deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Apache HugeGraph Gremlin RCE
Type: exploit
Path: modules/exploits/linux/http/apache_hugegraph_gremlin_rce.rb
Platform: %w[unix linux
Disclosure date: 2024-04-22
References: URL-https://blog.securelayer7.net/remote-code-execution-in-apache-hugegraph/, CVE-2024-27348

Description:
This module exploits CVE-2024-27348 which is a Remote Code Execution (RCE) vulnerability that exists in
          Apache HugeGraph Server in versions before 1.3.0. An attacker can bypass the sandbox restrictions and achieve
          RCE through Gremlin, resulting in complete control over the server

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET'
    })

    return CheckCode::Unknown('No response from the vulnerable endpoint /gremlin') unless res
    return CheckCode::Unknown("The response from the vulnerable endpoint /gremlin was: #{res.code} (expected: 200)") unless res.code == 200

    version = res.get_json_document&.dig('version')
    return CheckCode::Unknown('Unable able to determine the version of Apache HugeGraph') unless version

    if Rex::Version.new(version).between?(Rex::Version.new('1.0.0'), Rex::Version.new('1.3.0'))
      return CheckCode::Appears("Apache HugeGraph version detected: #{version}")
    end

    CheckCode::Safe("Apache HugeGraph version detected: #{version}")
  end
Metasploit Module: Apache Continuum Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/apache_continuum_cmd_exec.rb
Platform: linux
Disclosure date: 2016-04-06

Description:
This module exploits a command injection in Apache Continuum <= 1.4.2.
          By injecting a command into the installation.varValue POST parameter to
          /continuum/saveInstallation.action, a shell can be spawned.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/continuum/about.action'
    )

    if res && res.body.include?('1.4.2')
      CheckCode::Appears('The target appears to be vulnerable')
    elsif res && res.code == 200
      CheckCode::Detected('The target service was detected')
    else
      CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: LibreNMS Collectd Command Injection
Type: exploit
Path: modules/exploits/linux/http/librenms_collectd_cmd_inject.rb
Platform: unix
Disclosure date: 2019-07-15
References: CVE-2019-10669, URL-https://www.darkmatter.ae/xen1thlabs/librenms-command-injection-vulnerability-xl-19-017/
Targets: Linux

Description:
This module exploits a command injection vulnerability in the
          Collectd graphing functionality in LibreNMS.

          The `to` and `from` parameters used to define the range for
          a graph are sanitized using the `mysqli_escape_real_string()`
          function, which permits backticks. These parameters are used
          as part of a shell command that gets executed via the `passthru()`
          function, which can result in code execution.

Check method (fingerprinting):
res = send_request_cgi!('method' => 'GET', 'uri' => target_uri.path)
    return Exploit::CheckCode::Safe('The target is not vulnerable') unless res && res.body.downcase.include?('librenms')

    about_res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'pages', 'about.inc.php')
    )

    return Exploit::CheckCode::Detected('The target service was detected') unless about_res && about_res.code == 200

    version = about_res.body.match(/version\s+to\s+(\d+\.\d+\.?\d*)/)
    return Exploit::CheckCode::Detected('LibreNMS detected but version could not be determined') unless version && version.length > 1

    vprint_status("LibreNMS version #{version[1]} detected")
    version = Rex::Version.new(version[1])

    return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if version <= Rex::Version.new('1.50')

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Pulse Secure VPN Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/pulse_secure_cmd_exec.rb
Platform: unix
Disclosure date: 2019-04-24
References: CVE-2019-11539, URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44101/, URL-https://blog.orange.tw/2019/09/attacking-ssl-vpn-part-3-golden-pulse-secure-rce-chain.html, URL-https://hackerone.com/reports/591295
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits a post-auth command injection in the Pulse Secure
          VPN server to execute commands as root. The env(1) command is used to
          bypass application whitelisting and run arbitrary commands.

          Please see related module auxiliary/gather/pulse_secure_file_disclosure
          for a pre-auth file read that is able to obtain plaintext and hashed
          credentials, plus session IDs that may be used with this exploit.

