deardaniel/secdata-raw huggingface dataset:
Metasploit Module: PostgreSQL for Microsoft Windows Payload Execution
Type: exploit
Path: modules/exploits/windows/postgres/postgres_payload.rb
Platform: win
Disclosure date: 2009-04-10
References: URL-https://web.archive.org/web/[PII_REDACTED]2909/http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql
Targets: Windows x86, Windows x64

Description:
On default Microsoft Windows installations of PostgreSQL the postgres
          service account may write to the current directory (which is usually
          "C:\Program Files\PostgreSQL\<version>\data" where <version> is the
          major.minor version of PostgreSQL). UDF DLL's may be sourced from
          there as well.

          This module uploads a Windows DLL file via the pg_largeobject method
          of binary injection and creates a UDF (user defined function) from
          that DLL. Because the payload is run from DllMain, it does not need to
          conform to specific Postgres API versions.

Check method (fingerprinting):
version = postgres_fingerprint

    if version[:auth]
      print_good "Authentication successful. Version: #{version}"
      return CheckCode::Appears("Authenticated successfully; PostgreSQL version: #{version[:auth]}") # WRITE permission needs to be proven to get Vulnerable
    else
      print_error "Authentication failed. #{version[:preauth] || version[:unknown]}"
      return CheckCode::Safe('PostgreSQL authentication failed')
    end
  end
Metasploit Module: WinRM Script Exec Remote Code Execution
Type: exploit
Path: modules/exploits/windows/winrm/winrm_script_exec.rb
Platform: win
Disclosure date: 2012-11-01
References: URL-http://msdn.microsoft.com/en-us/library/windows/desktop/aa384426(v=vs.85).aspx

Description:
This module uses valid credentials to login to the WinRM service
          and execute a payload. It has two available methods for payload
          delivery: Powershell 2 (and above) and VBS CmdStager.

          The module will check if Powershell is available, and if so uses
          that method. Otherwise it falls back to the VBS CmdStager which is
          less stealthy.
Metasploit Module: Symantec System Center Alert Management System (hndlrsvc.exe) Arbitrary Command Execution
Type: exploit
Path: modules/exploits/windows/antivirus/ams_hndlrsvc.rb
Platform: win
Disclosure date: 2010-07-26
References: OSVDB-66807, BID-41959, CVE-2010-0111, URL-http://www.foofus.net/~spider/code/AMS2_072610.txt
Targets: Windows Universal

Description:
Symantec System Center Alert Management System is prone to a
          remote command-injection vulnerability because the application fails
          to properly sanitize user-supplied input.  This is part of Symantec
          AntiVirus Corporate Edition 8.0 - 10.1.7.
Metasploit Module: Trend Micro ServerProtect 5.58 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/antivirus/trendmicro_serverprotect.rb
Platform: win
Disclosure date: 2007-02-20
References: CVE-2007-1070, OSVDB-33042, BID-22639

Description:
This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
          By sending a specially crafted RPC request, an attacker could overflow the
          buffer and execute arbitrary code.
Metasploit Module: Trend Micro ServerProtect 5.58 CreateBinding() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/antivirus/trendmicro_serverprotect_createbinding.rb
Platform: win
Disclosure date: 2007-05-07
References: CVE-2007-2508, OSVDB-35790, BID-23868

Description:
This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060.
          By sending a specially crafted RPC request, an attacker could overflow the
          buffer and execute arbitrary code.
Metasploit Module: Trend Micro ServerProtect 5.58 EarthAgent.EXE Buffer Overflow
Type: exploit
Path: modules/exploits/windows/antivirus/trendmicro_serverprotect_earthagent.rb
Platform: win
Disclosure date: 2007-05-07
References: CVE-2007-2508, OSVDB-35789, BID-23866

Description:
This module exploits a buffer overflow in Trend Micro ServerProtect 5.58 Build 1060
          EarthAgent.EXE. By sending a specially crafted RPC request, an attacker could overflow the
          buffer and execute arbitrary code.
Metasploit Module: Symantec Workspace Streaming ManagementAgentServer.putFile XMLRPC Request Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/antivirus/symantec_workspace_streaming_exec.rb
Platform: java
Disclosure date: 2014-05-12
References: CVE-2014-1649, OSVDB-106923, BID-67189, ZDI-14-127, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140512_00

