deardaniel/secdata-raw huggingface dataset:
Metasploit Module: VMware vCenter Secrets Dump
Type: post
Path: modules/post/linux/gather/vcenter_secrets_dump.rb
Disclosure date: 2022-04-15
References: URL-https://github.com/shmilylty/vhost_password_decrypt, CVE-2022-22948, URL-https://pentera.io/blog/information-disclosure-in-vmware-vcenter/, URL-https://github.com/ErikWynter/metasploit-framework/blob/vcenter_gather_postgresql/modules/post/multi/gather/vmware_vcenter_gather_postgresql.rb

Description:
Grab secrets and keys from the vCenter server and add them to
          loot. This module is tested against the vCenter appliance only;
          it will not work on Windows vCenter instances. It is intended to
          be run after successfully acquiring root access on a vCenter
          appliance and is useful for penetrating further into the
          environment following a vCenter exploit that results in a root
          shell.

          Secrets include the dcAccountDN and dcAccountPassword for
          the vCenter machine which can be used for maniuplating the SSO
          domain via standard LDAP interface; good for plugging into the
          vmware_vcenter_vmdir_ldap module or for adding new SSO admin
          users. The MACHINE_SSL, VMCA_ROOT and SSO IdP certificates with
          associated private keys are also plundered and can be used to
          sign forged SAML assertions for the /ui admin interface.
Metasploit Module: Linux Gather Container Detection
Type: post
Path: modules/post/linux/gather/checkcontainer.rb
Platform: %w[linux unix

Description:
This module attempts to determine whether the system is running
          inside of a container and if so, which one. This module supports
          detection of Docker, WSL, LXC, Podman and systemd nspawn.
Metasploit Module: Linux Gather NetworkManager 802-11-Wireless-Security Credentials
Type: post
Path: modules/post/linux/gather/enum_psk.rb
Platform: linux
Authors: Cenk Kalpakoglu

Description:
This module collects 802-11-Wireless-Security credentials such as
          Access-Point name and Pre-Shared-Key from Linux NetworkManager
          connection configuration files.
Metasploit Module: Linux Container Enumeration
Type: post
Path: modules/post/linux/gather/enum_containers.rb
Platform: linux
Authors: stealthcopter

Description:
This module attempts to enumerate containers on the target machine and optionally run a command on each active container found.
          Currently it supports Docker, LXC and RKT.
Metasploit Module: MimiPenguin
Type: post
Path: modules/post/linux/gather/mimipenguin.rb
Disclosure date: 2018-05-23
References: URL-https://github.com/huntergregal/mimipenguin, URL-https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919, URL-https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1717490, CVE-2018-20781

Description:
This searches process memory for needles that indicate
          where cleartext passwords may be located. If any needles
          are discovered in the target process memory, collected
          strings in adjacent memory will be hashed and compared
          with password hashes found in `/etc/shadow`.
Metasploit Module: IGEL OS Dump File
Type: post
Path: modules/post/linux/gather/igel_dump_file.rb
Platform: linux
Disclosure date: 2024-03-07
Authors: Zack Didcott

Description:
Dump a file with escalated privileges for IGEL OS Workspace Edition sessions,
          by elevating rights with setup_cmd (SUID) and outputting with date.

Check method (fingerprinting):
version = Rex::Version.new(
      read_file('/etc/system-release').delete_prefix('IGEL OS').strip
    )
    unless version < Rex::Version.new('11.09.260')
      return Exploit::CheckCode::Safe("IGEL OS #{version} is not vulnerable")
    end

    unless file?('/etc/setupd-usercommands.json')
      return Exploit::CheckCode::Appears("IGEL OS #{version} appears to be vulnerable")
    end

    Exploit::CheckCode::Appears("IGEL OS #{version} should be vulnerable")
  end
Metasploit Module: Rancher Audit Log Sensitive Information Leak
Type: post
Path: modules/post/linux/gather/rancher_audit_log_leak.rb
Platform: linux
Disclosure date: 2024-02-08
References: URL-https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#api-audit-log-options, CVE-2023-22649

Description:
Rancher versions between 2.6.0-2.6.13, 2.7.0-2.7.9, 2.8.0-2.8.1 inclusive
          contain a vulnerability where sensitive data is leaked into the audit logs.
          Rancher Audit Logging is an opt-in feature, only deployments that have it
          enabled and have AUDIT_LEVEL set to 1 or above are impacted by this issue.