          A valid administrator session ID is required in lieu of untested SSRF.
Metasploit Module: Berlios GPSD Format String Vulnerability
Type: exploit
Path: modules/exploits/linux/http/gpsd_format_string.rb
Platform: linux
Disclosure date: 2005-05-25
References: CVE-2004-1388, OSVDB-13199, BID-12371, URL-http://www.securiteam.com/unixfocus/5LP0M1PEKK.html

Description:
This module exploits a format string vulnerability in the Berlios GPSD server.
          This vulnerability was discovered by Kevin Finisterre.
Metasploit Module: Supervisor XML-RPC Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/supervisor_xmlrpc_exec.rb
Platform: linux
Disclosure date: 2017-07-19
References: URL-https://github.com/Supervisor/supervisor/issues/964, URL-https://www.debian.org/security/2017/dsa-3942, URL-https://github.com/phith0n/vulhub/tree/master/supervisor/CVE-2017-11610, CVE-2017-11610

Description:
This module exploits a vulnerability in the Supervisor process control software, where an authenticated client
          can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server.
          The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this
          may be root. This vulnerability can only be exploited by an authenticated client, or if supervisord has been
          configured to run an HTTP server without authentication. This vulnerability affects versions 3.0a1 to 3.3.2.

Check method (fingerprinting):
print_status('Extracting version from web interface..')

    params = {
      'method' => 'GET',
      'uri' => normalize_uri('/')
    }
    if !datastore['HttpUsername'].to_s.empty? and !datastore['HttpPassword'].to_s.empty?
      print_status("Using basic auth (#{datastore['HttpUsername']}:#{datastore['HttpPassword']})")
      params.merge!({ 'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']) })
    end
    res = send_request_cgi(params)

    if res
      if res.code == 200
        match = res.body.match(/<span>(\d+\.[\dab]\.\d+)<\/span>/)
        if match
          version = Rex::Version.new(match[1])
          if check_version(version)
            print_good("Vulnerable version found: #{version}")
            return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
          else
            print_bad("Version #{version} is not vulnerable")
            return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
          end
        else
          print_bad('Could not extract version number from web interface')
          return Exploit::CheckCode::Unknown('Could not determine the target status')
        end
      elsif res.code == 401
        print_bad("Authentication failed: #{res.code} response")
        return Exploit::CheckCode::Detected('Authentication required (HTTP 401)')
      else
        print_bad("Unexpected HTTP code: #{res.code} response")
        return Exploit::CheckCode::Unknown('Could n
Metasploit Module: QNAP Q'Center change_passwd Command Execution
Type: exploit
Path: modules/exploits/linux/http/qnap_qcenter_change_passwd_exec.rb
Platform: linux
Disclosure date: 2018-07-11
References: CVE-2018-0706, CVE-2018-0707, EDB-45015, URL-https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilities, URL-https://seclists.org/fulldisclosure/2018/Jul/45, URL-https://www.securityfocus.com/archive/1/542141, URL-https://www.qnap.com/en-us/security-advisory/nas-201807-10

Description:
This module exploits a command injection vulnerability in the
          `change_passwd` API method within the web interface of QNAP Q'Center
          virtual appliance versions prior to 1.7.1083.

          The vulnerability allows the 'admin' privileged user account to
          execute arbitrary commands as the 'admin' operating system user.

          Valid credentials for the 'admin' user account are required, however,
          this module also exploits a separate password disclosure issue which
          allows any authenticated user to view the password set for the 'admin'
          user during first install.

          This module has been tested successfully on QNAP Q'Center appliance
          version 1.6.1075.

