deardaniel/secdata-raw huggingface dataset:
Metasploit Module: WMI Event Subscription Interval Persistence
Type: exploit
Path: modules/exploits/windows/persistence/wmi/wmi_event_subscription_interval.rb
Platform: win
Disclosure date: 2017-06-06
References: URL-https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf, URL-https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/

Description:
This module will create a permanent WMI event subscription to achieve file-less persistence using an event filter
          that triggers the payload after the specified CALLBACK_INTERVAL.

          If the persistence is not installed, it will keep triggering payloads to spawn.

          Additionally a custom command can be specified to run once the trigger is
          activated using the advanced option CustomPsCommand. This module requires administrator level privileges as well as a
          high integrity process. It is also recommended to use staged payloads due to powershell script length limitations.

Check method (fingerprinting):
return CheckCode::Safe('This module requires powershell to run') unless have_powershell?

    return CheckCode::Safe('This module requires admin privs to run') unless is_admin?

    return CheckCode::Safe('This module cannot run as System') if is_system?

    return CheckCode::Safe('This module requires UAC to be bypassed first') unless is_high_integrity?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: WMI Event Subscription Event Log Persistence
Type: exploit
Path: modules/exploits/windows/persistence/wmi/wmi_event_subscription_event_log.rb
Platform: win
Disclosure date: 2017-06-06
References: URL-https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf, URL-https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/

Description:
This module will create a permanent WMI event subscription to achieve file-less persistence using an event filter
          that will query the event log for an EVENT_ID_TRIGGER
          (default: failed logon request id 4625) that also contains a specified USERNAME_TRIGGER (note: failed logon auditing
          must be enabled on the target for this method to work, this can be enabled using "auditpol.exe /set /subcategory:Logon
          /failure:Enable"). When these criteria are met a command line event consumer will trigger an encoded powershell payload.

          Additionally a custom command can be specified to run once the trigger is
          activated using the advanced option CustomPsCommand. This module requires administrator level privileges as well as a
          high integrity process. It is also recommended to use staged payloads due to powershell script length limitations.

Check method (fingerprinting):
return CheckCode::Safe('This module requires powershell to run') unless have_powershell?

    return CheckCode::Safe('This module requires admin privs to run') unless is_admin?

    return CheckCode::Safe('This module cannot run as System') if is_system?

    return CheckCode::Safe('This module requires UAC to be bypassed first') unless is_high_integrity?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: WMI Event Subscription Process Persistence
Type: exploit
Path: modules/exploits/windows/persistence/wmi/wmi_event_subscription_process.rb
Platform: win
Disclosure date: 2017-06-06
References: URL-https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf, URL-https://learn-powershell.net/2013/08/14/powershell-and-events-permanent-wmi-event-subscriptions/

Description:
This module will create a permanent WMI event subscription to achieve file-less persistence using an event filter
          that triggers the payload when the specified process is started.

          Additionally a custom command can be specified to run once the trigger is
          activated using the advanced option CustomPsCommand. This module requires administrator level privileges as well as a
          high integrity process. It is also recommended to use staged payloads due to powershell script length limitations.

          Many built-in apps on Windows 10/11 launch via a modern UWP app (Win32Bridge.Server.exe or ApplicationFrameHost.exe),
          not the legacy binary (like calc.exe). If you pick one of these apps, like calc.exe, it can still be triggered
          from command line, however GUI execution will not work.

          Duplicate CLASSNAMEs will not overwrite, so if the env isn't cleaned up before
          re-exploitation, the exploitation will fail.

          Tested and works being launched from GUI (windows 10):
          chrome.exe (several shells at once)
          calc.exe (only from command line calc.exe or calc)
          msedge.exe (several shells at once)
          cmd.exe

Check method (fingerprinting):
return CheckCode::Safe('This module requires powershell to run') unless have_powershell?

    return CheckCode::Safe('This module requires admin privs to run') unless is_admin?

    return CheckCode::Safe('This module cannot run as System') if is_system?

    return CheckCode::Safe('This module requires UAC to be bypassed first') unless is_high_integrity?

    CheckCode::Appears('Likely exploitable')
  end
Metasploit Module: Windows WSL via Registry Persistence
Type: exploit
Path: modules/exploits/windows/persistence/wsl/registry.rb
Disclosure date: 2022-01-29
References: URL-https://medium.themayor.tech/windows-persistence-using-wsl2-8f87e319ea56, URL-https://lolapps-project.github.io/lolapps/Desktop/wsl/

Description:
This module will install a payload in WSL and execute it at user
          logon or system startup via the registry value in "CurrentVersion\Run"
          or "RunOnce" (depending on privilege and selected method).
          The payload will be installed completely in registry.

