
Metasploit Module: ABRT sosreport Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/abrt_sosreport_priv_esc.rb
Platform: linux
Disclosure date: 2015-11-23
References: BID-78137, CVE-2015-5287, EDB-38832, URL-https://www.openwall.com/lists/oss-security/2015/12/01/1, URL-https://access.redhat.com/errata/RHSA-2015:2505, URL-https://access.redhat.com/security/cve/CVE-2015-5287, URL-https://bugzilla.redhat.com/show_bug.cgi?id=1266837

Description:
This module attempts to gain root privileges on RHEL systems with
          a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
          as the crash handler.

          `sosreport` uses an insecure temporary directory, allowing local users
          to write to arbitrary files (CVE-2015-5287). This module uses a symlink
          attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path
          in `/proc/sys/kernel/modprobe`, resulting in root privileges.

          Waiting for `sosreport` could take a few minutes.

          This module has been tested successfully on:

          abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and
          abrt 2.1.11-19.el7 on RHEL 7.1 x86_64.

Check method (fingerprinting):
kernel_core_pattern = cmd_exec 'grep abrt-hook-ccpp /proc/sys/kernel/core_pattern'
    unless kernel_core_pattern.include? 'abrt-hook-ccpp'
      vprint_error 'System is not configured to use ABRT for crash reporting'
      return CheckCode::Safe('System is not configured to use ABRT for crash reporting')
    end
    vprint_good 'System is configured to use ABRT for crash reporting'

    if cmd_exec('systemctl status abrt-ccpp | grep Active').include? 'inactive'
      vprint_error 'abrt-ccp service not running'
      return CheckCode::Safe('abrt-ccpp service is not running')
    end
    vprint_good 'abrt-ccpp service is running'

    # Patched in 2.1.11-35.el7
    pkg_info = cmd_exec('yum list installed abrt | grep abrt').to_s
    abrt_version = pkg_info[/^abrt.*$/].to_s.split(/\s+/)[1]
    if abrt_version.blank?
      vprint_status 'Could not retrieve ABRT package version'
      return CheckCode::Safe('Could not retrieve ABRT package version')
    end
    unless Rex::Version.new(abrt_version) < Rex::Version.new('2.1.11-35.el7')
      vprint_status "ABRT package version #{abrt_version} is not vulnerable"
      return CheckCode::Safe("ABRT package version #{abrt_version} is not vulnerable")
    end
    vprint_good "ABRT package version #{abrt_version} is vulnerable"

    unless command_exists? 'python'
      vprint_error 'python is not installed'
      return CheckCode::Safe('Python is not installed')
    end
    vprint_good 'python is installed'

    CheckCode::Appears("ABRT
Metasploit Module: vCenter Sudo Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/vcenter_sudo_lpe.rb
Disclosure date: 2024-06-18
References: URL-https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453, URL-https://github.com/mbadanoiu/CVE-2024-37081/blob/main/VMware%20vCenter%20-%20CVE-2024-37081.pdf, CVE-2024-37081

Description:
VMware vCenter Server < 7.0.3 update R and < 8.0.2 update D
          contains multiple local privilege escalation vulnerabilities
          due to misconfiguration of sudo. An authenticated local user
          with non-administrative privileges may exploit these issues
          to elevate privileges to root on vCenter Server Appliance.

          Tested against VMware vCenter Server Appliance 8.0.0.10[PII_REDACTED]8

Check method (fingerprinting):
vbuild = get_vcenter_build
    # VMware VirtualCenter 7.0.3 build-19480866
    # VMware vCenter Server Appliance 6.5.0.0 Build 16197320
    # we want to try to make this build number Rex::Version friendly. https://rubular.com/r/BNLDjy0C862cdS
    # technically we only care about major release 7 and 8, however we'll try to future proof w/ \d instead
    return CheckCode::Safe("Unable to determine vcenter build from output: #{vbuild}") unless /(\d+\.\d+\.\d+) build[- ](\d+)/i =~ vbuild

    vbuild_version = Rex::Version.new("#{Regexp.last_match(1)}.#{Regexp.last_match(2)}")

    return CheckCode::Safe("Version not vulnerable: #{vbuild}") unless (vbuild_version > Rex::Version.new('8.0.0') && vbuild_version < Rex::Version.new('8.0.2.23929136')) || # 8.0 u2d
                                                                       (vbuild_version > Rex::Version.new('7.0.0') && vbuild_version < Rex::Version.new('7.0.3.24026615')) # 7.0 u3r

    vprint_good("Exploitable version detected: #{vbuild_version}")

