deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Gather AutoLogin User Credential Extractor
Type: post
Path: modules/post/windows/gather/credentials/windows_autologin.rb
References: URL-http://support.microsoft.com/kb/315231, URL-http://core.yehg.net/lab/#tools.exploits

Description:
This module extracts the plain-text Windows user login password in Registry.
          It exploits a Windows feature that Windows (2000 to 2008 R2) allows a
          user or third-party Windows Utility tools to configure User AutoLogin via
          plain-text password insertion in (Alt)DefaultPassword field in the registry
          location - HKLM\Software\Microsoft\Windows NT\WinLogon. This is readable
          by all users.
Metasploit Module: Windows Single Sign On Credential Collector (Mimikatz)
Type: post
Path: modules/post/windows/gather/credentials/sso.rb
Platform: win
Authors: Ben Campbell

Description:
This module will collect cleartext Single Sign On credentials from the Local
          Security Authority using the Kiwi (Mimikatz) extension. Blank passwords will not be stored
          in the database.
Metasploit Module: Windows Gather Steam Client Session Collector.
Type: post
Path: modules/post/windows/gather/credentials/steam.rb
Platform: win
Authors: Nikolai Rusakov <nikolai.rusakov[at]gmail.com>

Description:
This module will collect Steam session information from an
          account set to autologin.
Metasploit Module: Quassel IRC Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/quassel_irc.rb
Platform: win

Description:
This module searches for credentials stored on Quassel IRC Client on a Windows host.
Metasploit Module: Windows Gather FTP Navigator Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/ftpnavigator.rb
Authors: theLightCosine

Description:
This module extracts saved passwords from the FTP Navigator FTP client.
          It will decode the saved passwords and store them in the database.
Metasploit Module: Windows Gather Group Policy Preference Saved Passwords
Type: post
Path: modules/post/windows/gather/credentials/gpp.rb
References: URL-http://msdn.microsoft.com/en-us/library/cc232604(v=prot.13), URL-http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html, URL-http://blogs.technet.com/grouppolicy/archive/2009/04/22/passwords-in-group-policy-preferences-updated.aspx, URL-https://labs.portcullis.co.uk/blog/are-you-considering-using-microsoft-group-policy-preferences-think-again/, MSB-MS14-025

Description:
This module enumerates the victim machine's domain controller and
          connects to it via SMB. It then looks for Group Policy Preference XML
          files containing local user accounts and passwords and decrypts them
          using Microsofts public AES key.

          Cached Group Policy files may be found on end-user devices if the group
          policy object is deleted rather than unlinked.

          Tested on WinXP SP3 Client and Win2k8 R2 DC.
Metasploit Module: Windows Gather BulletProof FTP Client Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/bulletproof_ftp.rb

Description:
This module extracts information from BulletProof FTP Bookmarks files and store
          retrieved credentials in the database.
Metasploit Module: Postbox Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/postbox.rb
Platform: win

Description:
This module searches for Postbox credentials on a Windows host.
Metasploit Module: Veeam Backup and Replication Credentials Dump
Type: post
Path: modules/post/windows/gather/credentials/veeam_credential_dump.rb
Disclosure date: 2022-11-22
Authors: npm[at]cesium137.io
References: URL-https://blog.checkymander.com/red%20team/veeam/decrypt-veeam-passwords/

Description:
This module exports and decrypts credentials from Veeam Backup & Replication and
          Veeam ONE Monitor Server to a CSV file; it is intended as a post-exploitation
          module for Windows hosts with either of these products installed. The module
          supports automatic detection of VBR / Veeam ONE and is capable of decrypting
          credentials for all versions including the latest build of 11.x.
Metasploit Module: KakaoTalk Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/kakaotalk.rb
Platform: win

Description:
This module searches for KakaoTalk credentials on a Windows host. KakaoTalk is a popular mobile messaging app most widely used in South Korea.
Metasploit Module: Opera Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/opera.rb
Platform: win