          Staged payloads, like fetch payloads in linux X64 don't tend to work. The payload
          will ask for the stage, then submit the HTTP fetch request
          and when the payload is sent it doesn't execute.

          `cmd/linux/http/x64/meterpreter_reverse_tcp` and unix cmd payloads tend to work.

Check method (fingerprinting):
# /tmp seems to persist on *some* Ubuntu WSL (wsl v1 it did, v2 it didnt)
    print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if datastore['WritableDir'].start_with?('/tmp')
    return Msf::Exploit::CheckCode::Safe('System does not have powershell') unless registry_enumkeys('HKLM\\SOFTWARE\\Microsoft').include?('PowerShell')

    vprint_good('Powershell detected on system')

    # test write to see if we have access
    root_path = get_root_path
    rand = Rex::Text.rand_text_alphanumeric(15)

    vprint_status("Checking registry write access to: #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}\\#{rand}")
    return Msf::Exploit::CheckCode::Safe("Unable to write to registry path #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}") if registry_createkey("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{rand}").nil?

    registry_deletekey("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\#{regkey}\\#{rand}")

    return Msf::Exploit::CheckCode::Safe('WSL Not installed') unless wsl_enabled?

    Msf::Exploit::CheckCode::Vulnerable('Registry writable and WSL installed')
  end
Metasploit Module: Lotus Notes 8.0.x - 8.5.2 FP2 - Autonomy Keyview (.lzh Attachment)
Type: exploit
Path: modules/exploits/windows/lotus/lotusnotes_lzh.rb
Platform: win
Disclosure date: 2011-05-24
References: CVE-2011-1213, OSVDB-72706, BID-48018, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=904, URL-http://www.ibm.com/support/docview.wss?uid=swg21500034

Description:
This module exploits a stack buffer overflow in Lotus Notes 8.5.2 when
          parsing a malformed, specially crafted LZH file. This vulnerability was
          discovered binaryhouse.net
Metasploit Module: IBM Lotus Domino Sametime STMux.exe Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lotus/domino_sametime_stmux.rb
Platform: win
Disclosure date: 2008-05-21
References: CVE-2008-2499, OSVDB-45610, BID-29328, ZDI-08-028

Description:
This module exploits a stack buffer overflow in Lotus Domino\'s Sametime
          Server. By sending an overly long POST request to the Multiplexer
          STMux.exe service we are able to overwrite SEH. Based on the exploit
          by Manuel Santamarina Suarez.

Check method (fingerprinting):
connect

    req = "HEAD / HTTP/1.1\r\n"
    req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
    req << "User-Agent: Sametime Community Agent\r\n\r\n"

    sock.put(req)
    res = sock.get_once || ''

    disconnect

    if (res.to_s =~ /Lotus-Domino/)
      connect

      req = "GET /CommunityCBR HTTP/1.1\r\n"
      req << "Host: #{datastore['RHOST']}:#{datastore['RPORT']}\r\n"
      req << "User-Agent: Sametime Community Agent\r\n\r\n"
      sock.put(req)
      res = sock.get_once || ''

      disconnect

      if (res.to_s =~ /200 OK/)
        return Exploit::CheckCode::Detected('Lotus Domino Sametime stmux service detected')
      end
    end

    return Exploit::CheckCode::Safe('Lotus Domino Sametime stmux service not detected')
  end
Metasploit Module: IBM Lotus Domino Web Server Accept-Language Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lotus/domino_http_accept_language.rb
Platform: win
Disclosure date: 2008-05-20
References: CVE-2008-2240, OSVDB-45415, BID-29310, URL-http://www-01.ibm.com/support/docview.wss?uid=swg21303057

Description:
This module exploits a stack buffer overflow in IBM Lotus Domino Web Server
          prior to version 7.0.3FP1 and 8.0.1. This flaw is triggered by any HTTP
          request with an Accept-Language header greater than 114 bytes.
Metasploit Module: IBM Lotus Domino iCalendar MAILTO Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lotus/domino_icalendar_organizer.rb
Platform: win
Disclosure date: 2010-09-14
References: CVE-2010-3407, OSVDB-68040, ZDI-10-177, URL-http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/, URL-http://www-01.ibm.com/support/docview.wss?rs=475&uid=swg21446515

Description:
This module exploits a vulnerability found in IBM Lotus Domino iCalendar.  By
          sending a long string of data as the "ORGANIZER;mailto" header, process "nRouter.exe"
          crashes due to a Cstrcpy() routine in nnotes.dll, which allows remote attackers to
          gain arbitrary code execution.