Description:
This module exploits a code execution flaw in Symantec Workspace Streaming. The
          vulnerability exists in the ManagementAgentServer.putFile XMLRPC call exposed by the
          as_agent.exe service, which allows for uploading arbitrary files under the server root.
          This module abuses the auto deploy feature in the JBoss as_ste.exe instance in order
          to achieve remote code execution. This module has been tested successfully on Symantec
          Workspace Streaming 6.1 SP8 and Windows 2003 SP2, and reported to affect 7.5.0.x.
          Abused services listen on a single-machine deployment and also in the backend role in
          a multiple-machine deployment.

Check method (fingerprinting):
check_result = Exploit::CheckCode::Safe('Symantec Workspace Streaming not detected')

    if jboss_deploy_path.nil?
      xml = build_soap_check_put
      res = send_xml_rpc_request(xml)

      if res && res.code == 200 && res.body && res.body.to_s =~ /No method matching arguments/
        check_result = Exploit::CheckCode::Detected('Symantec Workspace Streaming SOAP endpoint detected')
      end
    else
      check_result = Exploit::CheckCode::Appears('Symantec Workspace Streaming JBoss deployment path found')
    end

    check_result
  end
Metasploit Module: Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution
Type: exploit
Path: modules/exploits/windows/antivirus/symantec_endpoint_manager_rce.rb
Platform: win
Disclosure date: 2014-02-24
References: CVE-2013-5014, CVE-2013-5015, OSVDB-103305, OSVDB-103306, EDB-31853, URL-https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt

Description:
This module exploits XXE and SQL injection flaws in Symantec Endpoint Protection Manager
          versions 11.0, 12.0 and 12.1. When supplying a specially crafted XML external entity (XXE) request an attacker
          can reach SQL injection affected components. As xp_cmdshell is enabled in the included
          database instance, it's possible to execute arbitrary system commands on the target
          with SYSTEM privileges.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'uri' => normalize_uri(target_uri.path),
        'method' => 'GET',
      }
    )

    if res && res.code == 200 && res.body =~ /Symantec Endpoint Protection Manager/ && res.body =~ /1995 - 2013 Symantec Corporation/
      return Exploit::CheckCode::Appears('Symantec Endpoint Protection Manager detected')
    end

    Exploit::CheckCode::Safe('Symantec Endpoint Protection Manager not detected')
  end
Metasploit Module: Symantec Remote Management Buffer Overflow
Type: exploit
Path: modules/exploits/windows/antivirus/symantec_rtvscan.rb
Platform: win
Disclosure date: 2006-05-24
References: CVE-2006-2630, OSVDB-25846, BID-18107, URL-http://research.eeye.com/html/advisories/published/AD20060612.html

Description:
This module exploits a stack buffer overflow in Symantec Client Security 3.0.x.
          This module has only been tested against Symantec Client Security 3.0.2
          build 10.0.2.2000.
Metasploit Module: Symantec Alert Management System Intel Alert Originator Service Buffer Overflow
Type: exploit
Path: modules/exploits/windows/antivirus/symantec_iao.rb
Platform: win
Disclosure date: 2009-04-28
References: CVE-2009-1430, OSVDB-54159, BID-34674

Description:
This module exploits a stack buffer overflow in Intel Alert Originator Service msgsys.exe.
          When an attacker sends a specially crafted alert, arbitrary code may be executed.
Metasploit Module: Symantec System Center Alert Management System (xfr.exe) Arbitrary Command Execution
Type: exploit
Path: modules/exploits/windows/antivirus/ams_xfr.rb
Platform: win
Disclosure date: 2009-04-28
References: CVE-2009-1429, BID-34671, OSVDB-54157, ZDI-09-060, URL-http://www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20090428_02
Targets: Windows Universal