          Tested against rancher 2.6.0.
Metasploit Module: Linux Gather System and User Information
Type: post
Path: modules/post/linux/gather/enum_system.rb
Platform: linux

Description:
This module gathers system information. We collect
          installed packages, installed services, mount information,
          user list, user bash history and cron jobs
Metasploit Module: Apache NiFi Credentials Gather
Type: post
Path: modules/post/linux/gather/apache_nifi_credentials.rb
Platform: linux
References: URL-https://stackoverflow.com/questions/77391210/python-vs-ruby-aes-pbkdf2, URL-https://nifi.apache.org/docs/nifi-docs/html/administration-guide.html#nifi_sensitive_props_key

Description:
This module will grab Apache NiFi credentials from various files on Linux.
Metasploit Module: Linux Gather User History
Type: post
Path: modules/post/linux/gather/enum_users_history.rb
Platform: linux

Description:
This module gathers the following user-specific information:
          shell history, MySQL history, PostgreSQL history, MongoDB history,
          Vim history, lastlog, and sudoers.
Metasploit Module: Linux Gather Protection Enumeration
Type: post
Path: modules/post/linux/gather/enum_protections.rb
Platform: linux
Authors: ohdae <bindshell[at]live.com>

Description:
This module checks whether popular system hardening mechanisms are
          in place, such as SMEP, SMAP, KPTI, SELinux, PaX, grsecurity, and
          Yama. It also tries to find installed applications that can be used
          to hinder, prevent, or detect attacks, such as tripwire, snort,
          apparmor, falco, and wazuh.

          This module is meant to identify Linux Secure Modules (LSM) in addition
          to various antivirus, IDS/IPS, firewalls, sandboxes and other security
          related software.
Metasploit Module: Linux Gather Dump Password Hashes for Linux Systems
Type: post
Path: modules/post/linux/gather/hashdump.rb
Platform: linux
Authors: Carlos Perez <carlos_perez[at]darkoperator.com>

Description:
Post Module to dump the password hashes for all users on a Linux System
Metasploit Module: Linux Gather ManageEngine Password Manager Pro Password Extractor
Type: post
Path: modules/post/linux/gather/manageengine_password_manager_creds.rb
Platform: unix
References: URL-https://www.trustedsec.com/blog/the-curious-case-of-the-password-database/, URL-https://github.com/trustedsec/Zoinks/blob/main/zoinks.py

Description:
This module gathers the encrypted passwords stored by Password Manager
          Pro and decrypt them using key materials stored in multiple
          configuration files.
Metasploit Module: Gather eCryptfs Metadata
Type: post
Path: modules/post/linux/gather/ecryptfs_creds.rb
Platform: linux
Authors: Dhiru Kholia <dhiru[at]openwall.com>

Description:
This module will collect the contents of all users' .ecrypts directories on
          the targeted machine. Collected "wrapped-passphrase" files can be
          cracked with John the Ripper (JtR) to recover "mount passphrases".
Metasploit Module: Haserl Arbitrary File Reader
Type: post
Path: modules/post/linux/gather/haserl_read.rb
References: URL-https://twitter.com/steaIth/status/[PII_REDACTED]54712842, URL-https://gitlab.alpinelinux.org/alpine/aports/-/issues/12539, CVE-2021-29133

Description:
This module exploits haserl prior to 0.9.36 to read arbitrary files.
          The most widely accepted exploitation vector is reading /etc/shadow,
          which will reveal root's hash for cracking.
Metasploit Module: Ansible Config Gather
Type: post
Path: modules/post/linux/gather/ansible.rb
Platform: linux

Description:
This module will grab ansible information including hosts, ping status, and the configuration file.
Metasploit Module: Linux Gather PPTP VPN chap-secrets Credentials
Type: post
Path: modules/post/linux/gather/pptpd_chap_secrets.rb

Description:
This module collects PPTP VPN information such as client, server, password,
          and IP from your target server's chap-secrets file.
Metasploit Module: Linux Gather Virtual Environment Detection
Type: post
Path: modules/post/linux/gather/checkvm.rb

Description:
This module attempts to determine whether the system is running
          inside of a virtual environment and if so, which one. This
          module supports detection of Hyper-V, VMWare, VirtualBox, Xen,
          Bhyve and QEMU/KVM.
Metasploit Module: Ansible Playbook Error Message File Reader
Type: post
Path: modules/post/linux/gather/ansible_playbook_error_message_file_reader.rb
Platform: linux
References: URL-https://rioasmara.com/2022/03/21/ansible-playbook-weaponization/