          Note: In order to trigger the vulnerable code path, a valid Domino mailbox account
          is needed.

Check method (fingerprinting):
connect
    banner = (sock.get_once(-1, 5) || '').chomp
    disconnect

    if banner =~ /Lotus Domino Release 8\.5/
      return Exploit::CheckCode::Appears('Lotus Domino Release 8.5 detected')
    else
      return Exploit::CheckCode::Safe('Lotus Domino Release 8.5 not detected')
    end
  end
Metasploit Module: IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution
Type: exploit
Path: modules/exploits/windows/ibm/ibm_was_dmgr_java_deserialization_rce.rb
Platform: win
Disclosure date: 2019-05-15
References: CVE-2019-4279, URL-https://www-01.ibm.com/support/docview.wss?uid=ibm10883628
Targets: Windows Binary, CMD

Description:
This module exploits untrusted serialized data processed by the WAS DMGR Server and Cells.
          NOTE: There is a required 2 minute timeout between attempts as the neighbor being added must be reset.
Metasploit Module: Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
Type: exploit
Path: modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
Platform: win
Disclosure date: 2012-07-27
References: CVE-2012-3951, OSVDB-84317, URL-http://web.archive.org/web/[PII_REDACTED]4651/http://secunia.com/advisories/50074/, URL-https://www.trustwave.com/spiderlabs/advisories/TWSL2012-014.txt

Description:
This exploits an insecure config found in Scrutinizer NetFlow & sFlow Analyzer.
          By default, the software installs a default password in MySQL, and binds the
          service to "0.0.0.0".  This allows any remote user to login to MySQL, and then
          gain arbitrary remote code execution under the context of 'SYSTEM'.  Examples
          of default credentials include: 'scrutinizer:admin', and 'scrutremote:admin'.

Check method (fingerprinting):
tmp_rport = datastore['RPORT']
    datastore['RPORT'] = datastore['HTTPPORT']
    res = send_request_raw({ 'uri' => '/' }) # Check the base path for regex
    datastore['RPORT'] = tmp_rport
    if res and res.body =~ /\<title\>Scrutinizer\<\/title\>/ and
       res.body =~ /\<div id\=\'.+\'\>Scrutinizer 9\.[0-5]\.[0-2]\<\/div\>/
      return Exploit::CheckCode::Appears('Vulnerable Scrutinizer version detected')
    end

    return Exploit::CheckCode::Safe('Vulnerable Scrutinizer version not detected')
  end
Metasploit Module: MySQL yaSSL SSL Hello Message Buffer Overflow
Type: exploit
Path: modules/exploits/windows/mysql/mysql_yassl_hello.rb
Platform: win
Disclosure date: 2008-01-04
References: CVE-2008-0226, OSVDB-41195, BID-27140

Description:
This module exploits a stack buffer overflow in the yaSSL (1.7.5 and earlier)
          implementation bundled with MySQL <= 6.0. By sending a specially crafted
          Hello packet, an attacker may be able to execute arbitrary code.
Metasploit Module: Oracle MySQL for Microsoft Windows FILE Privilege Abuse
Type: exploit
Path: modules/exploits/windows/mysql/mysql_start_up.rb
Platform: win
Disclosure date: 2012-12-01
References: CVE-2012-5613, OSVDB-88118, EDB-23083, URL-https://seclists.org/fulldisclosure/2012/Dec/13

Description:
This module takes advantage of a file privilege misconfiguration problem
          specifically against Windows MySQL servers. This module abuses the FILE
          privilege to write a payload to Microsoft's All Users Start Up directory
          which will execute every time a user logs in. The default All Users Start
          Up directory used by the module is present on Windows 7.

Check method (fingerprinting):
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
    return Exploit::CheckCode::Safe('MySQL login failed') unless m

    return Exploit::CheckCode::Appears('Target is running MySQL on Windows') if is_windows?