Description:
Symantec System Center Alert Management System is prone to a remote command-injection vulnerability
          because the application fails to properly sanitize user-supplied input.
Metasploit Module: MS08-068 Microsoft Windows SMB Relay Code Execution
Type: exploit
Path: modules/exploits/windows/smb/smb_relay.rb
Platform: win
Disclosure date: 2001-03-31
References: CVE-2008-4037, OSVDB-49736, MSB-MS08-068, URL-http://blogs.technet.com/swi/archive/2008/11/11/smb-credential-reflection.aspx, URL-https://en.wikipedia.org/wiki/SMBRelay, URL-http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
Targets: Automatic, PowerShell, Native upload, MOF upload, Command

Description:
This module will relay SMB authentication requests to another
          host, gaining access to an authenticated SMB session if successful.
          If the connecting user is an administrator and network logins are
          allowed to the target machine, this module will execute an arbitrary
          payload. To exploit this, the target system	must try to	authenticate
          to this module. The easiest way to force a SMB authentication attempt
          is by embedding a UNC path (\SERVER\SHARE) into a web page or
          email message. When the victim views the web page or email, their
          system will automatically connect to the server specified in the UNC
          share (the IP address of the system running this module) and attempt
          to authenticate.  Unfortunately, this
          module is not able to clean up after itself. The service and payload
          file listed in the output will need to be manually removed after access
          has been gained. The service created by this tool uses a randomly chosen
          name and description, so the services list can become cluttered after
          repeated exploitation.

          The SMB authentication relay attack was first reported by Sir Dystic on
          March 31st, 2001 at @lanta.con in Atlanta, Georgia.

          On November 11th 2008 Microsoft released bulletin MS08-068. This bulletin
          includes a patch which prevents the relaying of challenge keys back to
          the host which issued them, preventing this exploit from working in
          the default configuration. It is still possible to set the SMBHOST
          parameter to a third-party host that the victim is authorized to access,
          but the "reflection" attack has been effectively broken.

          As of Feb 2022 - this module does not support SMB 1.
Metasploit Module: MS05-039 Microsoft Plug and Play Service Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms05_039_pnp.rb
Platform: win
Disclosure date: 2005-08-09
Authors: ExaProbe <fmourron@exaprobe.com>, Pita Houmous <pita@mail.com>, Michael Thumann <mthumann@ernw.de>, acaro <acaro@jervus.it>
References: CVE-2005-1983, OSVDB-18605, BID-14513, MSB-MS05-039

Description:
This module exploits a stack buffer overflow in the Windows Plug
          and Play service. This vulnerability can be exploited on
          Windows 2000 without a valid user account.

          NOTE: Since the PnP service runs inside the service.exe process, a failed
          exploit attempt will cause the system to automatically reboot.

Check method (fingerprinting):
if (pnp_probe('A'))
      return Exploit::CheckCode::Vulnerable('Target is vulnerable to MS05-039 PnP overflow')
    end

    return Exploit::CheckCode::Safe('Target does not appear vulnerable to MS05-039')
  end
Metasploit Module: MS08-067 Microsoft Server Service Relative Path Stack Corruption
Type: exploit
Path: modules/exploits/windows/smb/ms08_067_netapi.rb
Platform: win
Disclosure date: 2008-10-28
References: URL-https://www.rapid7.com/db/vulnerabilities/dcerpc-ms-netapi-netpathcanonicalize-dos/

Description:
This module exploits a parsing flaw in the path canonicalization code of
          NetAPI32.dll through the Server Service. This module is capable of bypassing
          NX on some operating systems and service packs. The correct target must be
          used to prevent the Server Service (along with a dozen others in the same
          process) from crashing. Windows XP targets seem to handle multiple successful
          exploitation events, but 2003 targets will often crash or hang on subsequent
          attempts. This is just the first version of this module, full support for
          NX bypass on 2003, along with other platforms, is still in development.