Description:
This module will read the first line of a file based on an error message from ansible-playbook with sudo privileges.
          ansible-playbook takes a yaml file as input, and if there is an error, such as a non-yaml file, it outputs the line
          where the error occurs. This can be exploited to read the first line of the file, which we'll typically want to read
          /etc/shadow to obtain root's hash.
Metasploit Module: F5 Big-IP Gather Information from MCP Datastore
Type: post
Path: modules/post/linux/gather/f5_loot_mcp.rb
Platform: linux
Disclosure date: 2022-11-16
Authors: Ron Bowes
References: URL-https://github.com/rbowes-r7/refreshing-mcp-tool, URL-https://www.rapid7.com/blog/post/2022/11/16/cve-2022-41622-and-cve-2022-41800-fixed-f5-big-ip-and-icontrol-rest-vulnerabilities-and-exposures/, URL-https://support.f5.com/csp/article/K97843387

Description:
This module gathers various interesting pieces of data from F5's
          "mcp" datastore, which is accessed via /var/run/mcp using a
          proprietary protocol.

          Adapted from:  https://github.com/rbowes-r7/refreshing-mcp-tool/blob/main/mcp-getloot.rb
Metasploit Module: Linux Gather Network Information
Type: post
Path: modules/post/linux/gather/enum_network.rb
Platform: linux

Description:
This module gathers network information from the target system
          IPTables rules, interfaces, wireless information, open and listening
          ports, active network connections, DNS information and SSH information.
Metasploit Module: GrandStream GXP1600 Gather Credentials
Type: post
Path: modules/post/linux/gather/grandstream_gxp1600_creds.rb
Platform: linux

Description:
This gather module works against Grandstream GXP1600 series VoIP devices and can collect HTTP, SIP, and TR-069
          credentials from a device. You can first leverage the `exploit/linux/http/grandstream_gxp1600_unauth_rce` exploit
          module to get a root session on a target GXP1600 series device before running this post module.
Metasploit Module: Nagios XI Enumeration
Type: post
Path: modules/post/linux/gather/enum_nagios_xi.rb
Platform: linux
Disclosure date: 2018-04-17

Description:
NagiosXI may store credentials of the hosts it monitors. This module extracts these credentials,
          creating opportunities for lateral movement.
Metasploit Module: Linux Gather Saved mount.cifs/mount.smbfs Credentials
Type: post
Path: modules/post/linux/gather/mount_cifs_creds.rb
Platform: linux
Authors: Jon Hart <jhart[at]spoofed.org>

Description:
Post Module to obtain credentials saved for mount.cifs/mount.smbfs in
          /etc/fstab on a Linux system.
Metasploit Module: Puppet Config Gather
Type: post
Path: modules/post/linux/gather/puppet.rb
Platform: linux
References: URL-https://github.com/Tikam02/DevOps-Guide/blob/master/Infrastructure-provisioning/Puppet/puppet-commands.md

Description:
This module will grab Puppet config files, credentials, host information, and file buckets.
Metasploit Module: Gnome-Keyring Dump
Type: post
Path: modules/post/linux/gather/gnome_keyring_dump.rb
Authors: Spencer McIntyre

Description:
Use libgnome-keyring to extract network passwords for the current user.
          This module does not require root privileges to run.
Metasploit Module: OpenVPN Gather Credentials
Type: post
Path: modules/post/linux/gather/openvpn_credentials.rb
Platform: linux
References: URL-https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh

Description:
This module grab OpenVPN credentials from a running process
          in Linux.

          Note: --auth-nocache must not be set in the OpenVPN command line.
Metasploit Module: Linux Gather Gnome-Commander Creds
Type: post
Path: modules/post/linux/gather/gnome_commander_creds.rb
Platform: %w[linux

Description:
This module collects the clear text passwords stored by
          Gnome-commander, a GUI file explorer for GNOME.  Typically, these
          passwords are stored in the user's home directory, at
          ~/.gnome-commander/connections.
Metasploit Module: Linux Gather TOR Hidden Services
Type: post
Path: modules/post/linux/gather/tor_hiddenservices.rb
Platform: linux

Description:
This module collects the hostnames name and private keys of
          any TOR Hidden Services running on the target machine. It
          will search for torrc and if found, will parse it for the
          directories of Hidden Services. However, root permissions
          are required to read them as they are owned by the user that
          TOR runs as, usually a separate account.
Metasploit Module: Gather Available Shell Commands
Type: post
Path: modules/post/linux/gather/enum_commands.rb
Platform: linux
Authors: Alberto Rafael Rodriguez Iglesias <albertocysec[at]gmail.com>