    @user = cmd_exec('whoami').chomp
    @groups = cmd_exec('groups').chomp.split(' ')
    if ['infraprofile', 'vpxd', 'sts', 'pod'].include?(@user) || (['operator', 'admin'] & @groups).any?
      vprint_good('User is vulnerable')
    else
      return CheckCode::Safe("User not vulnerable or not in correct group. (#{@user}:#{@groups})")
    end

    CheckCode::Appears("Version #{vbuild_version} and user (#{@user}:#{@groups}) are vulnerable")
  end
Metasploit Module: Desktop Linux Password Stealer and Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/desktop_privilege_escalation.rb
Platform: linux
Disclosure date: 2014-08-07
Authors: Jakob Lell
Targets: Linux x86, Linux x86_64

Description:
This module steals the user password of an administrative user on a desktop Linux system
            when it is entered for unlocking the screen or for doing administrative actions using
            PolicyKit. Then, it escalates to root privileges using sudo and the stolen user password.
            It exploits the design weakness that there is no trusted channel for transferring the
            password from the keyboard to the actual password verification against the shadow file
            (which is running as root since /etc/shadow is only readable to the root user). Both
            screensavers (xscreensaver/gnome-screensaver) and PolicyKit use a component running under
            the current user account to query for the password and then pass it to a setuid-root binary
            to do the password verification. Therefore, it is possible to inject a password stealer
            after compromising the user account. Since sudo requires only the user password (and not
            the root password of the system), stealing the user password of an administrative user
            directly allows escalating to root privileges. Please note, you have to start a handler
            as a background job before running this exploit since the exploit will only create a shell
            when the user actually enters the password (which may be hours after launching the exploit).
            Using exploit/multi/handler with the option ExitOnSession set to false should do the job.

Check method (fingerprinting):
check_command = 'if which perl && '
    check_command << 'which sudo && '
    check_command << 'id|grep -E \'sudo|adm\' && '
    check_command << 'pidof xscreensaver gnome-screensaver polkit-gnome-authentication-agent-1;'
    check_command << 'then echo OK;'
    check_command << 'fi'

    output = cmd_exec(check_command).gsub("\r", '')

    vprint_status(output)

    if output['OK'] == 'OK'
      return Exploit::CheckCode::Vulnerable('Target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Dirty Pipe Local Privilege Escalation via CVE-2022-0847
Type: exploit
Path: modules/exploits/linux/local/cve_2022_0847_dirtypipe.rb
Disclosure date: 2022-02-20
References: CVE-2022-0847, URL-https://dirtypipe.cm4all.com, URL-https://haxx.in/files/dirtypipez.c

Description:
This exploit targets a vulnerability in the Linux kernel since 5.8, that allows
          writing of read only or immutable memory.

          The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.
          The module exploits this vulnerability by overwriting a suid binary with the
          payload, executing it, and then writing the original data back.

          There are two major limitations of this exploit: the offset cannot be on a page
          boundary (it needs to write one byte before the offset to add a reference to
          this page to the pipe), and the write cannot cross a page boundary.
          This means the payload must be less than the page size (4096 bytes).

Check method (fingerprinting):
arch = kernel_arch
    unless live_compile? || arch.include?('x64') || arch.include?('aarch64') || arch.include?('x86') || arch.include?('armle')
      return CheckCode::Safe("System architecture #{arch} is not supported without live compilation")
    end

    kernel_version = Rex::Version.new kernel_release.split('-').first
    if kernel_version < Rex::Version.new('5.8') ||
       kernel_version >= Rex::Version.new('5.16.11') ||
       (kernel_version >= Rex::Version.new('5.15.25') && kernel_version < Rex::Version.new('5.16')) ||
       (kernel_version >= Rex::Version.new('5.10.102') && kernel_version < Rex::Version.new('5.11'))
      return CheckCode::Safe("Linux kernel version #{kernel_version} is not vulnerable")
    end

    CheckCode::Appears("Linux kernel version found: #{kernel_version}")
  end
Metasploit Module: ABRT raceabrt Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/abrt_raceabrt_priv_esc.rb
Disclosure date: 2015-04-14
References: CVE-2015-3315, EDB-36747, BID-75117, URL-https://gist.github.com/taviso/fe359006836d6cd1091e, URL-http://www.openwall.com/lists/oss-security/2015/04/14/4, URL-http://www.openwall.com/lists/oss-security/2015/04/16/12, URL-https://github.com/abrt/abrt/commit/80408e9e24a1c10f85fd969e1853e0f192157f92, URL-https://access.redhat.com/security/cve/cve-2015-1862, URL-https://access.redhat.com/security/cve/cve-2015-3315, URL-https://access.redhat.com/articles/1415483

Description:
This module attempts to gain root privileges on Linux systems with
          a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
          as the crash handler.

