deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Netdata ndsudo privilege escalation
Type: exploit
Path: modules/exploits/linux/local/ndsudo_cve_2024_32019.rb
Disclosure date: 2024-04-12
References: CVE-2024-32019

Description:
The `ndsudo` is a tool shipped with Netdata Agent. The version v1.45.0 and below contain vulnerability, which allows an attacker to gain privilege escalation using `ndsudo` binary. The vulnerability is untrusted search path, when searching for additional binary files, such as `nvme`. An attacker can create malicious binary with same name and add the directory of this binary into `$PATH` variable. The `ndsudo` will trust the first occurence of this binary and execute it.

Check method (fingerprinting):
# could not find reasonable way to get version
    return CheckCode::Safe('Vulnerable binary not detected, check NdsudoPath option') unless file?(datastore['NdsudoPath']) && executable?(datastore['NdsudoPath'])
    return CheckCode::Unknown('Failed to run vulnerable binary, either binary is not ndsudo or user does not have right to execute ndsudo') unless cmd_exec(datastore['NdsudoPath']) == 'at least 2 parameters are needed, but 1 were given.'

    CheckCode::Appears('Vulnerable binary detected')
  end
Metasploit Module: Netfilter x_tables Heap OOB Write Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/netfilter_xtables_heap_oob_write_priv_esc.rb
Platform: linux
Disclosure date: 2021-07-07
References: CVE-2021-22555, URL-http://web.archive.org/web/[PII_REDACTED]5131/https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html, URL-https://nvd.nist.gov/vuln/detail/CVE-2021-22555, URL-https://ubuntu.com/security/CVE-2021-22555

Description:
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c.
          This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
          Kernels up to 5.11 (including) are vulnerable.
          More information about vulnerable kernels is
          available at https://nvd.nist.gov/vuln/detail/CVE-2021-22555#vulnConfigurationsArea

Check method (fingerprinting):
unless kernel_modules.include? 'ip_tables'
      vprint_warning('The ip_tables module is not loaded.')
      return CheckCode::Safe('The ip_tables module is not loaded.')
    end

    return CheckCode::Safe('LKRG is installed.') if lkrg_installed?
    return CheckCode::Safe('grsecurity is in use') if grsec_installed?

    release = kernel_release
    version = "#{release} #{kernel_version.split(' ').first}"
    ubuntu_offsets = strip_comments(get_external_source_code('CVE-2021-22555', 'exploit.c')).scan(/kernels\[\] = \{(.+?)\};/m).flatten.first
    ubuntu_kernels = ubuntu_offsets.scan(/"(.+?)"/).flatten
    if ubuntu_kernels.empty?
      fail_with(Msf::Module::Failure::BadConfig, 'Error parsing the list of supported kernels.')
    end
    return CheckCode::Safe("Ubuntu kernel #{version} is not vulnerable.") if !ubuntu_kernels.include? version

    # Setting the MSGMNI to a lower value is an easy remedy for this exploit on vulnerable kernels.
    # Currently, the exploit uses #define NUM_MSQIDS 4096, which is the minimum allowed message queue length.
    minimum_msgmni = 4096
    msgmni_path = '/proc/sys/kernel/msgmni'
    return CheckCode::Safe("#{msgmni_path} is not readable.") if !readable?(msgmni_path)

    msgmni = read_file(msgmni_path).to_i
    if msgmni >= minimum_msgmni
      return CheckCode::Appears("Target is running kernel release #{release}.")
    else
      return CheckCode::Safe("The kernel's MSGMNI queue size of #{msgmni} is too small for the exploit to execu
Metasploit Module: Linux udev Netlink Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/udev_netlink.rb
Disclosure date: 2009-04-16
References: CVE-2009-1185, OSVDB-53810, BID-34536
Targets: Linux x86, Linux x64, Command payload

Description:
Versions of udev < 1.4.1 do not verify that netlink messages are
            coming from the kernel. This allows local users to gain privileges by
            sending netlink messages from userland.
Metasploit Module: Sudo Chroot 1.9.17 Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/sudo_chroot_cve_2025_32463.rb
Disclosure date: 2025-06-30
References: EDB-52352, URL-https://www.helpnetsecurity.com/2025/07/01/sudo-local-privilege-escalation-vulnerabilities-fixed-cve-2025-32462-cve-2025-32463/, CVE-2025-32463

Description:
Sudo before version 1.19.17p1 allows user to use `chroot` option, when
          executing command. The option is intended to run a command with
          user-selected root directory (if sudoers file allow it). Change in version
          1.9.14 allows resolving paths via `chroot` using user-specified root
          directory when sudoers is still evaluating.
          This allows the attacker to trick Sudo into loading arbitrary shared object,
          thus resulting in a privilege escalation.

