deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Apache Solr Backup/Restore APIs RCE
Type: exploit
Path: modules/exploits/linux/http/apache_solr_backup_restore.rb
Platform: %w[unix linux
Disclosure date: 2024-02-24
References: URL-https://xz.aliyun.com/t/13637?time__1311=mqmxnQ0QiQi%3DDtKDsD7md0%3DnxeqjghDMxTD, URL-https://github.com/rapid7/metasploit-framework/issues/18919, URL-https://github.com/vvmdx/Apache-Solr-RCE_CVE-2023-50386_POC, CVE-2023-50386
Targets: Unix Command

Description:
Apache Solr from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1 is affected by an Unrestricted Upload of File
          with Dangerous Type vulnerability which can result in remote code execution in the context of the user running
          Apache Solr. When Apache Solr creates a Collection, it will use a specific directory as the classpath and load
          some classes from it. The backup function of the Collection can export malicious class files uploaded by
          attackers to the directory, allowing Solr to load custom classes and create arbitrary Java code. Execution
          can further bypass the Java sandbox configured by Solr, ultimately causing arbitrary command execution.

Check method (fingerprinting):
print_status('Running check method')
    auth_res = solr_check_auth
    unless auth_res
      return CheckCode::Unknown('Authentication failed!')
    end

    # convert to JSON
    ver_json = auth_res.get_json_document
    # get Solr version
    solr_version = Rex::Version.new(ver_json['lucene']['solr-spec-version'])
    print_status("Found Apache Solr #{solr_version}")
    # get OS version details
    @target_platform = ver_json['system']['name']
    target_arch = ver_json['system']['arch']
    target_osver = ver_json['system']['version']
    print_status("OS version is #{@target_platform} #{target_arch} #{target_osver}")

    unless solr_version.between?(Rex::Version.new('6.0.0'), Rex::Version.new('8.11.2')) ||
           solr_version.between?(Rex::Version.new('9.0.0'), Rex::Version.new('9.4.0'))
      return CheckCode::Safe('Running version of Solr is not vulnerable!')
    end

    CheckCode::Appears("Found Apache Solr version: #{ver_json['lucene']['solr-spec-version']}")
  end

  # This method returns the compiled byte code of the following class, SourceParser.java:
  #
  # package zk_backup_0.configs.confname;
  #
  # import sun.misc.Unsafe;
  # import java.io.BufferedReader;
  # import java.io.File;
  # import java.io.FileOutputStream;
  # import java.io.InputStreamReader;
  # import java.lang.reflect.Field;
  # import java.lang.reflect.Method;
  # import java.security.ProtectionDomain;
  # import java.util.Map;
  #
  #
  # public class SourceParser {
  #
  #     static
Metasploit Module: Zabbix 2.0.8 SQL Injection and Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/zabbix_sqli.rb
Platform: unix
Disclosure date: 2013-09-23
References: CVE-2013-5743, URL-https://support.zabbix.com/browse/ZBX-7091

Description:
This module exploits an unauthenticated SQL injection vulnerability affecting Zabbix
          versions 2.0.8 and lower.  The SQL injection issue can be abused in order to retrieve an
          active session ID.  If an administrator level user is identified, remote code execution
          can be gained by uploading and executing remote scripts via the 'scripts_exec.php' file.

Check method (fingerprinting):
# Check version
    vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, "httpmon.php")
    })

    if res and res.code == 200 and res.body =~ /(STATUS OF WEB MONITORING)/ and res.body =~ /(?<=Zabbix )(.*)(?= Copyright)/
      version = $1
      vprint_status("Zabbix version #{version} detected")
    else
      # If this fails, guest access may not be enabled
      vprint_status("Unable to access httpmon.php")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if version and Rex::Version.new(version) <= Rex::Version.new("2.0.8")
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    else
      return Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    end
  end
Metasploit Module: Eclipse Che machine-exec Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/eclipse_che_machine_exec_rce.rb
Platform: unix
Disclosure date: 2025-12-01
References: CVE-2025-12548, URL-https://access.redhat.com/security/cve/cve-2025-12548, URL-https://github.com/eclipse-che/che-machine-exec
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated remote code execution vulnerability
          in the Eclipse Che machine-exec service (CVE-2025-12548). The machine-exec
          service, exposed on port 3333 within Red Hat OpenShift DevSpaces developer
          workspace containers, accepts WebSocket connections without authentication.

