deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Xorg X11 Server SUID modulepath Privilege Escalation
Type: exploit
Path: modules/exploits/multi/local/xorg_x11_suid_server_modulepath.rb
Platform: linux
Disclosure date: 2018-10-25
References: CVE-2018-14665, BID-105741, EDB-45697, EDB-45742, EDB-45832, URL-https://www.securepatterns.com/2018/10/cve-2018-14665-another-way-of.html
Targets: Linux x64, Linux x86, Solaris x86, Solaris x64

Description:
This module attempts to gain root privileges with SUID Xorg X11 server
          versions 1.19.0 < 1.20.3.

          A permission check flaw exists for -modulepath and -logfile options when
          starting Xorg.  This allows unprivileged users that can start the server
          the ability to elevate privileges and run arbitrary code under root
          privileges.

          This module has been tested with CentOS 7 (1708).
          CentOS default install will require console auth for the users session.
          Xorg must have SUID permissions and may not start if running.

          On successful exploitation artifacts will be created consistant
          with starting Xorg.

Check method (fingerprinting):
# linux checks
    uname = cmd_exec('uname')
    if uname =~ /linux/i
      vprint_status 'Running additional check for Linux'
      if datastore['ConsoleLock']
        user = cmd_exec('id -un')
        unless exist?("/var/run/console/#{user}")
          vprint_error("No console lock for #{user}")
          return CheckCode::Safe("No console lock for #{user}")
        end
        vprint_good("Console lock for #{user}")
      end
    end

    # suid program check
    xorg_path = cmd_exec('command -v Xorg')
    unless xorg_path.include?('Xorg')
      return CheckCode::Safe('Could not find Xorg executable')
    end

    vprint_good("Xorg path found at #{xorg_path}")

    unless setuid? xorg_path
      return CheckCode::Safe("Xorg binary #{xorg_path} is not SUID")
    end

    vprint_good("Xorg binary #{xorg_path} is SUID")

    x_version = cmd_exec 'Xorg -version'
    if x_version.include?('Release Date')
      v = Rex::Version.new(x_version.scan(/\d\.\d+\.\d+/).first)
      unless v.between?(Rex::Version.new('1.19.0'), Rex::Version.new('1.20.2'))
        return CheckCode::Safe("Xorg version #{v} not supported")
      end
    elsif x_version.include?('Fatal server error')
      vprint_error 'User probably does not have console auth'
      vprint_error 'Below is Xorg -version output'
      vprint_error x_version
      return CheckCode::Safe('User does not have console auth')
    else
      vprint_warning('Could not parse Xorg -version output')
      return CheckCode::Appears('Cou
Metasploit Module: Vagrant Synced Folder Vagrantfile Breakout
Type: exploit
Path: modules/exploits/multi/local/vagrant_synced_folder_vagrantfile_breakout.rb
Platform: ruby
Disclosure date: 2011-01-19
References: URL-https://www.vagrantup.com/docs/synced-folders, URL-https://www.virtualbox.org/manual/ch04.html#sharedfolders
Targets: Ruby Code, Unix Command

Description:
This module exploits a default Vagrant synced folder (shared folder)
          to append a Ruby payload to the Vagrant project Vagrantfile config file.

          By default, unless a Vagrant project explicitly disables shared folders,
          Vagrant mounts the project directory on the host as a writable 'vagrant'
          directory on the guest virtual machine. This directory includes the
          project Vagrantfile configuration file.

          Ruby code within the Vagrantfile is loaded and executed when a user
          runs any vagrant command from the project directory on the host,
          leading to execution of Ruby code on the host.