Description:
This module searches for Opera credentials on a Windows host.
Metasploit Module: Windows Gather Microsoft Outlook Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/outlook.rb

Description:
This module extracts and decrypts saved Microsoft
          Outlook (versions 2002-2010) passwords from the Windows
          Registry for POP3/IMAP/SMTP/HTTP accounts.
          In order for decryption to be successful, this module must be
          executed under the same privileges as the user which originally
          encrypted the password.
Metasploit Module: Windows Gather TortoiseSVN Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/tortoisesvn.rb

Description:
This module extracts and decrypts saved TortoiseSVN passwords.  In
          order for decryption to be successful this module must be executed
          under the same privileges as the user which originally encrypted the
          password.
Metasploit Module: Windows Gather FlashFXP Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/flashfxp.rb

Description:
This module extracts weakly encrypted saved FTP Passwords from FlashFXP. It
          finds saved FTP connections in the Sites.dat file.
Metasploit Module: Digsby Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/digsby.rb
Platform: win

Description:
This module searches for Digsby credentials on a Windows host.
Metasploit Module: Windows Gather Razer Synapse Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/razer_synapse.rb
References: URL-http://www.pentestgeek.com/2013/01/16/hard-coded-encryption-keys-and-more-wordpress-fun/, URL-https://github.com/pasv/Testing/blob/master/Razer_decode.py

Description:
This module will enumerate passwords stored by the Razer Synapse
          client. The encryption key and iv is publicly known. This module
          will not only extract encrypted password but will also decrypt
          password using public key. Affects versions earlier than 1.7.15.
Metasploit Module: Windows Gather WS_FTP Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/wsftp_client.rb

Description:
This module extracts weakly encrypted saved FTP Passwords
          from WS_FTP. It finds saved FTP connections in the ws_ftp.ini file.
Metasploit Module: K-Meleon Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/kmeleon.rb
Platform: win

Description:
This module searches for K-Meleon credentials on a Windows host.
Metasploit Module: RedisDesktopManager Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/redis_desktop_manager.rb
Platform: win
References: URL-https://blog.kali-team.cn/Metasploit-PackRat-RedisDesktopManager-42dc7ab063f040d182da0f1fc16db74e

Description:
This module searches for RedisDesktopManager credentials on a Windows host.
Metasploit Module: Windows Gather Navicat Passwords
Type: post
Path: modules/post/windows/gather/credentials/navicat.rb
References: URL-https://github.com/HyperSine/how-does-navicat-encrypt-password, URL-https://blog.kali-team.cn/Metasploit-Navicat-fbc1390cf57c40b5b576584c48b8e125

Description:
This module will find and decrypt stored Navicat passwords.
Metasploit Module: Comodo Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/comodo.rb
Platform: win

Description:
This module searches for credentials stored in Comodo on a Windows host.
Metasploit Module: Flock Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/flock.rb
Platform: win

Description:
This module searches for credentials stored in Flock on a Windows host.
Metasploit Module: Internet Explorer Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/ie.rb
Platform: win

Description:
This module searches for Internet Explorer credentials on a Windows host.
Metasploit Module: Windows Gather Credentials Local Administrator Password Solution
Type: post
Path: modules/post/windows/gather/credentials/enum_laps.rb

Description:
This module will recover the LAPS (Local Administrator Password Solution) passwords,
          configured in Active Directory, which is usually only accessible by privileged users.
          Note that the local administrator account name is not stored in Active Directory,
          so it is assumed to be 'Administrator' by default.
Metasploit Module: Windows SAM secrets leak - HiveNightmare
Type: post
Path: modules/post/windows/gather/credentials/windows_sam_hivenightmare.rb
Disclosure date: 2021-07-20
References: CVE-2021-36934, URL-https://github.com/GossiTheDog/HiveNightmare, URL-https://isc.sans.edu/diary/Summer+of+SAM+-+incorrect+permissions+on+Windows+1011+hives/27652, URL-https://github.com/romarroca/SeriousSam