Check method (fingerprinting):
sudo_version = installed_package_version('sudo') || get_version

    return CheckCode::Unknown('Could not identify the version of sudo.') if sudo_version.blank?

    return CheckCode::Safe('/etc/nsswitch.conf not found') if !file?('/etc/nsswitch.conf')

    return CheckCode::Appears("Running version #{sudo_version}") if Rex::Version.new(sudo_version).between?(Rex::Version.new('1.9.14'), Rex::Version.new('1.9.17'))

    CheckCode::Safe("Sudo #{sudo_version} is not vulnerable")
  end
Metasploit Module: io_uring Same Type Object Reuse Priv Esc
Type: exploit
Path: modules/exploits/linux/local/cve_2022_1043_io_uring_priv_esc.rb
Disclosure date: 2022-03-22
References: URL-https://grsecurity.net/exploiting_and_defending_against_same_type_object_reuse, URL-https://github.com/opensrcsec/same_type_object_reuse_exploits, URL-https://github.com/torvalds/linux/commit/a30f895ad3239f45012e860d4f94c1a388b36d14, CVE-2022-1043

Description:
This module exploits a bug in io_uring leading to an additional put_cred()
          that can be exploited to hijack credentials of other processes.

          We spawn SUID programs to get the free'd cred object reallocated by a
          privileged process and abuse them to create a SUID root binary ourselves
          that'll pop a shell.

          The dangling cred pointer will, however, lead to a kernel panic as soon as
          the task terminates and its credentials are destroyed. We therefore detach
          from the controlling terminal, block all signals and rest in silence until
          the system shuts down and we get killed hard, just to cry in vain, seeing
          the kernel collapse.

          The bug affected kernels from v5.12-rc3 to v5.14-rc7.

          More than 1 CPU is required for exploitation.

          Successfully tested against Ubuntu 22.04.01 with kernel 5.13.12-051312-generic

Check method (fingerprinting):
# Check the kernel version to see if its in a vulnerable range
    release = kernel_release
    if Rex::Version.new(release.split('-').first) > Rex::Version.new('5.14-rc7') ||
       Rex::Version.new(release.split('-').first) < Rex::Version.new('5.12-rc3')
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe("Kernel version #{release} is not vulnerable")
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    # make sure we have enough CPUs. Minimum 2 required
    cpu = get_cpu_info
    if cpu[:cores] < 2
      CheckCode::Safe("> 1 CPU required, detected: #{cpu[:cores]}")
    end
    CheckCode::Vulnerable("> 1 CPU required, detected: #{cpu[:cores]}")
  end
Metasploit Module: Network Manager VPNC Username Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/network_manager_vpnc_username_priv_esc.rb
Platform: linux
Disclosure date: 2018-07-26
References: CVE-2018-10900, URL-https://seclists.org/oss-sec/2018/q3/51, URL-https://pulsesecurity.co.nz/advisories/NM-VPNC-Privesc, URL-https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/commit/07ac18a32b4, URL-https://security-tracker.debian.org/tracker/CVE-2018-10900, URL-https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-10900.html, URL-https://launchpad.net/ubuntu/+source/network-manager-vpnc/0.9.8.6-1ubuntu2.1, URL-https://www.debian.org/security/2018/dsa-4253, URL-https://bugzilla.redhat.com/show_bug.cgi?id=1605919, URL-https://bugzilla.novell.com/show_bug.cgi?id=1101147

Description:
This module exploits an injection vulnerability in the Network Manager
          VPNC plugin to gain root privileges.

          This module uses a new line injection vulnerability in the configured
          username for a VPN network connection to inject a `Password helper`
          configuration directive into the connection configuration.

          The specified helper is executed by Network Manager as root when the
          connection is started.

          Network Manager VPNC versions prior to 1.2.6 are vulnerable.

          This module has been tested successfully with VPNC versions:
          1.2.4-4 on Debian 9.0.0 (x64); and
          1.1.93-1 on Ubuntu Linux 16.04.4 (x64).

