deardaniel/secdata-raw huggingface dataset:
Metasploit Module: LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator
Type: auxiliary
Path: modules/auxiliary/fileformat/odt_badodt.rb
Disclosure date: May 01 2018
Authors: Richard Davy - secureyourit.co.uk
References: CVE-2018-10583, URL-https://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files/

Description:
Generates a Malicious ODT File which can be used with auxiliary/server/capture/smb or similar to capture hashes.
Metasploit Module: Maldoc in PDF Polyglot converter
Type: auxiliary
Path: modules/auxiliary/fileformat/maldoc_in_pdf_polyglot.rb
Platform: win
References: URL-https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html, URL-https://socradar.io/maldoc-in-pdf-a-novel-method-to-distribute-malicious-macros/, URL-https://www.nospamproxy.de/en/maldoc-in-pdf-danger-from-word-files-hidden-in-pdfs/, URL-https://github.com/exa-offsec/maldoc_in_pdf_polyglot/tree/main/demo

Description:
A malicious MHT file created can be opened in Microsoft Word even though it has magic numbers and file
          structure of PDF.

          If the file has configured macro, by opening it in Microsoft Word, VBS runs and performs malicious behaviors.

          The attack does not bypass configured macro locks. And the malicious macros are also not executed when the
          file is opened in PDF readers or similar software.
Metasploit Module: BADPDF Malicious PDF Creator
Type: auxiliary
Path: modules/auxiliary/fileformat/badpdf.rb
Platform: win
References: CVE-2018-4993, URL-https://research.checkpoint.com/ntlm-credentials-theft-via-pdf-files/

Description:
This module can either creates a blank PDF file which contains a UNC link which can be used
          to capture NetNTLM credentials, or if the PDFINJECT option is used it will inject the necessary
          code into an existing PDF document if possible.
Metasploit Module: IconEnvironmentDataBlock - Windows LNK File Special UNC Path NTLM Leak
Type: auxiliary
Path: modules/auxiliary/fileformat/icon_environment_datablock_leak.rb
Platform: win
Disclosure date: 2025-05-16
References: URL-https://zeifan.my/Right-Click-LNK/

Description:
This module creates a malicious Windows shortcut (LNK) file that
          specifies a special UNC path in IconEnvironmentDataBlock of Shell Link (.LNK)
          that can trigger an authentication attempt to a remote server. This can be used
          to harvest NTLM authentication credentials.

          When a victim browse to the location of the LNK file, it will attempt to
          connect to the the specified UNC path, resulting in an SMB connection that
          can be captured to harvest credentials.
Metasploit Module: Multi Manage YouTube Broadcast
Type: post
Path: modules/post/multi/manage/play_youtube.rb

Description:
This module will broadcast a YouTube video on specified compromised systems. It will play
          the video in the target machine's native browser. The VID datastore option is the "v"
          parameter in a YouTube video's URL.

          Enabling the EMBED option will play the video in full screen mode through a clean interface
          but is not compatible with all videos.

          This module will create a custom profile for Firefox on Linux systems in the /tmp directory.
Metasploit Module: Multiple Linux / Unix Post Sudo Upgrade Shell
Type: post
Path: modules/post/multi/manage/sudo.rb
Platform: %w[aix linux osx solaris unix
References: URL-http://www.sudo.ws/repos/sudo/file/05780f5f71fd/sudo.h

Description:
This module attempts to upgrade a shell account to UID 0 by reusing the
          given password and passing it to sudo. This technique relies on sudo
          versions from 2008 and later which support -A.
Metasploit Module: Browse the session filesystem in a Web Browser
Type: post
Path: modules/post/multi/manage/fileshare.rb

Description:
This module allows you to browse the session filesystem via a local
          browser window.
Metasploit Module: Multi Manage Network Route via Meterpreter Session
Type: post
Path: modules/post/multi/manage/autoroute.rb

Description:
This module manages session routing via an existing
          Meterpreter session. It enables other modules to 'pivot' through a
          compromised host when connecting to the named NETWORK and SUBMASK.
          Autoadd will search a session for valid subnets from the routing table
          and interface list then add routes to them. Default will add a default
          route so that all TCP/IP traffic not specified in the MSF routing table
          will be routed through the session when pivoting. See documentation for more
          'info -d' and click 'Knowledge Base'
Metasploit Module: Multi Manage DbVisualizer Query
Type: post
Path: modules/post/multi/manage/dbvis_query.rb
Platform: %w[linux win
References: URL-http://youtu.be/0LCLRVHX1vA

Description:
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases
          (With GUI). The remote database can be accessed from the command line without the need
          to authenticate, and this module abuses this functionality to query and will store the
          results.