Check method (fingerprinting):
res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'index.html')

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200 && res.body.include?("<title>Q'center</title>")
      vprint_error "Target is not a QNAP Q'Center appliance"
      return CheckCode::Safe('The target is not vulnerable')
    end

    version = res.body.scan(/\.js\?_v=([\d\.]+)/).flatten.first
    if version.to_s.eql? ''
      vprint_error "Could not determine QNAP Q'Center appliance version"
      return CheckCode::Detected("QNAP Q'Center detected, but the version could not be determined")
    end

    version = Rex::Version.new version
    vprint_status "Target is QNAP Q'Center appliance version #{version}"

    if version >= Rex::Version.new('1.7.1083')
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    CheckCode::Appears("Version #{version} appears to be vulnerable")
  end
Metasploit Module: Gitlist Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/gitlist_exec.rb
Platform: unix
Disclosure date: 2014-06-30
References: CVE-2014-4511, EDB-33929, URL-http://hatriot.github.io/blog/2014/06/29/gitlist-rce/

Description:
This module exploits an unauthenticated remote command execution vulnerability
          in version 0.4.0 of Gitlist. The problem exists in the handling of a specially
          crafted file name when trying to blame it.

Check method (fingerprinting):
repo = get_repo

    if repo.nil?
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    chk = Rex::Text.encode_base64(rand_text_alpha(rand(32) + 5))

    res = send_command(repo, "echo${IFS}" + chk + "|base64${IFS}--decode")

    if res && res.body
      if res.body.include?(Rex::Text.decode_base64(chk))
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      elsif res.body.to_s =~ /sh.*not found/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Chaos RAT XSS to RCE
Type: exploit
Path: modules/exploits/linux/http/chaos_rat_xss_to_rce.rb
Platform: linux
Disclosure date: 2024-04-10
References: URL-https://github.com/chebuya/CVE-2024-30850-chaos-rat-rce-poc, URL-https://github.com/tiagorlampert/CHAOS, CVE-2024-31839, CVE-2024-30850

Description:
CHAOS v5.0.8 is a free and open-source Remote Administration Tool that
          allows generated binaries to control remote operating systems. The
          webapp contains a remote command execution vulnerability which
          can be triggered by an authenticated user when generating a new
          executable. The webapp also contains an XSS vulnerability within
          the view of a returned command being executed on an agent.

          Execution can happen through one of three routes:

          1. Provided credentials can be used to execute the RCE directly

          2. A JWT token from an agent can be provided to emulate a compromised
          host. If a logged in user attempts to execute a command on the host
          the returned value contains an xss payload.

          3. Similar to technique 2, an agent executable can be provided and the
          JWT token can be extracted.

          Verified against CHAOS 7d5b20ad7e58e5b525abdcb3a12514b88e87cef2 running
          in a docker container.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )

    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Safe("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") if res.code == 200

    return CheckCode::Detected('Chaos application found') if res.body.include?('<title>CHAOS</title>')

    CheckCode::Safe('Chaos application not found')
  end
Metasploit Module: F5 BIG-IP iControl CSRF File Write SOAP API
Type: exploit
Path: modules/exploits/linux/http/f5_icontrol_soap_csrf_rce_cve_2022_41622.rb
Platform: unix
Disclosure date: 2022-11-16
References: CVE-2022-41622, URL-https://github.com/rbowes-r7/refreshing-soap-exploit, URL-https://www.rapid7.com/blog/post/2022/11/16/cve-2022-41622-and-cve-2022-41800-fixed-f5-big-ip-and-icontrol-rest-vulnerabilities-and-exposures/, URL-https://support.f5.com/csp/article/K97843387, URL-https://support.f5.com/csp/article/K94221585, URL-https://support.f5.com/csp/article/K05403841

Description:
This module exploits a cross-site request forgery (CSRF) vulnerability
          in F5 Big-IP's iControl interface to write an arbitrary file to the
          filesystem.

          While any file can be written to any location as root, the
          exploitability is limited by SELinux; the vast majority of writable
          locations are unavailable. By default, we write to a script that
          executes at reboot, which means the payload will execute the next time
          the server boots.