Check method (fingerprinting):
begin
      connect(versions: [1])
      smb_login
    rescue Rex::ConnectionError => e
      vprint_error("Connection failed: #{e.class}: #{e}")
      return Msf::Exploit::CheckCode::Unknown('Connection failed')
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
      if e.message =~ /Connection reset/
        vprint_error('Connection reset during login')
        vprint_error('This most likely means a previous exploit attempt caused the service to crash')
        return Msf::Exploit::CheckCode::Unknown('Connection reset during login, service may have crashed')
      else
        raise e
      end
    end

    #
    # Build the malicious path name
    # 5b878ae7 "db @eax;g"
    prefix = '\\'
    path =
      "\x00\\\x00/" * 0x10 +
      Rex::Text.to_unicode('\\') +
      Rex::Text.to_unicode('R7') +
      Rex::Text.to_unicode('\\..\\..\\') +
      Rex::Text.to_unicode('R7') +
      "\x00" * 2

    server = Rex::Text.rand_text_alpha(rand(8) + 1).upcase

    handle = dcerpc_handle('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
                           'ncacn_np', ["\\#{datastore['SMBPIPE']}"])

    begin
      # Samba doesn't have this handle and returns an ErrorCode
      dcerpc_bind(handle)
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
      vprint_error("SMB error: #{e.message}")
      return Msf::Exploit::CheckCode::Safe('SMB service does not appear to be vulnerable')
    end

    vprint_status('Verifying vulnerable status... (path: 0x%08x)' % path.length)
Metasploit Module: SMB DOUBLEPULSAR Remote Code Execution
Type: exploit
Path: modules/exploits/windows/smb/smb_doublepulsar_rce.rb
Platform: win
Disclosure date: 2017-04-14
References: MSB-MS17-010, CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, CVE-2017-0147, CVE-2017-0148, URL-https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html, URL-https://countercept.com/blog/analyzing-the-doublepulsar-kernel-dll-injection-technique/, URL-https://www.countercept.com/blog/doublepulsar-usermode-analysis-generic-reflective-dll-loader/

Description:
This module executes a Metasploit payload against the Equation Group's
          DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE.

          While this module primarily performs code execution against the implant,
          the "Neutralize implant" target allows you to disable the implant.

Check method (fingerprinting):
ipc_share = "\\\\#{rhost}\\IPC$"

    @tree_id = do_smb_setup_tree(ipc_share)
    vprint_good("Connected to #{ipc_share} with TID = #{@tree_id}")
    vprint_status("Target OS is #{smb_peer_os}")

    print_status('Sending ping to DOUBLEPULSAR')
    code, signature1, signature2 = do_smb_doublepulsar_pkt
    msg = 'Host is likely INFECTED with DoublePulsar!'

    case calculate_doublepulsar_status(@multiplex_id, code)
    when :success
      @xor_key = calculate_doublepulsar_xor_key(signature1)
      @arch = calculate_doublepulsar_arch(signature2)

      arch_str =
        case @arch
        when ARCH_X86
          'x86 (32-bit)'
        when ARCH_X64
          'x64 (64-bit)'
        end

      print_warning("#{msg} - Arch: #{arch_str}, XOR Key: 0x#{@xor_key.to_s(16).upcase}")
      CheckCode::Vulnerable('DOUBLEPULSAR implant detected')
    when :not_detected
      print_error('DOUBLEPULSAR not detected or disabled')
      CheckCode::Safe('DOUBLEPULSAR not detected or disabled')
    else
      print_error('An unknown error occurred')
      CheckCode::Unknown('An unknown error occurred during DOUBLEPULSAR detection')
    end
  end
Metasploit Module: MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms04_007_killbill.rb
Platform: win
Disclosure date: 2004-02-10
References: CVE-2003-0818, OSVDB-3902, BID-9633, MSB-MS04-007

Description:
This is an exploit for a previously undisclosed
          vulnerability in the bit string decoding code in the
          Microsoft ASN.1 library. This vulnerability is not related
          to the bit string vulnerability described in eEye advisory
          AD20040210-2. Both vulnerabilities were fixed in the
          MS04-007 patch.  Windows 2000 SP4 Rollup 1 also patches this
          vulnerability.

          You are only allowed one attempt with this vulnerability. If
          the payload fails to execute, the LSASS system service will
          crash and the target system will automatically reboot itself
          in 60 seconds. If the payload succeeds, the system will no
          longer be able to process authentication requests, denying
          all attempts to login through SMB or at the console. A
          reboot is required to restore proper functioning of an
          exploited system.