Description:
Due to mismanagement of SAM and SYSTEM hives in Windows 10, it is possible for an unprivileged
          user to read those files. But, as they are locked while Windows is running we are not able
          to read them directly. The trick is to take advantage of Volume Shadow Copy, which is generally
          enabled, to finally have a read access. Once SAM and SYSTEM files are successfully dumped and
          stored in `store_loot`, you can dump the hashes with some external scripts like secretsdump.py
Metasploit Module: Coolnovo Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/coolnovo.rb
Platform: win

Description:
This module searches for Coolnovo credentials on a Windows host.
Metasploit Module: Windows Pulse Secure Connect Client Saved Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/pulse_secure.rb
Platform: win
Authors: Quentin Kaiser <kaiserquentin[at]gmail.com>
References: CVE-2020-8956, URL-https://qkaiser.github.io/reversing/2020/10/27/pule-secure-credentials, URL-https://www.gremwell.com/blog/reversing_pulse_secure_client_credentials_store, URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601

Description:
This module extracts and decrypts saved Pulse Secure Connect Client passwords from the
          Windows Registry. This module can only access credentials created by the user that the
          Meterpreter session is running as.
          Note that this module cannot link the password to a username unless the
          Meterpreter sessions is running as SYSTEM. This is because the username associated
          with a password is saved in 'C:\ProgramData\Pulse Secure\ConnectionStore\[SID].dat',
          which is only readable by SYSTEM.
          Note that for enterprise deployment, this username is almost always the domain
          username.

Check method (fingerprinting):
version_path = 'C:\\Program Files (x86)\\Pulse Secure\\Pulse\\versionInfo.ini'
    begin
      if !session.fs.file.exist?(version_path)
        print_error('Pulse Secure Connect client is not installed on this system')
        return Msf::Exploit::CheckCode::Safe('Pulse Secure Connect client is not installed on this system')
      end
      version_file = begin
        session.fs.file.open(version_path)
      rescue StandardError
        nil
      end
      if version_file.nil?
        print_error('Cannot open Pulse Secure Connect version file.')
        return Msf::Exploit::CheckCode::Unknown('Cannot open Pulse Secure Connect version file')
      end
      version_data = version_file.read.to_s
      version_file.close
      matches = version_data.scan(/DisplayVersion=([0-9.]+)/m)
      build = Rex::Version.new(matches[0][0])
      print_status("Target is running Pulse Secure Connect build #{build}.")
      if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }
        print_good('This version is considered vulnerable.')
        return Msf::Exploit::CheckCode::Vulnerable("Pulse Secure Connect build #{build} is vulnerable")
      end

      if is_system?
        print_good("You're executing from a privileged process so this version is considered vulnerable.")
        return Msf::Exploit::CheckCode::Vulnerable('Running as SYSTEM with Pulse Secure Connect installed')
      end

      print_warning("You're executing from an unprivileged process so th
Metasploit Module: Miranda Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/miranda.rb
Platform: win

Description:
This module searches for Miranda credentials on a Windows host.
Metasploit Module: Windows Gather Internet Download Manager (IDM) Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/idm.rb

Description:
This module recovers the saved premium download account passwords from
          Internet Download Manager (IDM). These passwords are stored in an encoded
          format in the registry. This module traverses through these registry entries
          and decodes them. Thanks to the template code of theLightCosine's CoreFTP
          password module.
Metasploit Module: Chrome Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/chrome.rb
Platform: win

Description:
This module searches for credentials stored on Chrome on a Windows host.
Metasploit Module: SolarWinds Orion Secrets Dump
Type: post
Path: modules/post/windows/gather/credentials/solarwinds_orion_dump.rb
Disclosure date: 2022-11-08
References: URL-https://malicious.link/post/2020/solarflare-release-password-dumper-for-SolarWinds-orion/, URL-https://github.com/atredispartners/solarwinds-orion-cryptography