Check method (fingerprinting):
return CheckCode::Safe('Vagrantfile not found.') unless vagrantfile

    # `writable?' method does not support Windows systems
    begin
      return CheckCode::Detected("#{vagrantfile} is not writable.") unless writable?(vagrantfile)
    rescue RuntimeError
      return CheckCode::Detected("Could not verify if #{vagrantfile} is writable.")
    end

    CheckCode::Appears("#{vagrantfile} is writable!")
  end
Metasploit Module: ElasticSearch Dynamic Script Arbitrary Java Execution
Type: exploit
Path: modules/exploits/multi/elasticsearch/script_mvel_rce.rb
Platform: java
Disclosure date: 2013-12-09
References: CVE-2014-3120, OSVDB-106949, EDB-33370, URL-http://bouk.co/blog/elasticsearch-rce/, URL-https://www.found.no/foundation/elasticsearch-security/#staying-safe-while-developing-with-elasticsearch

Description:
This module exploits a remote command execution (RCE) vulnerability in ElasticSearch,
          exploitable by default on ElasticSearch prior to 1.2.0. The bug is found in the
          REST API, which does not require authentication, where the search
          function allows dynamic scripts execution. It can be used for remote attackers
          to execute arbitrary Java code. This module has been tested successfully on
          ElasticSearch 1.1.1 on Ubuntu Server 12.04 and Windows XP SP3.

Check method (fingerprinting):
result = Exploit::CheckCode::Safe('Elasticsearch does not appear to be vulnerable')

    if vulnerable?
      result = Exploit::CheckCode::Vulnerable('Arbitrary Java execution confirmed via MVEL scripting')
    end

    result
  end
Metasploit Module: ElasticSearch Search Groovy Sandbox Bypass
Type: exploit
Path: modules/exploits/multi/elasticsearch/search_groovy_script.rb
Platform: java
Disclosure date: 2015-02-11
References: CVE-2015-1427, URL-https://jordan-wright.github.io/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/, URL-https://github.com/XiphosResearch/exploits/tree/master/ElasticSearch, URL-http://drops.wooyun.org/papers/5107

Description:
This module exploits a remote command execution (RCE) vulnerability in ElasticSearch,
          exploitable by default on ElasticSearch prior to 1.4.3. The bug is found in the
          REST API, which does not require authentication, where the search function allows
          groovy code execution and its sandbox can be bypassed using java.lang.Math.class.forName
          to reference arbitrary classes. It can be used to execute arbitrary Java code. This
          module has been tested successfully on ElasticSearch 1.4.2 on Ubuntu Server 12.04.

Check method (fingerprinting):
result = Exploit::CheckCode::Safe('Elasticsearch does not appear to be vulnerable')

    if vulnerable?
      result = Exploit::CheckCode::Vulnerable('Arbitrary Java execution confirmed via Groovy scripting')
    end

    result
  end
Metasploit Module: Cron Persistence
Type: exploit
Path: modules/exploits/multi/persistence/cron.rb
Platform: unix
Disclosure date: 1979-07-01

Description:
This module will create a cron or crontab entry to execute a payload.
          The module includes the ability to automatically clean up those entries to prevent multiple executions.
          syslog will get a copy of the cron entry.
          Verified on Ubuntu 22.04.1, MacOS 13.7.4

Check method (fingerprinting):
# https://gist.github.com/istvanp/310203 for cron regex validator
    cron_regex = '(\*|[0-5]?[0-9]|\*\/[0-9]+)\s+'
    cron_regex << '(\*|1?[0-9]|2[0-3]|\*\/[0-9]+)\s+'
    cron_regex << '(\*|[1-2]?[0-9]|3[0-1]|\*\/[0-9]+)\s+'
    cron_regex << '(\*|[0-9]|1[0-2]|\*\/[0-9]+|jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s+'
    cron_regex << '(\*\/[0-9]+|\*|[0-7]|sun|mon|tue|wed|thu|fri|sat)' # \s*
    # cron_regex << '(\*\/[0-9]+|\*|[0-9]+)?'