          An attacker can connect to the machine-exec service and execute arbitrary
          commands via JSON-RPC over WebSocket. This allows lateral movement between
          workspaces and potential cluster compromise.

          The vulnerability affects Red Hat OpenShift DevSpaces environments where
          the machine-exec service is network-accessible.

Check method (fingerprinting):
begin
      wsock, hello = connect_ws_with_leftover(normalize_uri(target_uri.path, 'connect'))
    rescue Rex::Proto::Http::WebSocket::ConnectionError => e
      return CheckCode::Unknown("WebSocket connection failed: #{e.message}")
    end

    if hello.blank?
      safe_wsclose(wsock)
      return CheckCode::Unknown('No hello message received from service')
    end

    begin
      json = JSON.parse(hello)
      if json['method'] == 'connected' && json.dig('params', 'tunnel')
        safe_wsclose(wsock)
        return CheckCode::Appears('machine-exec service accepts unauthenticated connections')
      end
    rescue JSON::ParserError
      nil
    end

    safe_wsclose(wsock)
    CheckCode::Safe('Service did not respond as expected')
  end
Metasploit Module: OpenNMS Horizon Authenticated RCE
Type: exploit
Path: modules/exploits/linux/http/opennms_horizon_authenticated_rce.rb
Platform: linux
Disclosure date: 2023-07-01
References: CVE-2023-40315, CVE-2023-0872

Description:
This module exploits built-in functionality in OpenNMS
          Horizon in order to execute arbitrary commands as the
          opennms user. For versions 32.0.2 and higher, this
          module requires valid credentials for a user with
          ROLE_FILESYSTEM_EDITOR privileges and either
          ROLE_ADMIN or ROLE_REST.

          For versions 32.0.1 and lower, credentials are
          required for a user with ROLE_FILESYSTEM_EDITOR,
          ROLE_REST, and/or ROLE_ADMIN privileges. In that case,
          the module will automatically escalate privileges via
          CVE-2023-40315 or CVE-2023-0872 if necessary.

          This module has been successfully tested against OpenNMS
          version 31.0.7

Check method (fingerprinting):
# Try to authenticate
    success, msg_or_check_code = opennms_login('check')
    return msg_or_check_code unless success

    vprint_status(msg_or_check_code)

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'index.jsp'),
      'keep_cookies' => true
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    # If we are authenticating as a user without dashboard privileges, the response code will be 403, so we can't use this
    # Instead, we should simply check if the HTLM body includes the expected title and version information
    unless res.get_html_document.xpath('//title').text.include?('OpenNMS Web Console')
      return CheckCode::Detected('Failed to access the OpenNMS Web Console after authentication.')
    end

    # Based on the version history (https://www.opennms.com/version-history/) all OpenNMS Horizon versions follow the \d+\.\d+\.\d+ pattern
    version = res.body.scan(/- Version: (\d+\.\d+\.\d+)$/)&.flatten&.first

    if version.blank?
      return CheckCode::Detected('Failed to obtain a valid OpenNMS version.')
    end

    begin
      rex_version = Rex::Version.new(version)
    rescue ArgumentError => e
      return CheckCode::Unknown("Failed to obtain a valid OpenNMS version: #{e}")
    end

    if rex_version < Rex::Version.new('32.0.2')
      print_status("The target is OpenNMS version #{version} and is likely vulnerable to CVE-2023-40315 and CVE-2023-0872.")
    else
Metasploit Module: Rconfig 3.x Chained Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/rconfig_ajaxarchivefiles_rce.rb
Platform: %w[unix linux
Disclosure date: 2020-03-11
References: CVE-2019-19509, CVE-2020-10220, URL-https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2019-19509.py, URL-https://github.com/v1k1ngfr/exploits-rconfig/blob/master/rconfig_CVE-2020-10220.py