          A race condition allows local users to change ownership of arbitrary
          files (CVE-2015-3315). This module uses a symlink attack on
          `/var/tmp/abrt/*/maps` to change the ownership of `/etc/passwd`,
          then adds a new user with UID=0 GID=0 to gain root privileges.
          Winning the race could take a few minutes.

          This module has been tested successfully on:

          abrt 2.1.11-12.el7 on RHEL 7.0 x86_64;
          abrt 2.1.5-1.fc19 on Fedora Desktop 19 x86_64;
          abrt 2.2.1-1.fc19 on Fedora Desktop 19 x86_64;
          abrt 2.2.2-2.fc20 on Fedora Desktop 20 x86_64;
          abrt 2.3.0-3.fc21 on Fedora Desktop 21 x86_64.

Check method (fingerprinting):
if immutable?('/etc/passwd')
      vprint_error 'File /etc/passwd is immutable'
      return CheckCode::Safe("'/etc/passwd' is immutable")
    end

    kernel_core_pattern = cmd_exec 'grep abrt-hook-ccpp /proc/sys/kernel/core_pattern'
    unless kernel_core_pattern.include? 'abrt-hook-ccpp'
      vprint_error 'System is NOT configured to use ABRT for crash reporting'
      return CheckCode::Safe('System is not configured to use ABRT for crash reporting')
    end
    vprint_good 'System is configured to use ABRT for crash reporting'

    if cmd_exec('[ -d /var/spool/abrt ] && echo true').include? 'true'
      vprint_error "Directory '/var/spool/abrt' exists. System has been patched."
      return CheckCode::Safe('System appears to have been patched')
    end
    vprint_good 'System does not appear to have been patched'

    unless cmd_exec('[ -d /var/tmp/abrt ] && echo true').include? 'true'
      vprint_error "Directory '/var/tmp/abrt' does NOT exist"
      return CheckCode::Safe("Directory '/var/tmp/abrt' does not exist")
    end
    vprint_good "Directory '/var/tmp/abrt' exists"

    if cmd_exec('systemctl status abrt-ccpp | grep Active').include? 'inactive'
      vprint_error 'abrt-ccp service NOT running'
      return CheckCode::Safe('abrt-ccpp service is not running')
    end
    vprint_good 'abrt-ccpp service is running'

    pkg_info = cmd_exec('yum list installed abrt | grep abrt').to_s
    abrt_version = pkg_info[/^abrt.*$/].to_s.split(/\s+/)[1]
    unless abrt_versi
Metasploit Module: Debian/Ubuntu ntfs-3g Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ntfs3g_priv_esc.rb
Disclosure date: 2017-01-05
References: CVE-2017-0358, EDB-41356, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1072
Targets: Linux x86, Linux x64

Description:
ntfs-3g mount helper in Ubuntu 16.04, 16.10, Debian 7, 8, and possibly 9 does not properly sanitize the environment when executing modprobe.
            This can be abused to load a kernel module and execute a binary payload as the root user.

Check method (fingerprinting):
# check if linux headers were installed on Debian (not ubuntu). The 'common' headers won't work.
    def headers_installed?
      output = cmd_exec('dpkg -l | grep \'^ii\' | grep linux-headers.*[^common]{7}')
      if output
        if output.include?('linux-headers')
          return true
        else
          print_error('Linux kernel headers not available, compiling will fail.')
          return false
        end
      end
      false
    end

    output = cmd_exec('dpkg -l ntfs-3g | grep \'^ii\'')
    if output
      if output.include?('1:2015.3.14AR.1-1build1') # Ubuntu 16.04 LTS
        print_good('Vulnerable Ubuntu 16.04 detected')
        CheckCode::Appears('Vulnerable ntfs-3g version detected')
      elsif output.include?('1:2016.2.22AR.1-3') # Ubuntu 16.10
        print_good('Vulnerable Ubuntu 16.10 detected')
        CheckCode::Appears('Vulnerable ntfs-3g version detected')
      elsif output.include?('1:2012.1.15AR.5-2.1+deb7u2') # Debian Wheezy, we also need linux-source installed
        print_good('Vulnerable Debian 7 (wheezy) detected')
        if headers_installed?
          return CheckCode::Appears('Vulnerable ntfs-3g version detected')
        else
          return CheckCode::Safe('Linux kernel headers are not available')
        end
      elsif output.include?('1:2014.2.15AR.2-1+deb8u2') # Debian Jessie, we also need linux-source installed
        print_good('Vulnerable Debian 8 (jessie) detected')
        if headers_installed?
          return CheckCode
Metasploit Module: Microsoft OMI Management Interface Authentication Bypass
Type: exploit
Path: modules/exploits/linux/local/cve_2021_38648_omigod.rb
Platform: unix
Disclosure date: 2021-09-14
References: CVE-2021-38648, URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648, URL-https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure, URL-https://attackerkb.com/topics/08O94gYdF1/cve-2021-38647
Targets: Unix Command, Linux Dropper

Description:
By removing the authentication exchange, an attacker can issue requests to the local OMI management socket
          that will cause it to execute an operating system command as the root user. This vulnerability was patched in
          OMI version 1.6.8-1 (released September 8th 2021).