    return CheckCode::Unknown('Invalid timing format') unless datastore['TIMING'] =~ /#{cron_regex}/

    return CheckCode::Safe("#{target.opts[:path]} doesn't exist") unless exists?(target.opts[:path])
    # it may not be directly writable, but we can use crontab to write it for us
    if !writable?(target.opts[:path]) && !command_exists?('crontab')
      return CheckCode::Safe("Can't write to: #{target.opts[:path]} or crontab not found")
    end

    if target.name == 'User Crontab' && !user_cron_permission?(target_user)
      return CheckCode::Unknown('User denied cron via cron.deny')
    end

    CheckCode::Appears('Cron timing is valid, no cron.deny entries found')
  end
Metasploit Module: Obsidian Plugin Persistence
Type: exploit
Path: modules/exploits/multi/persistence/obsidian_plugin.rb
Platform: unix
Disclosure date: 2022-09-16
References: URL-https://docs.obsidian.md/Plugins/Getting+started/Build+a+plugin, URL-https://github.com/obsidianmd/obsidian-sample-plugin/tree/master, URL-https://forum.obsidian.md/t/can-obsidian-plugins-have-malware/34491, URL-https://help.obsidian.md/Extending+Obsidian/Plugin+security, URL-https://thomas-byrne.co.uk/research/obsidian-malicious-plugins/obsidian-research/

Description:
This module searches for Obsidian vaults for a user, and uploads a malicious
          community plugin to the vault. The vaults must be opened with community
          plugins enabled (NOT restricted mode), but the plugin will be enabled
          automatically.

          Tested against Obsidian 1.7.7 on Kali, Ubuntu 22.04, and Windows 10.

Check method (fingerprinting):
return CheckCode::Appears('Vaults found') unless find_vaults.empty?

    CheckCode::Safe('No vaults found')
  end
Metasploit Module: Python Site-Specific Hook Persistence
Type: exploit
Path: modules/exploits/multi/persistence/python_site_specific_hook.rb
Platform: linux
Disclosure date: 2012-09-29
References: URL-https://docs.python.org/3/library/site.html

Description:
This module leverages Python's startup mechanism, where some files can be automically processed during the initialization of the Python interpreter. One of those files are startup hooks (site-specific, dist-packages). If these files are present in site-specific or dist-packages directories, any lines beginning with import will be executed automatically. This creates a persistence mechanism, if an attacker has established access to target machine with sufficient permissions.

Check method (fingerprinting):
get_python_version

    return CheckCode::Safe('Python not present on the system') unless @python_version

    CheckCode::Vulnerable('Python is present on the system')
  end
Metasploit Module: Burp Extension Persistence
Type: exploit
Path: modules/exploits/multi/persistence/burp_extension.rb
Platform: java
Disclosure date: 2025-01-01
References: URL-https://portswigger.net/burp/documentation/desktop/extensions/creating, URL-https://portswigger.net/burp/documentation/desktop/troubleshooting/launch-from-command-line
Targets: Java, Linux, Windows

Description:
This module adds a java based malicious extension to the Burp Suite configuration file.
          When burp is opened, the extension will be loaded and the payload will be executed.

          Tested against Burp Suite Community Edition v2024.9.4, on Ubuntu Desktop 24.04.
          Tested against Burp Suite Community Edition v2025.12.3 on Windows 10.

Check method (fingerprinting):
if action.name == 'build'
      if File.exist?(datastore['GRADLE'])
        vprint_good('Gradle found')
      else
        print_warning('Gradle is required on the local computer running metasploit, please install it or use precompiled action')
      end
    end

    @userconfig_path = get_userconfig_path
    CheckCode::Safe("Config file not found: #{datastore['config']}") if @userconfig_path.nil?
    CheckCode::Detected("Found UserConfig file #{@userconfig_path}")
  end
Metasploit Module: at(1) Persistence
Type: exploit
Path: modules/exploits/multi/persistence/at.rb
Platform: %w[unix linux osx
Disclosure date: 1997-01-01
References: URL-https://linux.die.net/man/1/at, URL-https://www.geeksforgeeks.org/at-command-in-linux-with-examples/