Description:
This module exploits multiple vulnerabilities in rConfig version 3.9
          in order to execute arbitrary commands.
          This module takes advantage of a command injection vulnerability in the
          `path` parameter of the ajax archive file functionality within the rConfig web
          interface in order to execute the payload.
          Valid credentials for a user with administrative privileges are required.
          However, this module can bypass authentication via SQLI.
          This module has been successfully tested on Rconfig 3.9.3 and 3.9.4.
          The steps are:
          1. SQLi on /commands.inc.php allows us to add an administrative user.
          2. An authenticated session is established with the newly added user
          3. Command Injection on /lib/ajaxHandlers/ajaxArchiveFiles.php allows us to
          execute the payload.
          4. Remove the added admin user.
          Tips : once you get a shell, look at the CVE-2019-19585.
          You will probably get root because rConfig install script add Apache user to
          sudoers with nopasswd ;-)

Check method (fingerprinting):
vprint_status 'STEP 0: Get rConfig version...'
    res = send_request_cgi!(
      'method' => 'GET',
      'uri' => '/login.php'
    )
    if !res || !res.get_html_document
      return Exploit::CheckCode::Unknown('Could not retrieve the rConfig login page')
    end

    footer = res.get_html_document.at('div[@id="footer-copyright"]')
    return Exploit::CheckCode::Unknown('Could not find version information on the login page') unless footer

    if footer.text.include? 'rConfig Version 3.9'
      print_good('rConfig version 3.9 detected')
      return Exploit::CheckCode::Appears('rConfig version 3.9 was detected')
    elsif footer.text.include? 'rConfig'
      print_status('rConfig detected, but not version 3.9')
      return Exploit::CheckCode::Detected('rConfig was detected but not version 3.9')
    end
    Exploit::CheckCode::Safe('rConfig was not detected')
  end

  # CREATE AN ADMIN USER IN RCONFIG
Metasploit Module: Raidsonic NAS Devices Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/raidsonic_nas_ib5220_exec_noauth.rb
Platform: unix
Disclosure date: 2013-02-04
References: CVE-2013-10049, OSVDB-90221, EDB-24499, BID-57958, URL-http://www.s3cur1ty.de/m1adv2013-010

Description:
Different Raidsonic NAS devices are vulnerable to OS command injection via the web
          interface. The vulnerability exists in timeHandler.cgi, which is accessible without
          authentication. This module has been tested with the versions IB-NAS5220 and
          IB-NAS4220. Since this module is adding a new user and modifying the inetd daemon
          configuration, this module is set to ManualRanking and could cause target instability.
Metasploit Module: PowerShellEmpire Arbitrary File Upload (Skywalker)
Type: exploit
Path: modules/exploits/linux/http/empire_skywalker.rb
Platform: python
Disclosure date: 2016-10-15
References: CVE-2024-6127, URL-https://blog.harmj0y.net/empire/empire-fails/, URL-https://aceresponder.com/blog/exploiting-empire-c2-framework, URL-https://github.com/ACE-Responder/Empire-C2-RCE-PoC/tree/main
Targets: Python, Linux x86, Linux x64

Description:
A vulnerability existed in the new Empire (maintained by BC Security)
          prior to commit e73e883 (<v5.9.3) or the original PowerShellEmpire
          server prior to commit f030cf62 which would allow an arbitrary file
          to be written to an attacker controlled location with the permissions
          of the Empire server.

          This exploit will write the payload to /tmp/ directory followed by a
          cron.d file to execute the payload.

Check method (fingerprinting):
@staging_key = get_staging_key
    return Exploit::CheckCode::Safe('The target is not vulnerable') if @staging_key.nil?