Description:
This module exports and decrypts credentials from SolarWinds Orion Network
          Performance Monitor (NPM) to a CSV file; it is intended as a post-exploitation
          module for Windows hosts with SolarWinds Orion NPM installed. The module
          supports decryption of AES-256, RSA, and XMLSEC secrets. Separate actions for
          extraction and decryption of the data are provided to allow session migration
          during execution in order to log in to the SQL database using SSPI. Tested on
          the 2020 version of SolarWinds Orion NPM. This module is possible only because
          of the source code and technical information published by Rob Fuller and
          Atredis Partners.
Metasploit Module: Safari Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/safari.rb
Platform: win

Description:
This module searches for Safari credentials on a Windows host.
Metasploit Module: Windows Gather Skype Saved Password Hash Extraction
Type: post
Path: modules/post/windows/gather/credentials/skype.rb
References: URL-http://www.recon.cx/en/f/vskype-part2.pdf, URL-https://web.archive.org/web/[PII_REDACTED]5406/http://insecurety.net/?p=427, URL-https://github.com/skypeopensource/tools

Description:
This module finds saved login credentials
          for the Windows Skype client. The hash is in MD5 format
          that uses the username, a static string "\nskyper\n" and the
          password. The resulting MD5 is stored in the Config.xml file
          for the user after being XOR'd against a key generated by applying
          2 SHA1 hashes of "salt" data which is stored in ProtectedStorage
          using the Windows API CryptProtectData against the MD5
Metasploit Module: Windows Gather Credential Collector
Type: post
Path: modules/post/windows/gather/credentials/credential_collector.rb

Description:
This module harvests credentials found on the host and stores them in the database.
Metasploit Module: Sylpheed Email Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/sylpheed.rb
Platform: win

Description:
This module searches for credentials stored on Sylpheed email client on a Windows host.
Metasploit Module: Operamail Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/operamail.rb
Platform: win

Description:
This module searches for Operamail credentials on a Windows host.
Metasploit Module: Windows Gather DynDNS Client Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/dyndns.rb

Description:
This module extracts the username, password, and hosts for DynDNS version 4.1.8.
          This is done by downloading the config.dyndns file from the victim machine, and then
          automatically decode the password field. The original copy of the config file is also
          saved to disk.
Metasploit Module: Windows Gather Spark IM Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/spark_im.rb
References: URL-http://adamcaudill.com/2012/07/27/decrypting-spark-saved-passwords/

Description:
This module will enumerate passwords stored by the Spark IM client.
          The encryption key is publicly known. This module will not only extract encrypted
          password but will also decrypt password using public key.
Metasploit Module: Windows Gather IPSwitch iMail User Data Enumeration
Type: post
Path: modules/post/windows/gather/credentials/imail.rb
References: EDB-11331

Description:
This module will collect iMail user data such as the username, domain,
          full name, e-mail, and the decoded password.  Please note if IMAILUSER is
          specified, the module extracts user data from all the domains found.  If
          IMAILDOMAIN is specified, then it will extract all user data under that
          particular category.
Metasploit Module: Windows Gather PL/SQL Developer Connection Credentials
Type: post
Path: modules/post/windows/gather/credentials/plsql_developer.rb
References: URL-https://adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption/

Description:
This module can decrypt the histories and connection credentials of PL/SQL Developer,
          and passwords are available if the user chooses to remember.
Metasploit Module: Windows Gather MDaemonEmailServer Credential Cracking
Type: post
Path: modules/post/windows/gather/credentials/mdaemon_cred_collector.rb
Platform: win
Authors: Manuel Nader #AgoraSecurity
References: BID-4686

Description:
Finds and cracks the stored passwords of MDaemon Email Server.
Metasploit Module: Windows Gather SmartFTP Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/smartftp.rb

Description:
This module finds saved login credentials
          for the SmartFTP FTP client for windows.
          It finds the saved passwords and decrypts
          them.
Metasploit Module: Tango Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/tango.rb
Platform: win