Description:
This module executes a metasploit payload utilizing at(1) to execute jobs at a specific time.  It should work out of the box
          with any UNIX-like operating system with atd running.
          Verified on Kali linux and OSX 13.7.4

Check method (fingerprinting):
return CheckCode::Safe("#{datastore['WritableDir']} does not exist") unless exists? datastore['WritableDir']
    return CheckCode::Safe("#{datastore['WritableDir']} not writable") unless writable? datastore['WritableDir']

    return CheckCode::Safe('at(1) not found on system') unless command_exists? 'at'

    # we do a direct test with atq instead of reading at.allow and at.deny
    token = Rex::Text.rand_text_alphanumeric(8)
    if cmd_exec("atq && echo #{token}").include?(token)
      return CheckCode::Vulnerable('at(1) confirmed to be usable as a persistence mechanism')
    end

    CheckCode::Safe('at(1) not usable as a persistence mechanism likely due to explicit permissions in at.allow or at.deny')
  end
Metasploit Module: Periodic Script Persistence
Type: exploit
Path: modules/exploits/multi/persistence/periodic_script.rb
Platform: osx
Disclosure date: 2012-04-01
References: URL-https://taomm.org/vol1/pdfs/CH%202%20Persistence.pdf, URL-https://superuser.com/questions/391204/what-is-the-difference-between-periodic-and-cron-on-os-x/
Targets: OSX, Python, Unix, Bsd

Description:
This module will achieve persistence by writing a script to the /etc/periodic directory.
          According to The Art of Mac Malware no such malware species persist in this manner (2024).
          This payload requires root privileges to run. This module can be run on BSD, OSX or Arch Linux.

Check method (fingerprinting):
periodic = "/etc/periodic/#{datastore['PERIODIC_DIR']}/"

    return CheckCode::Vulnerable("#{periodic} is writable") if writable? periodic

    CheckCode::Safe("Unable to write to #{periodic}")
  end
Metasploit Module: SSH Key Persistence
Type: exploit
Path: modules/exploits/multi/persistence/ssh_key.rb
Platform: %w[linux unix win
Disclosure date: 1995-07-01
References: URL-https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement, URL-https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui&pivots=windows-10, URL-https://stackoverflow.com/a/50502015

Description:
This module will add an SSH key to a specified user (or all), to allow
          remote login via SSH at any time. No payload is required for this module to work.

          If an SSH key is not provided, a new 4096 bit RSA keypair will be generated.
          The private key will be stored as loot for later use.

Check method (fingerprinting):
return CheckCode::Safe('sshd_config file not found') unless file?(sshd_config_file)

    enabled = pubkey_enabled?
    if enabled.nil?
      print_warning('Unable to determine if PubkeyAuthentication is enabled due to permission issues')
    elsif enabled == false
      return CheckCode::Safe("PubkeyAuthentication disabled in sshd_config and can't be enabled")
    end

    CheckCode::Appears('Likely vulnerable')
  end
Metasploit Module: Oracle MySQL UDF Payload Execution
Type: exploit
Path: modules/exploits/multi/mysql/mysql_udf_payload.rb
Platform: win
Disclosure date: 2009-01-16
References: URL-http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html

Description:
This module creates and enables a custom UDF (user defined function) on the
          target host via the SELECT ... into DUMPFILE method of binary injection. On
          default Microsoft Windows installations of MySQL (=< 5.5.9), directory write
          permissions not enforced, and the MySQL service runs as LocalSystem.