    Exploit::CheckCode::Appears('The target appears to be vulnerable')
  end
Metasploit Module: Dlink DIR Routers Unauthenticated HNAP Login Stack Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/dlink_hnap_login_bof.rb
Platform: linux
Disclosure date: 2016-11-07
References: CVE-2016-6563, US-CERT-VU-677427, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/dlink-hnap-login.txt, URL-https://seclists.org/fulldisclosure/2016/Nov/38
Targets: Dlink DIR-818 / 822 / 823 / 850 [MIPS], Dlink DIR-868 (rev. B and C) / 880 / 885 / 890 / 895 [ARM]

Description:
Several Dlink routers contain a pre-authentication stack buffer overflow vulnerability, which
          is exposed on the LAN interface on port 80. This vulnerability affects the HNAP SOAP protocol,
          which accepts arbitrarily long strings into certain XML parameters and then copies them into
          the stack.
          This exploit has been tested on the real devices DIR-818LW and 868L (rev. B), and it was tested
          using emulation on the DIR-822, 823, 880, 885, 890 and 895. Others might be affected, and
          this vulnerability is present in both MIPS and ARM devices.
          The MIPS devices are powered by Lextra RLX processors, which are crippled MIPS cores lacking a
          few load and store instructions. Because of this the payloads have to be sent unencoded, which
          can cause them to fail, although the bind shell seems to work well.
          For the ARM devices, the inline reverse tcp seems to work best.
          Check the reference links to see the vulnerable firmware versions.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/HNAP1/',
        'method' => 'POST',
        'Content-Type' => 'text/xml',
        'headers' => { 'SOAPAction' => 'http://purenetworks.com/HNAP1/Login' }
      })

      if res && res.code == 500
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ISPConfig language_edit.php PHP Code Injection
Type: exploit
Path: modules/exploits/linux/http/ispconfig_lang_edit_php_code_injection.rb
Platform: php
Disclosure date: 2023-10-24
References: CVE-2023-46818, URL-https://github.com/SyFi/CVE-2023-46818, URL-https://karmainsecurity.com/KIS-2023-13, URL-https://karmainsecurity.com/pocs/CVE-2023-46818.php
Targets: Automatic PHP

Description:
This module exploits a PHP code injection vulnerability in ISPConfig's
          language_edit.php file. The vulnerability occurs when the `admin_allow_langedit`
          setting is enabled, allowing authenticated administrators to inject arbitrary
          PHP code through the language editor interface.

          This module will automatically check if the required `admin_allow_langedit`
          permission is enabled, and attempt to enable it if it's disabled (requires
          admin credentials with system configuration access).

          The exploit works by injecting a PHP payload into a language file, which
          is then executed when the file is accessed. The payload is base64 encoded
          and written using PHP's file_put_contents function.

Check method (fingerprinting):
print_status('Checking if the target is ISPConfig...')
    return CheckCode::Unknown('Failed to login') unless authenticate

    # Always try to log in and parse version, since credentials are required
    # cookie_jar.clear (handled in exploit)
    # Try to access the dashboard or settings page
    settings_res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'help', 'version.php'),
      'keep_cookies' => true
    })
    if settings_res
      doc = settings_res.get_html_document
      # Try to find version in a span, div, or similar element
      version_element = doc.at('//p[@class="frmTextHead"]')
      if version_element
        version_text = version_element.text
        version = version_text.split(':')[1].gsub(' ', '')
        version = Rex::Version.new(version)
        if version < Rex::Version.new('3.2.11p1')
          print_good("ISPConfig version detected: #{version_text}")
          return CheckCode::Appears("Version: #{version_text}")
        end
      end
    end
    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Linksys E1500/E2500 apply.cgi Remote Command Injection
Type: exploit
Path: modules/exploits/linux/http/linksys_e1500_apply_exec.rb
Platform: unix
Disclosure date: 2013-02-05
References: CVE-2018-3953, BID-57760, EDB-24475, OSVDB-89912, URL-http://www.s3cur1ty.de/m1adv2013-004
Targets: CMD, Linux mipsel Payload

Description:
Some Linksys Routers are vulnerable to an authenticated OS command injection.
          Default credentials for the web interface are admin/admin or admin/password. Since
          it is a blind os command injection vulnerability, there is no output for the
          executed command when using the cmd generic payload. A ping command against a
          controlled system could be used for testing purposes.
Metasploit Module: MicroFocus Secure Messaging Gateway Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/microfocus_secure_messaging_gateway.rb
Platform: php
Disclosure date: 2018-06-19
References: URL-https://pentest.blog/unexpected-journey-6-all-ways-lead-to-rome-remote-code-execution-on-microfocus-secure-messaging-gateway/, CVE-2018-12464, CVE-2018-12465, URL-https://support.microfocus.com/kb/doc.php?id=7023132, URL-https://support.microfocus.com/kb/doc.php?id=7023133

Description:
This module exploits a SQL injection and command injection vulnerability in MicroFocus Secure Messaging Gateway.
          An unauthenticated user can execute a terminal command under the context of the web user.