Check method (fingerprinting):
unless command_exists? 'nmcli'
      vprint_error 'Network Manager nmcli utility is not installed'
      return CheckCode::Safe('Network Manager nmcli utility is not installed')
    end
    vprint_good 'nmcli utility is installed'

    CheckCode::Detected('Network Manager nmcli utility is installed')
  end
Metasploit Module: VMWare Setuid vmware-mount Unsafe popen(3)
Type: exploit
Path: modules/exploits/linux/local/vmware_mount.rb
Disclosure date: 2013-08-22
References: CVE-2013-1662, OSVDB-96588, BID-61966, URL-http://blog.cmpxchg8b.com/2013/08/security-debianisms.html, URL-http://web.archive.org/web/[PII_REDACTED]0036/http://www.vmware.com:80/support/support-resources/advisories/VMSA-2013-0010.html, URL-https://www.rapid7.com/blog/post/2013/09/05/cve-2013-1662-vmware-mount-exploit

Description:
VMWare Workstation (up to and including 9.0.2 build-1031769)
            and Player have a setuid executable called vmware-mount that
            invokes lsb_release in the PATH with popen(3). Since PATH is
            user-controlled, and the default system shell on
            Debian-derived distributions does not drop privs, we can put
            an arbitrary payload in an executable called lsb_release and
            have vmware-mount happily execute it as root for us.

Check method (fingerprinting):
return CheckCode::Safe("#{vmware_mount} file not found") unless file? vmware_mount
    return CheckCode::Safe("#{vmware_mount} is not setuid") unless setuid? vmware_mount

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: ZPanel zsudo Local Privilege Escalation Exploit
Type: exploit
Path: modules/exploits/linux/local/zpanel_zsudo.rb
Platform: %w[linux unix
Disclosure date: 2013-06-07
References: CVE-2013-10052
Targets: Command payload, Linux x86

Description:
This module abuses the zsudo binary, installed with zpanel, to escalate
            privileges. In order to work, a session with access to zsudo on the sudoers
            configuration is needed. This module is useful for post exploitation of ZPanel
            vulnerabilities, where typically web server privileges are acquired, and this
            user is allowed to execute zsudo on the sudoers file.

Check method (fingerprinting):
if file?(datastore['zsudo'])
      return CheckCode::Detected('zsudo binary found')
    end

    return CheckCode::Safe('zsudo binary not found')
  end
Metasploit Module: Apache Tomcat on Ubuntu Log Init Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/tomcat_ubuntu_log_init_priv_esc.rb
Disclosure date: 2016-09-30
References: EDB-40450, URL-https://ubuntu.com/security/notices/USN-3081-1, URL-http://legalhackers.com/advisories/Tomcat-DebPkgs-Root-Privilege-Escalation-Exploit-CVE-2016-1240.html, CVE-2016-1240

Description:
Tomcat (6, 7, 8) packages provided by default repositories on Debian-based
          distributions (including Debian, Ubuntu etc.) provide a vulnerable
          tomcat init script that allows local attackers who have already gained access
          to the tomcat account (for example, by exploiting an RCE vulnerability
          in a java web application hosted on Tomcat, uploading a webshell etc.) to
          escalate their privileges from tomcat user to root and fully compromise the
          target system.

          Tested against Tomcat 8.0.32-1ubuntu1.1 on Ubuntu 16.04

Check method (fingerprinting):
package = cmd_exec('dpkg -l tomcat[6-8] | grep \'^i\'')
    if package.nil? || package.empty? || package.include?('not found') # catch dpkg command not found
      return CheckCode::Safe('Unable to execute command to determine installed pacakges')
    end

    package = package.gsub('\s+', ' ') # replace whitespace with space so we can split easy
    package = package.split(' ')
    # 0 is ii for installed
    # 1 is tomcat# for package name
    # 2 is version number
    begin
      package = Rex::Version.new(package[2])
    rescue ArgumentError => e
      return CheckCode::Safe("Error processing Tomcat version (#{package[2]}) into known format: #{e}")
    end

    if (package.to_s.start_with?('8') && package < Rex::Version.new('8.0.32-1ubuntu1.2')) ||
       (package.to_s.start_with?('7') && package < Rex::Version.new('7.0.52-1ubuntu0.7')) ||
       (package.to_s.start_with?('6') && package < Rex::Version.new('6.0.35-1ubuntu3.8'))
      return CheckCode::Appears("Vulnerable app version detected: #{package}")
    end