Description:
This module will check which shell commands are available on a system."
Metasploit Module: Linux Gather Configurations
Type: post
Path: modules/post/linux/gather/enum_configs.rb
Platform: linux

Description:
This module collects configuration files found on commonly installed
          applications and services, such as Apache, MySQL, Samba, Sendmail, etc.
          If a config file is found in its default path, the module will assume
          that is the file we want.
Metasploit Module: Linux DoS Xen 4.2.0 2012-5525
Type: post
Path: modules/post/linux/dos/xen_420_dos.rb
References: CVE-2012-5525

Description:
This module causes a hypervisor crash in Xen 4.2.0 when invoked from a
          paravirtualized VM, including from dom0.  Successfully tested on Debian 7
          3.2.0-4-amd64 with Xen 4.2.0.
Metasploit Module: GrandStream GXP1600 proxy SIP traffic
Type: post
Path: modules/post/linux/capture/grandstream_gxp1600_sip.rb
Platform: linux

Description:
This capture module works against Grandstream GXP1600 series VoIP devices and can reconfigure the device to use an
          arbitrary SIP proxy. You can first leverage the `exploit/linux/http/grandstream_gxp1600_unauth_rce` exploit
          module to get a root session on a target GXP1600 series device before running this post module.
Metasploit Module: Solaris Gather Configured Services
Type: post
Path: modules/post/solaris/gather/enum_services.rb

Description:
Post module to enumerate services on a Solaris system.
Metasploit Module: Solaris Gather Dump Password Hashes for Solaris Systems
Type: post
Path: modules/post/solaris/gather/hashdump.rb

Description:
Post module to dump the password hashes for all users on a Solaris system.
Metasploit Module: Solaris Gather Virtual Environment Detection
Type: post
Path: modules/post/solaris/gather/checkvm.rb

Description:
This module attempts to determine whether the system is running
          inside of a virtual environment and if so, which one. This
          module supports detection of Solaris Zone, VMWare, VirtualBox, Xen,
          and QEMU/KVM.
Metasploit Module: Solaris Gather Installed Packages
Type: post
Path: modules/post/solaris/gather/enum_packages.rb

Description:
Post module to enumerate installed packages on a Solaris system.
Metasploit Module: Solaris pfexec Upgrade Shell
Type: post
Path: modules/post/solaris/escalate/pfexec.rb
Platform: solaris
Authors: bcoles
References: URL-https://docs.oracle.com/cd/E19253-01/816-4557/prbactm-1/index.html, URL-http://www.c0t0d0s0.org/archives/4844-Less-known-Solaris-features-pfexec.html, URL-http://solaris.wikia.com/wiki/Providing_root_privileges_with_pfexec

Description:
This module attempts to upgrade a shell session to UID 0 using pfexec.
Metasploit Module: Solaris srsexec Arbitrary File Reader
Type: post
Path: modules/post/solaris/escalate/srsexec_readline.rb
Disclosure date: 2007-05-07
References: CVE-2007-2617, URL-https://download.oracle.com/sunalerts/1000443.1.html, URL-https://www.securityfocus.com/archive/1/468235, EDB-30021, BID-23915

Description:
This module exploits a vulnerability in NetCommander 3.2.3 and 3.2.5.
          When srsexec is executed in debug (-d) verbose (-v) mode,
          the first line of an arbitrary file can be read due to the suid bit set.
          The most widely accepted exploitation vector is reading /etc/shadow,
          which will reveal root's hash for cracking.

Check method (fingerprinting):
if is_root?
      fail_with(Failure::BadConfig, 'Session already has root privileges')
    end

    # This ls is based on the guidance in the sun alerts article
    unin = cmd_exec '/usr/bin/ls /opt/SUNWsrspx/bin/UninstallNetConnect.*.sh'
    unin =~ /UninstallNetConnect\.([\d.]{11})\.sh/
    unless ::Regexp.last_match(1)
      print_error('NetConnect uninstall not found, either not installed or too new')
      return false
    end

    version = Rex::Version.new(::Regexp.last_match(1).split('.').map(&:to_i).join('.'))
    unless version.between?(Rex::Version.new('3.2.3'), Rex::Version.new('3.2.4'))
      print_error "#{version} is not vulnerable"
      return false
    end
    print_good("#{version} is vulnerable")

    unless setuid?(suid_bin_path)
      vprint_error("#{suid_bin_path} is not setuid, it must have been manually patched")
      return false
    end

    true
  end
Metasploit Module: OS X Text to Speech Utility
Type: post
Path: modules/post/osx/admin/say.rb
References: URL-http://www.gabrielserafini.com/blog/2008/08/19/mac-os-x-voices-for-using-with-the-say-command/