    Exploit::CheckCode::Safe('Target is not running Windows')
  end
Metasploit Module: Oracle MySQL for Microsoft Windows MOF Execution
Type: exploit
Path: modules/exploits/windows/mysql/mysql_mof.rb
Platform: win
Disclosure date: 2012-12-01
References: CVE-2012-5613, OSVDB-88118, EDB-23083, URL-https://seclists.org/fulldisclosure/2012/Dec/13

Description:
This module takes advantage of a file privilege misconfiguration problem
          specifically against Windows MySQL servers (due to the use of a .mof file).
          This may result in arbitrary code execution under the context of SYSTEM.
          This module requires a valid MySQL account on the target machine.

Check method (fingerprinting):
m = mysql_login(datastore['USERNAME'], datastore['PASSWORD'])
    return Exploit::CheckCode::Safe('MySQL login failed') if not m

    return Exploit::CheckCode::Appears('Target is running MySQL on Windows') if is_windows?

    return Exploit::CheckCode::Safe('Target is not running Windows')
  end
Metasploit Module: FlexNet License Server Manager lmgrd Buffer Overflow
Type: exploit
Path: modules/exploits/windows/license/flexnet_lmgrd_bof.rb
Platform: win
Disclosure date: 2012-03-23
References: CVE-2011-4135, OSVDB-81899, BID-52718, ZDI-12-052, URL-http://aluigi.altervista.org/adv/lmgrd_1-adv.txt, URL-http://www.flexerasoftware.com/pl/13057.htm

Description:
This module exploits a vulnerability in the FlexNet
          License Server Manager.

          The vulnerability is due to the insecure usage of memcpy
          in the lmgrd service when handling network packets, which
          results in a stack buffer overflow.

          In order to improve reliability, this module will make lots of
          connections to lmgrd during each attempt to maximize its success.
Metasploit Module: SentinelLM UDP Buffer Overflow
Type: exploit
Path: modules/exploits/windows/license/sentinel_lm7_udp.rb
Platform: win
Disclosure date: 2005-03-07
References: CVE-2005-0353, OSVDB-14605, BID-12742

Description:
This module exploits a simple stack buffer overflow in the Sentinel
          License Manager. The SentinelLM service is installed with a
          wide selection of products and seems particular popular with
          academic products. If the wrong target value is selected,
          the service will crash and not restart.

Check method (fingerprinting):
connect_udp
    udp_sock.put("\x7a\x00\x00\x00\x00\x00")
    res = udp_sock.recvfrom(8192)
    disconnect_udp

    if (res and res[0] == 0x7a)
      return Exploit::CheckCode::Detected('Sentinel License Manager detected')
    end

    return Exploit::CheckCode::Safe('Sentinel License Manager not detected')
  end
Metasploit Module: Computer Associates License Client GETCONFIG Overflow
Type: exploit
Path: modules/exploits/windows/license/calicclnt_getconfig.rb
Platform: win
Disclosure date: 2005-03-02
References: CVE-2005-0581, OSVDB-14389, BID-12705, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=213

Description:
This module exploits a vulnerability in the CA License Client
          service. This exploit will only work if your IP address can be
          resolved from the target system point of view. This can be
          accomplished on a local network by running the 'nmbd' service
          that comes with Samba. If you are running this exploit from
          Windows and do not filter udp port 137, this should not be a
          problem (if the target is on the same network segment). Due to
          the bugginess of the software, you are only allowed one connection
          to the agent port before it starts ignoring you. If it wasn't for this
          issue, it would be possible to repeatedly exploit this bug.

Check method (fingerprinting):
# It is possible to check, but due to a software bug, checking prevents exploitation
  # end
Metasploit Module: Computer Associates License Server GETCONFIG Overflow
Type: exploit
Path: modules/exploits/windows/license/calicserv_getconfig.rb
Platform: win
Disclosure date: 2005-03-02
References: CVE-2005-0581, OSVDB-14389, BID-12705, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=213

Description:
This module exploits an vulnerability in the CA License Server
          network service. By sending an excessively long GETCONFIG
          packet the stack may be overwritten.