Description:
This module searches for Tango credentials on a Windows host. Tango is a third-party, cross platform messaging application software for smartphones developed by TangoME, Inc.
Metasploit Module: XChat Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/xchat.rb
Platform: win

Description:
This module searches for XChat credentials on a Windows host. XChat is an IRC chat program for both Linux and Windows.
Metasploit Module: Gadugadu Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/gadugadu.rb
Platform: win

Description:
This module searches for Gadugadu credentials on a Windows host. Gadu-Gadu is a Polish instant messaging client using a proprietary protocol. Gadu-Gadu was the most popular IM service in Poland.
Metasploit Module: Windows Gather SmarterMail Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/smartermail.rb
Platform: win
References: URL-http://www.gironsec.com/blog/tag/cracking-smartermail/

Description:
This module extracts and decrypts the sysadmin password in the
          SmarterMail 'mailConfig.xml' configuration file. The encryption
          key and IV are publicly known.

          This module has been tested successfully on SmarterMail versions
          10.7.4842 and 11.7.5136.
Metasploit Module: Windows Gather RazorSQL Credentials
Type: post
Path: modules/post/windows/gather/credentials/razorsql.rb

Description:
This module stores username, password, type, host, port, database (and name)
          collected from profiles.txt of RazorSQL.
Metasploit Module: Windows Gather Mikrotik Winbox "Keep Password" Credentials Extractor
Type: post
Path: modules/post/windows/gather/credentials/winbox_settings.rb
Platform: win
Authors: Pasquale \

Description:
This module extracts Mikrotik Winbox credentials saved in the
          "settings.cfg.viw" file when the "Keep Password" option is
          selected in Winbox.
Metasploit Module: ICQ Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/icq.rb
Platform: win

Description:
This module searches for ICQ credentials on a Windows host.
Metasploit Module: Windows Gather TeamViewer Passwords
Type: post
Path: modules/post/windows/gather/credentials/teamviewer_passwords.rb
References: CVE-2019-18988, URL-https://whynotsecurity.com/blog/teamviewer/, URL-https://www.cnblogs.com/Kali-Team/p/12468066.html

Description:
This module will find and decrypt stored TeamViewer passwords
Metasploit Module: Adi IRC Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/adi_irc.rb
Platform: win

Description:
This module searches for credentials stored on AdiIRC Client on a Windows host.
Metasploit Module: Windows Gather McAfee ePO 4.6 Config SQL Credentials
Type: post
Path: modules/post/windows/gather/credentials/epo_sql.rb
Authors: Nathan Einwechter <neinwechter[at]gmail.com>

Description:
This module extracts connection details and decrypts the saved password for the
          SQL database in use by a McAfee ePO 4.6 server. The passwords are stored in a
          config file. They are encrypted with AES-128-ECB and a static key.
Metasploit Module: Windows Gather FileZilla FTP Server Credential Collection
Type: post
Path: modules/post/windows/gather/credentials/filezilla_server.rb
Platform: win

Description:
This module will collect credentials from the FileZilla FTP server if installed.
Metasploit Module: Windows Gather Nimbuzz Instant Messenger Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/nimbuzz.rb

Description:
This module extracts the account passwords saved by Nimbuzz Instant
          Messenger in hex format.
Metasploit Module: Windows Gather Xshell and Xftp Passwords
Type: post
Path: modules/post/windows/gather/credentials/xshell_xftp_password.rb
References: URL-https://github.com/HyperSine/how-does-Xmanager-encrypt-password/blob/master/doc/how-does-Xmanager-encrypt-password.md

Description:
This module can decrypt the password of xshell and xftp,
          if the user chooses to remember the password.
Metasploit Module: Tlen Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/tlen.rb
Platform: win

Description:
This module searches for Tlen credentials on a Windows host. Tlen is a free Polish instant messaging service.
Metasploit Module: Viber Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/viber.rb
Platform: win

Description:
This module searches for credentials in Viber desktop application on a Windows host. Viber is a cross-platform voice over IP and instant messaging software application.