          An alternate target - Login - will add a backdoor that executes next
          time a user logs in interactively. This overwrites a file,
          but we restore it when we get a session

          Note that because this is a CSRF vulnerability, it starts a web
          server, but an authenticated administrator must visit the site, which
          redirects them to the target.
Metasploit Module: Axis IP Camera Application Upload
Type: exploit
Path: modules/exploits/linux/http/axis_app_install.rb
Platform: linux
Disclosure date: 2018-04-12
References: URL-https://www.tenable.com/blog/tenable-research-advisory-axis-camera-app-malicious-package-distribution-weakness, URL-https://www.axis.com/support/developer-support/axis-camera-application-platform
Targets: Linux Dropper

Description:
This module exploits the "Apps" feature in Axis IP cameras. The feature allows third party
          developers to upload and execute 'eap' applications on the device. The system does not validate
          the application comes from a trusted source, so a malicious attacker can upload and execute
          arbitrary code. The issue has no CVE, although the technique was made public in 2018.

          This module uploads and executes stageless meterpreter as `root`. Uploading the application
          requires valid credentials. The default administrator credentials used to be `root:root` but
          newer firmware versions force users to provide a new password for the `root` user.

          The module was tested on an Axis M3044-V using the latest firmware (9.80.3.8: December 2021).
          Although all modules that support the "Apps" feature are presumed to be vulnerable.

Check method (fingerprinting):
# grab the brand/model. Shouldn't require authentication.
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/axis-cgi/prod_brand_info/getbrand.cgi')
    })

    return CheckCode::Unknown('Could not determine the target status') unless res && (res.code == 200)

    body_json = res.get_json_document
    return CheckCode::Unknown('Could not determine the target status') if body_json.empty? || body_json.dig('Brand', 'ProdShortName').nil?

    # The brand / model are now known
    check_comment = "The target reports itself to be a '#{body_json.dig('Brand', 'ProdShortName')}'."

    # check to see if the applications api exists (also tests credentials)
    res = send_request_cgi({
      'method' => 'GET',
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'uri' => normalize_uri(target_uri.path, '/axis-cgi/applications/list.cgi')
    })

    # A strange edge case where there is no response... respond detected
    return CheckCode::Detected('The target service was detected') unless res
    # Respond safe if credentials fail, to prevent the exploit from running
    return CheckCode::Safe('The user provided credentials did not work.') if res.code == 401
    # Assume any non-200 means the API doesn't exist
    return CheckCode::Safe(check_comment) if res.code != 200

    # This checks for an XML response which I'm not sure is smart considering most of the device
    # does JSON replies... the con
Metasploit Module: TrueOnline / Billion 5200W-T Router Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/trueonline_billion_5200w_rce.rb
Platform: unix
Disclosure date: 2016-12-26
References: CVE-2017-18369, CVE-2017-18372, URL-https://seclists.org/fulldisclosure/2017/Jan/40, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/zyxel_trueonline.txt, URL-https://blogs.securiteam.com/index.php/archives/2910

Description:
TrueOnline is a major ISP in Thailand, and it distributes a customized version of
          the Billion 5200W-T router. This customized version has at least two command injection
          vulnerabilities, one authenticated and one unauthenticated, on different firmware versions.
          This module will attempt to exploit the unauthenticated injection first, and if that fails,
          it will attempt to exploit the authenticated injection.
          This module was tested in an emulated environment, as the author doesn't have access to the
          Thai router any more. Any feedback should be sent directly to the module's author, as well as
          to the Metasploit project.
          There are other language strings in the firmware, so it is likely that this firmware is not
          only distributed in Thailand. Other Billion 5200W-T in other countries might be vulnerable too.
Metasploit Module: VMware vCenter Server Virtual SAN Health Check Plugin RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_vcenter_vsan_health_rce.rb
Platform: unix
Disclosure date: 2021-05-25
References: CVE-2021-21985, URL-https://www.vmware.com/security/advisories/VMSA-2021-0010.html, URL-https://attackerkb.com/topics/X85GKjaVER/cve-2021-21985#rapid7-analysis, URL-http://noahblog.360.cn/vcenter-cve-2021-2021-21985/, URL-https://www.iswin.org/2021/06/02/Vcenter-Server-CVE-2021-21985-RCE-PAYLOAD/, URL-https://testbnull.medium.com/a-quick-look-at-cve-2021-21985-vcenter-pre-auth-rce-9ecd459150a5, URL-https://y4y.space/2021/06/04/learning-jndi-injection-from-cve-2021-21985/, URL-https://github.com/alt3kx/CVE-2021-21985_PoC
Targets: Unix Command, Linux Dropper