          Please note: backslash quotes and your (stacked or not) queries should
          end with a semicolon.
Metasploit Module: Multi Manage Record Microphone
Type: post
Path: modules/post/multi/manage/record_mic.rb
Platform: %w[linux osx win

Description:
This module will enable and record your target's microphone.
          For non-Windows targets, please use Java meterpreter to be
          able to use this feature.
Metasploit Module: Multi Manage the screen of the target meterpreter session
Type: post
Path: modules/post/multi/manage/screenshare.rb

Description:
This module allows you to view and control the screen of the target computer via
          a local browser window. The module continually screenshots the target screen and
          also relays all mouse and keyboard events to session.
Metasploit Module: Multi Manage File Compressor
Type: post
Path: modules/post/multi/manage/zip.rb

Description:
This module zips a file or a directory. On Linux, it uses the zip command.
          On Windows, it will try to use remote target's 7Zip if found. If not, it falls
          back to its Windows Scripting Host.
Metasploit Module: Shell to Meterpreter Upgrade
Type: post
Path: modules/post/multi/manage/shell_to_meterpreter.rb
Authors: Tom Sellers <tom [at] fadedcode.net>

Description:
This module attempts to upgrade a command shell to meterpreter. The shell
          platform is automatically detected and the best version of meterpreter for
          the target is selected. Currently meterpreter/reverse_tcp is used on Windows
          and Linux, with 'python/meterpreter/reverse_tcp' used on all others.
Metasploit Module: Open a file or URL on the target computer
Type: post
Path: modules/post/multi/manage/open.rb

Description:
This module will open any file or URL specified with the URI format on the
          target computer via the embedded commands such as 'open' or 'xdg-open'.
Metasploit Module: Multi Manage Post Module Macro Execution
Type: post
Path: modules/post/multi/manage/multi_post.rb
Platform: %w[linux osx solaris unix win

Description:
This module will execute a list of modules given in a macro file in the format
          of <module> <opt=val,opt=val> against the select session checking for compatibility
          of the module against the sessions and validation of the options provided.
Metasploit Module: Multi Manage Set Wallpaper
Type: post
Path: modules/post/multi/manage/set_wallpaper.rb

Description:
This module will set the desktop wallpaper background on the specified session.
          The method of setting the wallpaper depends on the platform type.
Metasploit Module: Web browsers HSTS entries eraser
Type: post
Path: modules/post/multi/manage/hsts_eraser.rb
Platform: %w[linux osx unix win
References: URL-http://blog.en.elevenpaths.com/2017/12/breaking-out-hsts-and-hpkp-on-firefox.html, URL-https://www.blackhat.com/docs/eu-17/materials/eu-17-Berta-Breaking-Out-HSTS-And-HPKP-On-Firefox-IE-Edge-And-Possibly-Chrome.pdf

Description:
This module removes the HSTS database of the following tools and web browsers: Mozilla Firefox,
          Google Chrome, Opera, Safari and wget.
Metasploit Module: Multi Manage DbVisualizer Add Db Admin
Type: post
Path: modules/post/multi/manage/dbvis_add_db_admin.rb
Platform: %w[linux win
References: URL-http://youtu.be/0LCLRVHX1vA

Description:
Dbvisulaizer offers a command line functionality to execute SQL pre-configured databases
          (With GUI). The remote database can be accessed from the command line without the need
          to authenticate, which can be abused to create an administrator in the database with the
          proper database permissions. Note: This module currently only supports MySQL.
Metasploit Module: Multi Manage the screensaver of the target computer
Type: post
Path: modules/post/multi/manage/screensaver.rb
References: URL-https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7530

Description:
This module allows you to turn on or off the screensaver of the target computer and also
          lock the current session.
Metasploit Module: Multi Manage System Remote TCP Shell Session
Type: post
Path: modules/post/multi/manage/system_session.rb
Platform: %w[linux osx unix
Authors: Carlos Perez <carlos_perez[at]darkoperator.com>

Description:
This module will create a Reverse TCP Shell on the target system
          using the system's own scripting environments installed on the
          target.
Metasploit Module: Multi Gather Run Shell Command Resource File
Type: post
Path: modules/post/multi/gather/multi_command.rb
Platform: %w[bsd linux osx unix win

Description:
This module will read shell commands from a resource file and
          execute the commands in the specified Meterpreter or shell session.
Metasploit Module: Multi Gather Resolve Hosts
Type: post
Path: modules/post/multi/gather/resolve_hosts.rb
Platform: %w[win python