    CheckCode::Safe("Unexploitable tomcat packages found: #{package}")
  end
Metasploit Module: Sudo Heap-Based Buffer Overflow
Type: exploit
Path: modules/exploits/linux/local/sudo_baron_samedit.rb
Platform: unix
Disclosure date: 2021-01-26
References: URL-https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit, URL-https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt, URL-https://www.kalmarunionen.dk/writeups/sudo/, URL-https://github.com/blasty/CVE-2021-3156/blob/main/hax.c, CVE-2021-3156

Description:
A heap based buffer overflow exists in the sudo command line utility that can be exploited by a local attacker
          to gain elevated privileges. The vulnerability was introduced in July of 2011 and affects version 1.8.2
          through 1.8.31p2 as well as 1.9.0 through 1.9.5p1 in their default configurations. The technique used by this
          implementation leverages the overflow to overwrite a service_user struct in memory to reference an attacker
          controlled library which results in it being loaded with the elevated privileges held by sudo.

Check method (fingerprinting):
sudo_version = get_versions[:sudo]
    return CheckCode::Unknown('Could not identify the version of sudo.') if sudo_version.nil?

    # fixup the p number used by sudo to be compatible with Rex::Version
    sudo_version.gsub!(/p/, '.')

    vuln_builds = [
      [Rex::Version.new('1.8.2'), Rex::Version.new('1.8.31.2')],
      [Rex::Version.new('1.9.0'), Rex::Version.new('1.9.5.1')],
    ]

    if sudo_version == '1.8.31'
      # Ubuntu patched it as version 1.8.31-1ubuntu1.2 which is reported as 1.8.31
      return CheckCode::Detected("sudo #{sudo_version} may be a vulnerable build.")
    end

    if vuln_builds.any? { |build_range| Rex::Version.new(sudo_version).between?(*build_range) }
      return CheckCode::Appears("sudo #{sudo_version} is a vulnerable build.")
    end

    CheckCode::Safe("sudo #{sudo_version} is not a vulnerable build.")
  end
Metasploit Module: VMware Workspace ONE Access CVE-2022-31660
Type: exploit
Path: modules/exploits/linux/local/vmware_workspace_one_access_certproxy_lpe.rb
Disclosure date: 2022-08-02
References: CVE-2022-31660, URL-https://www.vmware.com/security/advisories/VMSA-2022-0021.html

Description:
VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges
            to those of the root user by modifying a file and then restarting the vmware-certproxy service which
            invokes it. The service control is permitted via the sudo configuration without a password.

Check method (fingerprinting):
unless whoami == 'horizon'
      return CheckCode::Safe('Not running as the horizon user.')
    end

    token = Rex::Text.rand_text_alpha(10)
    unless sudo("--list '#{certproxy_service}' && echo #{token}").include?(token)
      return CheckCode::Safe('Cannot invoke the service control script with sudo.')
    end

    unless writable?(TARGET_FILE)
      return CheckCode::Safe('Cannot write to the service file.')
    end

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Ubuntu Enlightenment Mount Priv Esc
Type: exploit
Path: modules/exploits/linux/local/ubuntu_enlightenment_mount_priv_esc.rb
Disclosure date: 2022-09-13
References: URL-https://github.com/MaherAzzouzi/CVE-2022-37706-LPE-exploit, URL-https://twitter.com/maherazz2/status/[PII_REDACTED]07734023, CVE-2022-37706

Description:
This module exploits a command injection within Enlightenment's
          enlightenment_sys binary. This is done by calling the mount
          command and feeding it paths which meet all of the system
          requirements, but execute a specific path as well due to a
          semi-colon being used.
          This module was tested on Ubuntu 22.04.1 X64 Desktop with
          enlightenment 0.25.3-1 (current at module write time)

Check method (fingerprinting):
enlightenment_sys = find_enlightenment_sys
    return CheckCode::Safe('An exploitable enlightenment_sys was not found on the system') if enlightenment_sys.nil?