          NOTE: This module will leave a payload executable on the target system when the
          attack is finished, as well as the UDF DLL, and will define or redefine sys_eval()
          and sys_exec() functions.
Metasploit Module: Inductive Automation Ignition Remote Code Execution
Type: exploit
Path: modules/exploits/multi/scada/inductive_ignition_rce.rb
Platform: win
Disclosure date: 2020-06-11
References: URL-https://www.zerodayinitiative.com/blog/2020/6/10/a-trio-of-bugs-used-to-exploit-inductive-automation-at-pwn2own-miami, URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Miami_2020/rce_me_v2/rce_me_v2.md, URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Miami2020/rce_me_v2.md, CVE-2020-10644, CVE-2020-12004, ZDI-20-685, ZDI-20-686
Targets: Linux

Description:
This module exploits a Java deserialization vulnerability in the Inductive Automation Ignition SCADA product,
          versions 8.0.0 to (and including) 8.0.7.
          This exploit was tested on versions 8.0.0 and 8.0.7 on both Linux and Windows.
          The default configuration is exploitable by an unauthenticated attacker, which can achieve
          remote code execution as SYSTEM on a Windows installation and root on Linux.
          The vulnerability was discovered and exploited at Pwn2Own Miami 2020 by the Flashback team (Pedro Ribeiro +
          Radek Domanski).

Check method (fingerprinting):
version = Rex::Version.new(version_get)
    if version.segments.length < 3
      fail_with(Failure::Unknown, 'Failed to obtain target version')
    end
    print_status("#{peer} - Detected version #{version}")
    if version >= Rex::Version.new('8.0.0') && version <= Rex::Version.new('8.0.7')
      return Exploit::CheckCode::Appears("Inductive Automation Ignition version #{version} appears vulnerable")
    else
      return Exploit::CheckCode::Safe("Inductive Automation Ignition version #{version} is not vulnerable")
    end
  end
Metasploit Module: Script Web Delivery
Type: exploit
Path: modules/exploits/multi/script/web_delivery.rb
Platform: python
Disclosure date: 2013-07-19
Authors: bcoles
References: URL-https://securitypadawan.blogspot.com/2014/02/php-meterpreter-web-delivery.html, URL-https://www.pentestgeek.com/2013/07/19/invoke-shellcode/, URL-http://www.powershellmagazine.com/2013/04/19/pstip-powershell-command-line-switches-shortcuts/, URL-https://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html, URL-http://web.archive.org/web/[PII_REDACTED]2440/http://subt0x10.blogspot.com:80/2017/04/bypass-application-whitelisting-script.html, URL-https://enigma0x3.net/2017/08/03/wsh-injection-a-case-study/, URL-https://iwantmore.pizza/posts/amsi.html, URL-https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/, URL-https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/, URL-https://lolbas-project.github.io/lolbas/Scripts/Pubprn/
Targets: Python, PHP, PSH, Regsvr32, pubprn, SyncAppvPublishingServer, PSH (Binary), Linux, Mac OS X

Description:
This module quickly fires up a web server that serves a payload.

          The module will provide a command to be run on the target machine
          based on the selected target. The provided command will download
          and execute a payload using either a specified scripting language
          interpreter or "squiblydoo" via regsvr32.exe for bypassing
          application whitelisting.

          The main purpose of this module is to quickly establish a session on a
          target machine when the attacker has to manually type in the command:
          e.g. Command Injection, RDP Session, Local Access or maybe Remote
          Command Execution.

          This attack vector does not write to disk so it is less likely to
          trigger AV solutions and will allow privilege escalations supplied
          by Meterpreter.

          When using either of the PSH targets, ensure the payload architecture
          matches the target computer or use SYSWOW64 powershell.exe to execute
          x86 payloads on x64 machines.

          Regsvr32 uses "squiblydoo" technique to bypass application whitelisting.
          The signed Microsoft binary file, Regsvr32, is able to request an .sct
          file and then execute the included PowerShell command inside of it.

          Similarly, the pubprn target uses the pubprn.vbs script to request and
          execute a .sct file.

          Both web requests (i.e., the .sct file and PowerShell download/execute)
          can occur on the same port.

          The SyncAppvPublishingServer target uses SyncAppvPublishingServer.exe
          Microsoft signed binary to request and execute a PowerShell script. This
          technique only works on Windows 10 builds <= 1709.