Description:
Resolves hostnames to either IPv4 or IPv6 addresses from the perspective of the remote host.
Metasploit Module: SaltStack Salt Information Gatherer
Type: post
Path: modules/post/multi/gather/saltstack_salt.rb

Description:
This module gathers information from SaltStack Salt masters and minions.
          Data gathered from minions: 1. salt minion config file
          Data gathered from masters: 1. minion list (denied, pre, rejected, accepted)
          2. minion hostname/ip/os (depending on module settings)
          3. SLS
          4. roster, any SSH keys are retrieved and saved to creds, SSH passwords printed
          5. minion config files
          6. pillar data
Metasploit Module: Multi Gather VirtualBox VM Enumeration
Type: post
Path: modules/post/multi/gather/enum_vbox.rb
Platform: %w[bsd linux osx unix win
Authors: theLightCosine

Description:
This module will attempt to enumerate any VirtualBox VMs on the target machine.
          Due to the nature of VirtualBox, this module can only enumerate VMs registered
          for the current user, therefore, this module needs to be invoked from a user context.
Metasploit Module: Multiplatform WLAN Enumeration and Geolocation
Type: post
Path: modules/post/multi/gather/wlan_geolocate.rb
Platform: %w[android osx win linux bsd solaris

Description:
Enumerate wireless networks visible to the target device.
          Optionally geolocate the target by gathering local wireless networks and
          performing a lookup against Google APIs.
Metasploit Module: Multi Gather Firefox Signon Credential Collection
Type: post
Path: modules/post/multi/gather/firefox_creds.rb
Platform: %w[bsd linux osx unix win

Description:
This module will collect credentials from the Firefox web browser if it is
          installed on the targeted machine. Additionally, cookies are downloaded. Which
          could potentially yield valid web sessions.

          Firefox stores passwords within the signons.sqlite database file. There is also a
          keys3.db file which contains the key for decrypting these passwords. In cases where
          a Master Password has not been set, the passwords can easily be decrypted using
          3rd party tools or by setting the DECRYPT option to true. Using the latter often
          needs root privileges. Also be warned that if your session dies in the middle of the
          file renaming process, this could leave Firefox in a non working state. If a
          Master Password was used the only option would be to bruteforce.

          Useful 3rd party tools:
          + firefox_decrypt (https://github.com/Unode/firefox_decrypt)
          + pswRecovery4Moz (https://github.com/philsmd/pswRecovery4Moz)
Metasploit Module: Chrome Gather Cookies
Type: post
Path: modules/post/multi/gather/chrome_cookies.rb
Platform: %w[linux unix bsd osx windows
Authors: mangopdf <mangodotpdf[at]gmail.com>

Description:
Read all cookies from the Default Chrome profile of the target user.
Metasploit Module: Multi Gather Skype User Data Enumeration
Type: post
Path: modules/post/multi/gather/skype_enum.rb
Platform: %w[osx win

Description:
This module will enumerate Skype account settings, contact list, call history, chat logs,
          file transfer history, and voicemail logs, saving all the data to CSV files for analysis.
Metasploit Module: Multi Gather Run Console Resource File
Type: post
Path: modules/post/multi/gather/run_console_rc_file.rb

Description:
This module will read console commands from a resource file and
          execute the commands in the specified Meterpreter session.
Metasploit Module: Multi Gather DNS Forward Lookup Bruteforce
Type: post
Path: modules/post/multi/gather/dns_bruteforce.rb
Platform: %w[bsd linux osx solaris win

Description:
Brute force subdomains and hostnames via wordlist.
Metasploit Module: Multi Gather Ubiquiti UniFi Controller Backup
Type: post
Path: modules/post/multi/gather/ubiquiti_unifi_backup.rb
References: URL-https://github.com/zhangyoufu/unifi-backup-decrypt/, URL-https://github.com/justingist/POSH-Ubiquiti/blob/master/Posh-UBNT.psm1, URL-https://help.ubnt.com/hc/en-us/articles/205202580-UniFi-system-properties-File-Explanation, URL-https://community.ubnt.com/t5/UniFi-Wireless/unf-controller-backup-file-format/td-p/1624105

Description:
On an Ubiquiti UniFi controller, reads the system.properties configuration file
          and downloads the backup and autobackup files.  The files are then decrypted using
          a known encryption key, then attempted to be repaired by zip.  Meterpreter must be
          used due to the large file sizes, which can be flaky on regular shells to read.
          Confirmed to work on 5.10.19 - 5.10.23, but most likely quite a bit more.
          If the zip can be repaired, the db and its information will be extracted.
Metasploit Module: Gather electerm Passwords
Type: post
Path: modules/post/multi/gather/electerm.rb
Authors: Kali-Team <kali-team[at]qq.com>
References: URL-https://blog.kali-team.cn/metasploit-electerm-6854f3d868eb45eab6951acc463a910d