Check method (fingerprinting):
connect
    banner = sock.get_once
    sock.put("A0 GETCONFIG SELF 0<EOM>")
    res = sock.get_once || ''
    disconnect
    if (res =~ /OS\<([^\>]+)/)
      vprint_status("CA License Server reports OS: #{$1}")
      return Exploit::CheckCode::Detected("CA License Server detected, OS: #{$1}")
    end
    return Exploit::CheckCode::Safe('CA License Server not detected')
  end
Metasploit Module: Blue Coat WinProxy Host Header Overflow
Type: exploit
Path: modules/exploits/windows/proxy/bluecoat_winproxy_host.rb
Platform: win
Disclosure date: 2005-01-05
Authors: MC
References: CVE-2005-4085, OSVDB-22238, BID-16147, URL-http://www.bluecoat.com/support/knowledge/advisory_host_header_stack_overflow.html

Description:
This module exploits a buffer overflow in the Blue Coat Systems WinProxy
          service by sending a long port value for the Host header in a HTTP
          request.
Metasploit Module: Qbik WinGate WWW Proxy Server URL Processing Overflow
Type: exploit
Path: modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
Platform: win
Disclosure date: 2006-06-07
Authors: aushack
References: CVE-2006-2926, OSVDB-26214, BID-18312

Description:
This module exploits a stack buffer overflow in Qbik WinGate version
          6.1.1.1077 and earlier. By sending malformed HTTP POST URL to the
          HTTP proxy service on port 80, a remote attacker could overflow
          a buffer and execute arbitrary code.

Check method (fingerprinting):
connect
    sock.put("GET /\r\n\r\n") # Malformed request to get proxy info
    banner = sock.get_once || ''
    if (banner =~ /Server:\sWinGate\s6.1.1\s\(Build 1077\)/)
      return Exploit::CheckCode::Appears('WinGate 6.1.1 Build 1077 detected')
    end

    return Exploit::CheckCode::Safe('WinGate 6.1.1 not detected')
  end
Metasploit Module: Proxy-Pro Professional GateKeeper 4.7 GET Request Overflow
Type: exploit
Path: modules/exploits/windows/proxy/proxypro_http_get.rb
Platform: win
Disclosure date: 2004-02-23
Authors: MC
References: CVE-2004-0326, OSVDB-4027, BID-9716

Description:
This module exploits a stack buffer overflow in Proxy-Pro Professional
          GateKeeper 4.7. By sending a long HTTP GET to the default port
          of 3128, a remote attacker could overflow a buffer and execute
          arbitrary code.
Metasploit Module: CCProxy Telnet Proxy Ping Overflow
Type: exploit
Path: modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
Platform: win
Disclosure date: 2004-11-11
References: CVE-2004-2416, OSVDB-11593, BID-11666, EDB-621

Description:
This module exploits the YoungZSoft CCProxy <= v6.2 suite
          Telnet service. The stack is overwritten when sending an overly
          long address to the 'ping' command.

Check method (fingerprinting):
connect
    banner = sock.get_once || ''
    disconnect

    if banner.to_s =~ /CCProxy Telnet Service Ready/
      return Exploit::CheckCode::Detected('CCProxy Telnet Service detected')
    end

    return Exploit::CheckCode::Safe('CCProxy Telnet Service not detected')
  end
Metasploit Module: Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57
Type: exploit
Path: modules/exploits/windows/scada/sunway_force_control_netdbsrv.rb
Platform: win
Disclosure date: 2011-09-22
References: CVE-2011-10032, OSVDB-75798, BID-49747, URL-http://aluigi.altervista.org/adv/forcecontrol_1-adv.txt

Description:
This module exploits a stack based buffer overflow found in the SNMP
          NetDBServer service of Sunway Forcecontrol <= 6.1 sp3. The overflow is
          triggered when sending an overly long string to the listening service
          on port 2001.
Metasploit Module: 7-Technologies IGSS 9 IGSSdataServer .RMS Rename Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/igss9_igssdataserver_rename.rb
Platform: win
Disclosure date: 2011-03-24
References: CVE-2011-1567, OSVDB-72352, URL-http://aluigi.altervista.org/adv/igss_5-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-132-01A

Description:
This module exploits a vulnerability found on 7-Technologies IGSS 9. By supplying
          a long string of data to the 'Rename' (0x02), 'Delete' (0x03), or 'Add' (0x04) command,
          a buffer overflow condition occurs in IGSSdataServer.exe while handing an RMS report,
          which results arbitrary code execution under the context of the user.

          The attack is carried out in three stages.  The first stage sends the final payload to
          IGSSdataServer.exe, which will remain in memory.  The second stage sends the Add command
          so the process can find a valid ID for the Rename command.  The last stage then triggers
          the vulnerability with the Rename command, and uses an egghunter to search for the
          shellcode that we sent in stage 1.  The use of egghunter appears to be necessary due to
          the small buffer size, which cannot even contain our ROP chain and the final payload.