          "PSH (Binary)" will write a file to the disk, allowing for custom binaries
          to be served up to be downloaded and executed.
Metasploit Module: Samba 2.2.2 - 2.2.6 nttrans Buffer Overflow
Type: exploit
Path: modules/exploits/multi/samba/nttrans.rb
Platform: linux
Disclosure date: 2003-04-07
References: CVE-2002-1318, OSVDB-14525, BID-6210, URL-http://www.samba.org/samba/history/samba-2.2.7a.html

Description:
This module attempts to exploit a buffer overflow vulnerability present in
          versions 2.2.2 through 2.2.6 of Samba.

          The Samba developers report this as:
          "Bug in the length checking for encrypted password change requests from clients."

          The bug was discovered and reported by the Debian Samba Maintainers.
Metasploit Module: Samba "username map script" Command Execution
Type: exploit
Path: modules/exploits/multi/samba/usermap_script.rb
Platform: unix
Disclosure date: 2007-05-14
References: CVE-2007-2447, OSVDB-34700, BID-23972, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=534, URL-http://samba.org/samba/security/CVE-2007-2447.html

Description:
This module exploits a command execution vulnerability in Samba
          versions 3.0.20 through 3.0.25rc3 when using the non-default
          "username map script" configuration option. By specifying a username
          containing shell meta characters, attackers can execute arbitrary
          commands.

          No authentication is needed to exploit this vulnerability since
          this option is used to map usernames prior to authentication!
Metasploit Module: RealServer Describe Buffer Overflow
Type: exploit
Path: modules/exploits/multi/realserver/describe.rb
Platform: %w[bsd linux win
Disclosure date: 2002-12-20
Authors: hdm
References: CVE-2002-1643, OSVDB-4468

Description:
This module exploits a buffer overflow in RealServer 7/8/9
          and was based on Johnny Cyberpunk's THCrealbad exploit. This
          code should reliably exploit Linux, BSD, and Windows-based
          servers.

Check method (fingerprinting):
res = send_request_raw(
      {
        'method' => 'OPTIONS',
        'proto' => 'RTSP',
        'version' => '1.0',
        'uri' => '/'
      }, 5
    )

    http_fingerprint({ response: res }) # check method / Custom server check
    if res and res['Server']
      vprint_status("Found RTSP: #{res['Server']}")
      return Exploit::CheckCode::Detected('RealServer RTSP service detected')
    end
    Exploit::CheckCode::Safe('RealServer RTSP service not detected')
  end
Metasploit Module: PostgreSQL COPY FROM PROGRAM Command Execution
Type: exploit
Path: modules/exploits/multi/postgres/postgres_copy_from_program_cmd_exec.rb
Platform: %w[linux unix win osx
Disclosure date: 2019-03-20
References: CVE-2019-9193, URL-https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5, URL-https://www.postgresql.org/docs/9.3/release-9-3.html
Targets: Unix/OSX/Linux, Windows - PowerShell (In-Memory), Windows (CMD)

Description:
Installations running Postgres 9.3 and above have functionality which allows for the superuser
          and users with 'pg_execute_server_program' to pipe to and from an external program using COPY.
          This allows arbitrary command execution as though you have console access.

          This module attempts to create a new table, then execute system commands in the context of
          copying the command output into the table.

          This module should work on all Postgres systems running version 9.3 and above.

          For Linux & OSX systems, target 1 is used with cmd payloads such as: cmd/unix/reverse_perl

          For Windows Systems, target 2 is used with powershell payloads such as: cmd/windows/powershell_reverse_tcp
          Alternativly target 3 can be used to execute generic commands, such as a web_delivery meterpreter powershell payload
          or other customised command.

Check method (fingerprinting):
vuln_version? ? CheckCode::Appears('PostgreSQL version appears vulnerable') : CheckCode::Safe('PostgreSQL version does not appear to be vulnerable')
  end