Description:
This module will determine if electerm is installed on the target system and, if it is, it will try to
          dump all saved session information from the target. The passwords for these saved sessions will then be decrypted
          where possible.
Metasploit Module: Windows Gather Apple iOS MobileSync Backup File Collection
Type: post
Path: modules/post/multi/gather/apple_ios_backup.rb
Platform: %w[osx win

Description:
This module will collect sensitive files from any on-disk iOS device backups
Metasploit Module: Multi Gather RubyGems API Key
Type: post
Path: modules/post/multi/gather/rubygems_api_key.rb
Platform: %w[bsd linux osx unix

Description:
This module obtains a user's RubyGems API key from ~/.gem/credentials.
Metasploit Module: UNIX Gather Cached AD Hashes
Type: post
Path: modules/post/multi/gather/unix_cached_ad_hashes.rb
Platform: %w[linux osx unix solaris aix

Description:
Post Module to obtain all cached AD hashes on the targeted UNIX machine. These can be cracked with John the Ripper (JtR).
Metasploit Module: Multi Gather Malware Verifier
Type: post
Path: modules/post/multi/gather/check_malware.rb

Description:
This module will check a file for malware on VirusTotal based on the checksum.
Metasploit Module: Multiplatform Installed Software Version Enumerator
Type: post
Path: modules/post/multi/gather/enum_software_versions.rb
Platform: %w[win linux osx bsd solaris android

Description:
This module, when run against a compromised machine, will gather details on all installed software,
          including their versions and if available, when they were installed, and will save it into a loot file for later use.
          Users can then use this loot file to determine what additional vulnerabilites may affect the target machine.

          Note that for Linux systems, software enumeration is done via package managers. As a result the results may
          not reflect all of the available software on the system simply because users may have installed additional
          software from alternative sources such as source code that these package managers are not aware of.
Metasploit Module: Multi Gather GnuPG Credentials Collection
Type: post
Path: modules/post/multi/gather/gpg_creds.rb
Platform: %w[bsd linux osx unix

Description:
This module will collect the contents of all users' .gnupg directories on the targeted
          machine. Password protected secret keyrings can be cracked with John the Ripper (JtR).
Metasploit Module: Memory Search
Type: post
Path: modules/post/multi/gather/memory_search.rb
Platform: %w[linux unix osx windows

Description:
This module allows for searching the memory space of running processes for
          potentially sensitive data such as passwords.
Metasploit Module: Gather Dbeaver Passwords
Type: post
Path: modules/post/multi/gather/dbeaver.rb
Authors: Kali-Team <kali-team[at]qq.com>
References: URL-https://blog.kali-team.cn/Metasploit-dbeaver-9f42e26241c94ba785dce5f1e69697aa

Description:
This module will determine if Dbeaver is installed on the target system and, if it is, it will try to
          dump all saved session information from the target. The passwords for these saved sessions will then be decrypted
          where possible.
Metasploit Module: UNIX Gather RSYNC Credentials
Type: post
Path: modules/post/multi/gather/rsyncd_creds.rb

Description:
Post Module to obtain credentials saved for RSYNC in various locations
Metasploit Module: Multi Gather Pidgin Instant Messenger Credential Collection
Type: post
Path: modules/post/multi/gather/pidgin_cred.rb
Platform: %w[bsd linux osx unix win

Description:
This module will collect credentials from the Pidgin IM client if it is installed.
Metasploit Module: Jenkins Credential Collector
Type: post
Path: modules/post/multi/gather/jenkins_gather.rb

Description:
This module can be used to extract saved Jenkins credentials, user
          tokens, SSH keys, and secrets. Interesting files will be stored in
          loot along with combined csv output.
Metasploit Module: UNIX Gather .netrc Credentials
Type: post
Path: modules/post/multi/gather/netrc_creds.rb
Platform: %w[bsd linux osx unix

Description:
Post Module to obtain credentials saved for FTP and other services in .netrc
Metasploit Module: LastPass Vault Decryptor
Type: post
Path: modules/post/multi/gather/lastpass_creds.rb
Platform: %w[linux osx unix win
References: URL-http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it