Description:
This module will speak whatever is in the 'TEXT' option on the victim machine.
Metasploit Module: OSX Manage Record Microphone
Type: post
Path: modules/post/osx/manage/record_mic.rb

Description:
This module will allow the user to detect (with the LIST action) and
          capture (with the RECORD action) audio inputs on a remote OSX machine.
Metasploit Module: OSX Network Share Mounter
Type: post
Path: modules/post/osx/manage/mount_share.rb

Description:
This module lists saved network shares and tries to connect to them using stored
          credentials. This does not require root privileges.
Metasploit Module: OS X Manage Sonic Pi
Type: post
Path: modules/post/osx/manage/sonic_pi.rb
Platform: osx

Description:
This module controls Sonic Pi via its local OSC server.

          The server runs on 127.0.0.1:4557 and receives OSC messages over UDP.

          Yes, this is RCE, but it's local. I suggest playing music. :-)
Metasploit Module: OSX Manage Webcam
Type: post
Path: modules/post/osx/manage/webcam.rb

Description:
This module will allow the user to detect installed webcams (with
          the LIST action), take a snapshot (with the SNAPSHOT action), or
          record a webcam and mic (with the RECORD action).
Metasploit Module: OSX VPN Manager
Type: post
Path: modules/post/osx/manage/vpn.rb

Description:
This module lists VPN connections and tries to connect to them using stored credentials.
Metasploit Module: OS X Gather Adium Enumeration
Type: post
Path: modules/post/osx/gather/enum_adium.rb

Description:
This module will collect Adium's account plist files and chat logs from the
          victim's machine.  There are three different actions you may choose: ACCOUNTS,
          CHATS, and ALL.  Note that to use the 'CHATS' action, make sure you set the regex
          'PATTERN' option in order to look for certain log names (which consists of a
          contact's name, and a timestamp).  The current 'PATTERN' option is configured to
          look for any log created on February 2012 as an example.  To loot both account
          plists and chat logs, simply set the action to 'ALL'.
Metasploit Module: Git Ignore Retriever
Type: post
Path: modules/post/osx/gather/gitignore.rb

Description:
This module finds potentially sensitive items by finding .gitignore files.
Metasploit Module: OS X Display Apple VNC Password
Type: post
Path: modules/post/osx/gather/vnc_password_osx.rb

Description:
This module shows Apple VNC Password from Mac OS X High Sierra.
Metasploit Module: OS X Gather Colloquy Enumeration
Type: post
Path: modules/post/osx/gather/enum_colloquy.rb

Description:
This module will collect Colloquy's info plist file and chat logs from the
          victim's machine.  There are three actions you may choose:  INFO, CHATS, and
          ALL.  Please note that the CHAT action may take a long time depending on the
          victim machine, therefore we suggest to set the regex 'PATTERN' option in order
          to search for certain log names (which consists of the contact's name, and a
          timestamp).  The default 'PATTERN' is configured as "^alien" as an example
          to search for any chat logs associated with the name "alien".
Metasploit Module: OSX Gather Safari LastSession.plist
Type: post
Path: modules/post/osx/gather/safari_lastsession.rb
References: URL-http://www.securelist.com/en/blog/8168/Loophole_in_Safari

Description:
This module downloads the LastSession.plist file from the target machine.
          LastSession.plist is used by Safari to track active websites in the current session,
          and sometimes contains sensitive information such as usernames and passwords.

          This module will first download the original LastSession.plist, and then attempt
          to find the credential for Gmail. The Gmail's last session state may contain the
          user's credential if his/her first login attempt failed (likely due to a typo),
          and then the page got refreshed or another login attempt was made. This also means
          the stolen credential might contain typos.
Metasploit Module: OS X Gather Mac OS X Password Hash Collector
Type: post
Path: modules/post/osx/gather/hashdump.rb

Description:
This module dumps SHA-1, LM, NT, and SHA-512 Hashes on OSX. Supports
          versions 10.3 to 10.14.
Metasploit Module: OS X Gather Messages
Type: post
Path: modules/post/osx/gather/enum_messages.rb
Platform: osx
Authors: Geckom <geckom[at]redteamr.com>

Description:
This module will collect the Messages sqlite3 database files and chat logs
          from the victim's machine. There are four actions you may choose: DBFILE,
          READABLE, LATEST, and ALL. DBFILE and READABLE will retrieve all messages, and
          LATEST will retrieve the last X number of messages (useful with 2FA). Module
          was tested with OS X 10.11 (El Capitan).