Description:
This module exploits Java unsafe reflection and SSRF in the VMware
          vCenter Server Virtual SAN Health Check plugin's ProxygenController
          class to execute code as the vsphere-ui user.

          See the vendor advisory for affected and patched versions. Tested
          against VMware vCenter Server 6.7 Update 3m (Linux appliance).

Check method (fingerprinting):
# https://docs.oracle.com/javase/tutorial/essential/environment/sysprop.html
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(
        target_uri.path,
        '/ui/h5-vsan/rest/proxy/service/systemProperties/getProperty'
      ),
      'ctype' => 'application/json',
      'data' => {
        'methodInput' => ['user.name', nil]
      }.to_json
    )

    return CheckCode::Unknown('Could not determine the target status') unless res

    unless res.code == 200 && res.get_json_document['result'] == 'vsphere-ui'
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Vulnerable('System property user.name is vsphere-ui.')
  end
Metasploit Module: Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb
Platform: linux
Disclosure date: 2019-07-29
References: CVE-2019-15949, URL-https://github.com/jakgibb/nagiosxi-root-rce-exploit
Targets: Linux (x86), Linux (x64), Linux (cmd)

Description:
This module exploits a vulnerability in the getprofile.sh script
          of Nagios XI prior to 5.6.6 in order to upload a malicious check_ping
          plugin and thereby execute arbitrary commands.

          For Nagios XI 5.2.0-5.4.13, the commands are run as the nagios user.
          For versions 5.5.0-5.6.5 the commands are run as root. Note that versions
          prior to 5.2.0 will still be marked as being vulnerable however this
          module does not presently support exploiting these targets.

          The module uploads a malicious check_ping plugin to the Nagios XI server via
          /admin/monitoringplugins.php and then executes this plugin by issuing
          a HTTP GET request to download a system profile from the server.
          For all supported targets except Linux (cmd), the module uses a command
          stager to write the exploit to the target via the malicious plugin.
          This may not work if Nagios XI is running in a restricted Unix environment,
          so in that case the target must be set to Linux (cmd). The module then
          writes the payload to the malicious plugin while avoiding commands
          that may not be supported.

          Valid credentials for a user with administrative privileges are
          required. This module was successfully tested on Nagios XI 5.3.0 and
          Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before
          5.5.0, it may take a significant amount of time for the payload to get
          back (up to 5 minutes). If exploitation fails against an older system,
          it is recommended to increase the WfsDelay setting (default is 300
          seconds). See the documentation for more information.

Check method (fingerprinting):
# Use nagios_xi_login to try and authenticate. If authentication succeeds, nagios_xi_login returns
    # an array containing the http response body of a get request to index.php and the session cookies
    auth_result, err_msg, @auth_cookies, @version = authenticate(username, password, finish_install)

    case auth_result
    when AUTH_RESULTS[:connection_failed]
      return CheckCode::Unknown(err_msg)
    when AUTH_RESULTS[:unexpected_error], AUTH_RESULTS[:not_fully_installed], AUTH_RESULTS[:failed_to_handle_license_agreement], AUTH_RESULTS[:failed_to_extract_tokens], AUTH_RESULTS[:unable_to_obtain_version]
      return CheckCode::Detected(err_msg)
    when AUTH_RESULTS[:not_nagios_application]
      return CheckCode::Safe(err_msg)
    end

    if @version < Rex::Version.new('5.6.6')
      return CheckCode::Appears("Version #{@version} appears to be vulnerable")
    end

    return CheckCode::Safe("Version #{@version} is not vulnerable")
  end