Description:
This module extracts and decrypts LastPass master login accounts and passwords,
          encryption keys, 2FA tokens and all the vault passwords
Metasploit Module: Multi Gather DNS Reverse Lookup Scan
Type: post
Path: modules/post/multi/gather/dns_reverse_lookup.rb
Platform: %w[bsd linux osx solaris win

Description:
Performs DNS reverse lookup using the OS included DNS query command.
Metasploit Module: Gather MinIO Client Key
Type: post
Path: modules/post/multi/gather/minio_client.rb
Authors: Kali-Team <kali-team[at]qq.com>
References: URL-https://blog.kali-team.cn/Metasploit-MinIO-Client-7d940c60ae8545aeaa29c96536dda855

Description:
This module searches for MinIO Client credentials on a Windows host.
Metasploit Module: UNIX Gather .fetchmailrc Credentials
Type: post
Path: modules/post/multi/gather/fetchmailrc_creds.rb
Platform: %w[bsd linux osx unix

Description:
Post Module to obtain credentials saved for IMAP, POP and other mail
          retrieval protocols in fetchmail's .fetchmailrc
Metasploit Module: Azure CLI Credentials Gatherer
Type: post
Path: modules/post/multi/gather/azure_cli_creds.rb
Platform: win

Description:
This module will collect the Azure CLI 2.0+ (az cli) settings files
          for all users on a given target. These configuration files contain
          JWT tokens used to authenticate users and other subscription information.
          Once tokens are stolen from one host, they can be used to impersonate
          the user from a different host.
Metasploit Module: Gather AWS EC2 Instance Metadata
Type: post
Path: modules/post/multi/gather/aws_ec2_instance_metadata.rb
Platform: %w[unix
References: URL-http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html

Description:
This module will attempt to connect to the AWS EC2 instance metadata service
          and crawl and collect all metadata known about the session'd host.
Metasploit Module: UNIX Gather Kerberos Tickets
Type: post
Path: modules/post/multi/gather/unix_kerberos_tickets.rb
Platform: %w[linux osx unix solaris aix

Description:
Post Module to obtain all kerberos tickets on the targeted UNIX machine.
Metasploit Module: UNIX Gather AWS Keys
Type: post
Path: modules/post/multi/gather/aws_keys.rb
Platform: linux
References: URL-http://s3tools.org/kb/item14.htm, URL-http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-config-files

Description:
This module will attempt to read AWS configuration files
          (.aws/config, .aws//credentials and .s3cfg) for users discovered
          on the session'd system and extract AWS keys from within.
Metasploit Module: Linux Gather HexChat/XChat Enumeration
Type: post
Path: modules/post/multi/gather/enum_hexchat.rb
Platform: linux
Authors: sinn3r
References: URL-https://hexchat.readthedocs.io/en/latest/settings.html

Description:
This module will collect HexChat and XChat's config files and chat logs from the victim's
          machine.  There are three actions you may choose: CONFIGS, CHATS, and ALL.  The
          CONFIGS option can be used to collect information such as channel settings,
          channel/server passwords, etc.  The CHATS option will simply download all the
          .log files.
Metasploit Module: Multi Gather Maven Credentials Collection
Type: post
Path: modules/post/multi/gather/maven_creds.rb
Platform: %w[bsd linux osx unix win
Authors: elenoir

Description:
This module will collect the contents of all users settings.xml on the targeted
          machine.
Metasploit Module: Gather Tomcat Credentials
Type: post
Path: modules/post/multi/gather/tomcat_gather.rb

Description:
This module will attempt to collect credentials from Tomcat services running on the machine.
Metasploit Module: Multi Gather Generic Operating System Environment Settings
Type: post
Path: modules/post/multi/gather/env.rb
Platform: %w[linux win unix

Description:
This module prints out the operating system environment variables.
Metasploit Module: Multi Gather VMWare VM Identification
Type: post
Path: modules/post/multi/gather/find_vmx.rb
Platform: %w[bsd linux osx unix win
Authors: theLightCosine

Description:
This module will attempt to find any VMWare virtual machines stored on the target.
Metasploit Module: Multi Gather pgpass Credentials
Type: post
Path: modules/post/multi/gather/pgpass_creds.rb
Platform: %w[linux bsd unix osx win
Authors: Zach Grace <zgrace[at]403labs.com>

Description:
This module will collect the contents of all users' .pgpass or pgpass.conf
          file and parse them for credentials.
Metasploit Module: Multi Gather FileZilla FTP Client Credential Collection
Type: post
Path: modules/post/multi/gather/filezilla_client_cred.rb
Platform: %w[bsd linux osx unix win

Description:
This module will collect credentials from the FileZilla FTP client if it is installed.