Check method (fingerprinting):
pid = pidof('omiserver').first
    return CheckCode::Safe('The omiserver process was not found.') if pid.nil?

    omiserver_bin = read_file("/proc/#{pid}/cmdline").split("\x00", 2).first
    omiserver_bin = DEFAULT_SERVER_BIN_PATH if omiserver_bin.blank? && file?(DEFAULT_SERVER_BIN_PATH)
    return CheckCode::Unknown('Failed to find the omiserver binary path.') if omiserver_bin.blank?

    vprint_status("Found #{omiserver_bin} running in PID: #{pid}")
    if cmd_exec("#{omiserver_bin} --version") =~ /\sOMI-(\d+(\.\d+){2,3}(-\d+)?)\s/
      version = Regexp.last_match(1)
    else
      return CheckCode::Unknown('Failed to identify the version of the omiserver binary.')
    end

    return CheckCode::Safe("Version #{version} is not affected.") if Rex::Version.new(version) > Rex::Version.new('1.6.8-0')

    CheckCode::Appears("Version #{version} is affected.")
  end
Metasploit Module: Kloxo Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/kloxo_lxsuexec.rb
Disclosure date: 2012-09-18
References: CVE-2012-10022, EDB-25406, OSVDB-93287, URL-http://roothackers.net/showthread.php?tid=92

Description:
Version 6.1.12 and earlier of Kloxo contain two setuid root binaries such as
            lxsuexec and lxrestart, allow local privilege escalation to root from uid 48,
            Apache by default on CentOS 5.8, the operating system supported by Kloxo.
            This module has been tested successfully with Kloxo 6.1.12 and 6.1.6.
Metasploit Module: Login to Another User with Su on Linux / Unix Systems
Type: exploit
Path: modules/exploits/linux/local/su_login.rb
Platform: linux
Disclosure date: 1971-11-03
Authors: Gavin Youker <youkergav@gmail.com>
Targets: Linux x86, Linux x86_64

Description:
This module attempts to create a new login session by
          invoking the su command of a valid username and password.

          If the login is successful, a new session is created via
          the specified payload.

          Because su forces passwords to be passed over stdin, this
          module attempts to invoke a psuedo-terminal with python,
          python3, or script.

Check method (fingerprinting):
# Make sure su is installed.
    unless command_exists?('su')
      vprint_error('su not found on target machine')
      return CheckCode::Safe('su is not found on target')
    end

    # Make sure a program to run the exploit is installed.
    prorgam = find_exec_program
    unless prorgam
      vprint_error('One of the following programs must be installed on target: python, python3, script')
      return CheckCode::Safe('Required program is not installed on target')
    end

    # Make sure script requirements are met.
    if prorgam == 'script'
      # Check for command dependencies.
      commands = ['sh', 'sleep', 'echo', 'base64']
      for command in commands
        unless command_exists?(command)
          vprint_error("The '#{command}' must be installed on target")
          return CheckCode::Safe('Required command is not installed on target')
        end
      end

      # Check that the script program is apart of the util-linux package.
      version = find_util_linux_verison
      unless version
        vprint_error("The 'script' program must be of the 'util-linux' package")
        return CheckCode::Safe("The 'script' program is not from the util-linux package")
      end

      # Check that util-linux in of a compatible version.
      unless version >= Rex::Version.new('2.25')
        vprint_error("The package 'util-linux' must be version 2.25 or higher")
        return CheckCode::Safe("util-linux version #{version} is not compatible")
      end
    end

    re
Metasploit Module: Docker Container Escape Via runC Overwrite
Type: exploit
Path: modules/exploits/linux/local/docker_runc_escape.rb
Platform: unix
Disclosure date: 2019-01-01
References: CVE-2019-5736, URL-https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html, URL-https://www.openwall.com/lists/oss-security/2019/02/13/3, URL-https://www.docker.com/blog/docker-security-update-cve-2018-5736-and-container-security-best-practices/
Targets: Unix (In-Memory), Linux (Dropper) x64, Linux (Dropper) x86

Description:
This module leverages a flaw in `runc` to escape a Docker container
          and get command execution on the host as root. This vulnerability is
          identified as CVE-2019-5736. It overwrites the `runc` binary with the
          payload and wait for someone to use `docker exec` to get into the
          container. This will trigger the payload execution.

          Note that executing this exploit carries important risks regarding
          the Docker installation integrity on the target and inside the
          container ('Side Effects' section in the documentation).