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Unitrends Enterprise Backup bpserverd Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ueb_bpserverd_privesc.rb
Platform: linux
Disclosure date: 2018-03-14
References: URL-https://support.unitrends.com/UnitrendsBackup/s/article/000005691, URL-http://blog.redactedsec.net/exploits/2018/04/20/UEB9_tcp.html, EDB-44297, CVE-2018-6329

Description:
It was discovered that the Unitrends bpserverd proprietary protocol, as exposed via xinetd,
            has an issue in which its authentication can be bypassed.  A remote attacker could use this
            issue to execute arbitrary commands with root privilege on the target system.
            This is very similar to exploits/linux/misc/ueb9_bpserverd however it runs against the
            localhost by dropping a python script on the local file system.  Unitrends stopped
            bpserverd from listening remotely on version 10.
Metasploit Module: Progress Flowmon Local sudo privilege escalation
Type: exploit
Path: modules/exploits/linux/local/progress_flowmon_sudo_privesc_2024.rb
Platform: unix
Disclosure date: 2024-03-19
References: CVE-2024-2389, URL-https://rhinosecuritylabs.com/research/cve-2024-2389-in-progress-flowmon/, URL-https://support.kemptechnologies.com/hc/en-us/articles/[PII_REDACTED]8733-CVE-2024-2389-Flowmon-critical-security-vulnerability

Description:
This module abuses a feature of the sudo command on Progress Flowmon.
          Certain binary files are allowed to automatically elevate
          with the sudo command.  This is based off of the file name.  This
          includes executing a PHP command with a specific file name. If the
          file is overwritten with PHP code it can be used to elevate privileges
          to root. Progress Flowmon up to at least version 12.3.5 is vulnerable.

Check method (fingerprinting):
score = 0
    score += 1 if read_file('/var/www/shtml/index.php')&.include?('FlowMon')
    score += 1 if read_file('/var/www/shtml/ui/manifest.json')&.include?('Flowmon Web Interface')
    score += 1 if exists?('/var/www/shtml/translate.php')
    vprint_status("Found #{score} indicators this is a Progress Flowmon product")
    return CheckCode::Detected('Target appears to be a Progress Flowmon product') if score > 0

    return CheckCode::Safe('Target does not appear to be a Progress Flowmon product')
  end
Metasploit Module: glibc 'realpath()' Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/glibc_realpath_priv_esc.rb
Disclosure date: 2018-01-16
References: BID-102525, CVE-2[PII_REDACTED], EDB-43775, URL-https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/, URL-http://www.openwall.com/lists/oss-security/2018/01/11/5, URL-https://securitytracker.com/id/1040162, URL-https://sourceware.org/bugzilla/show_bug.cgi?id=22679, URL-https://usn.ubuntu.com/3534-1/, URL-https://bugzilla.redhat.com/show_bug.cgi?id=1533836

Description:
This module attempts to gain root privileges on Linux systems by abusing
          a vulnerability in GNU C Library (glibc) version 2.26 and prior.

          This module uses halfdog's RationalLove exploit to exploit a buffer
          underflow in glibc realpath() and create a SUID root shell. The exploit
          has offsets for glibc versions 2.23-0ubuntu9 and 2.24-11+deb9u1.

          The target system must have unprivileged user namespaces enabled.

          This module has been tested successfully on Ubuntu Linux 16.04.3 (x86_64)
          with glibc version 2.23-0ubuntu9; and Debian 9.0 (x86_64) with glibc
          version 2.24-11+deb9u1.

Check method (fingerprinting):
kernel_ver = kernel_release
    if Rex::Version.new(kernel_ver.split('-').first) < Rex::Version.new('2.6.36')
      vprint_error "Linux kernel version #{kernel_ver} is not vulnerable"
      return CheckCode::Safe("Kernel version #{kernel_ver} is not vulnerable")
    end
    vprint_good "Linux kernel version #{kernel_ver} is vulnerable"

    arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    vprint_good "System architecture #{arch} is supported"

    glibc_ver = glibc_version
    if Rex::Version.new(glibc_ver.split('-').first) > Rex::Version.new('2.26')
      vprint_error "GNU C Library version #{glibc_ver} is not vulnerable"
      return CheckCode::Safe("GNU C Library version #{glibc_ver} is not vulnerable")
    end
    vprint_good "GNU C Library version #{glibc_ver} is vulnerable"

    # fuzzy match glibc 2.23-0ubuntu9 and 2.24-11+deb9u1
    glibc_banner = cmd_exec('ldd --version')
    unless glibc_banner.include?('2.23-0ubuntu') || glibc_banner.include?('2.24-11+deb9')
      vprint_error 'No offsets for this version of GNU C Library'
      return CheckCode::Safe('No offsets available for this GNU C Library version')
    end

    config = kernel_config
    if config.nil?
      vprint_error 'Could not retrieve kernel config'
      return CheckCode::Unknown('Could not retrieve kernel config')
    end

    unless config