          This exploit has been successfully tested with the win32/*/reverse_tcp
          payloads, however a few problems were encountered when using the
          equivalent bind payloads. Your mileage may vary.
Metasploit Module: MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference
Type: exploit
Path: modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb
Platform: win
Disclosure date: 2009-09-07
References: MSB-MS09-050, CVE-2009-3103, BID-36299, OSVDB-57799, URL-https://seclists.org/fulldisclosure/2009/Sep/0039.html
Targets: Windows Vista SP1/SP2 and Server 2008 (x86)

Description:
This module exploits an out of bounds function table dereference in the SMB
          request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7
          release candidates (not RTM), and Windows 2008 Server prior to R2. Windows Vista
          without SP1 does not seem affected by this flaw.
Metasploit Module: Generic DLL Injection From Shared Resource
Type: exploit
Path: modules/exploits/windows/smb/generic_smb_dll_injection.rb
Platform: win
Disclosure date: 2015-03-04
Targets: Windows x86, Windows x64

Description:
This is a general-purpose module for exploiting conditions where a DLL can be loaded
          from a specified SMB share. This module serves payloads as DLLs over an SMB service.
Metasploit Module: SMB Delivery
Type: exploit
Path: modules/exploits/windows/smb/smb_delivery.rb
Platform: win
Disclosure date: 2016-07-26
References: URL-https://github.com/rapid7/metasploit-framework/pull/3074
Targets: DLL, PSH

Description:
This module serves payloads via an SMB server and provides commands to retrieve
          and execute the generated payloads. Currently supports DLLs and Powershell.
Metasploit Module: MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms06_070_wkssvc.rb
Platform: win
Disclosure date: 2006-11-14
References: CVE-2006-4691, OSVDB-30263, BID-20985, MSB-MS06-070

Description:
This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect
          function using the Workstation service in Windows 2000 SP4 and Windows XP SP2.

          In order to exploit this vulnerability, you must specify the name of a
          valid Windows DOMAIN. It may be possible to satisfy this condition by using
          a custom DNS and LDAP setup, however that method is not covered here.

          Although Windows XP SP2 is vulnerable, Microsoft reports that Administrator
          credentials are required to reach the vulnerable code. Windows XP SP1 only
          requires valid user credentials. Also, testing shows that a machine already
          joined to a domain is not exploitable.
Metasploit Module: MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms06_040_netapi.rb
Platform: win
Disclosure date: 2006-08-08
References: CVE-2006-3439, OSVDB-27845, BID-19409, MSB-MS06-040

Description:
This module exploits a stack buffer overflow in the NetApi32 CanonicalizePathName() function
          using the NetpwPathCanonicalize RPC call in the Server Service. It is likely that
          other RPC calls could be used to exploit this service. This exploit will result in
          a denial of service on Windows XP SP2 or Windows 2003 SP1. A failed exploit attempt
          will likely result in a complete reboot on Windows 2000 and the termination of all
          SMB-related services on Windows XP. The default target for this exploit should succeed
          on Windows NT 4.0, Windows 2000 SP0-SP4+, Windows XP SP0-SP1 and Windows 2003 SP0.
Metasploit Module: Microsoft Windows Shell LNK Code Execution
Type: exploit
Path: modules/exploits/windows/smb/ms15_020_shortcut_icon_dllloader.rb
Platform: win
Disclosure date: 2015-03-10
References: CVE-2015-0096, MSB-MS15-020, URL-http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Full-details-on-CVE-2015-0096-and-the-failed-MS10-046-Stuxnet/ba-p/6718459#.VQBOymTF9so, URL-https://github.com/rapid7/metasploit-framework/pull/4911

Description:
This module exploits a vulnerability in the MS10-046 patch to abuse (again) the handling
          of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious
          DLL. This creates an SMB resource to provide the payload and the trigger, and generates a
          LNK file which must be sent to the target. This module has been tested successfully on
          Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with MS14-027
          installed.
Metasploit Module: MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow
Type: exploit
Path: modules/exploits/windows/smb/ms03_049_netapi.rb
Platform: win
Disclosure date: 2003-11-11
References: CVE-2003-0812, OSVDB-11461, BID-9011, MSB-MS03-049

Description:
This module exploits a stack buffer overflow in the NetApi32 NetAddAlternateComputerName
          function using the Workstation service in Windows XP.