          One of the user supplied parameters of API endpoint is used by the application without input validation and/or parameter binding,
          which leads to SQL injection vulnerability. Successfully exploiting this vulnerability gives a ability to add new user onto system.
          manage_domains_dkim_keygen_request.php endpoint is responsible for executing an operation system command. It's not possible
          to access this endpoint without having a valid session.

          Combining these vulnerabilities gives the opportunity execute operation system commands under the context
          of the web user.

Check method (fingerprinting):
r = rand_text_numeric(15..35)
    res = execute_query("SELECT #{r}")
    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end
    unless res.code == 200 && res.body.include?(r)
      return CheckCode::Safe('The target is not vulnerable')
    end

    CheckCode::Vulnerable('The target is vulnerable')
  end
Metasploit Module: Mutiny 5 Arbitrary File Upload
Type: exploit
Path: modules/exploits/linux/http/mutiny_frontend_upload.rb
Platform: linux
Disclosure date: 2013-05-15
References: CVE-2013-0136, OSVDB-93444, US-CERT-VU-701572, URL-https://www.rapid7.com/blog/post/2013/05/15/new-1day-exploits-mutiny-vulnerabilities

Description:
This module exploits a code execution flaw in the Mutiny 5 appliance. The
          EditDocument servlet provides a file upload function to authenticated users. A
          directory traversal vulnerability in the same functionality allows for arbitrary
          file upload, which results in arbitrary code execution with root privileges. In
          order to exploit the vulnerability a valid user (any role) in the web frontend is
          required. The module has been tested successfully on the Mutiny 5.0-1.07 appliance.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, "interface", "/"),
    })

    if res.nil?
      vprint_error("Connection timed out")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/
      version = $1
    end

    if version and version >= "5" and version <= "5.0-1.07"
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    return Exploit::CheckCode::Safe(version ? "Version #{version} is not vulnerable" : 'The target is not vulnerable')
  end
Metasploit Module: PineApp Mail-SeCure ldapsyncnow.php Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/pineapp_ldapsyncnow_exec.rb
Platform: unix
Disclosure date: 2013-07-26
References: ZDI-13-185, OSVDB-95781

Description:
This module exploits a command injection vulnerability on PineApp Mail-SeCure
          3.70. The vulnerability exists on the ldapsyncnow.php component, due to the insecure
          usage of the shell_exec() php function. This module has been tested successfully
          on PineApp Mail-SeCure 3.70.

Check method (fingerprinting):
# Since atm of writing this exploit there isn't patch available,
    # checking for the vulnerable component should be a reliable test.
    res = send_request_cgi({
      'uri' => my_uri,
      'vars_get' => {
        'sync_now' => '1'
      }
    })
    if res and res.code == 200 and res.body =~ /window\.setTimeout\('loaded\(\)', 2500\);/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: V-CMS PHP File Upload and Execute
Type: exploit
Path: modules/exploits/linux/http/vcms_upload.rb
Platform: php
Disclosure date: 2011-11-27
References: CVE-2011-4828, OSVDB-77183, BID-50706, URL-http://xforce.iss.net/xforce/xfdb/71358
Targets: Generic (PHP Payload), Linux x86

Description:
This module exploits a vulnerability found on V-CMS's inline image upload feature.
          The problem is due to the inline_image_upload.php file not checking the file type
          before saving it on the web server. This allows any malicious user to upload a
          script (such as PHP) without authentication, and then execute it with a GET request.

          The issue is fixed in 1.1 by checking the extension name.  By default, 1.1 only
          allows jpg, jpeg, png, gif, bmp, but it is still possible to upload a PHP file as
          one of those extension names, which may still be leveraged in an attack.

Check method (fingerprinting):
uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    res = send_request_raw({
      'uri' => uri,
      'method' => 'GET'
    })

    if res and res.body =~ /V-CMS v1\.[0-1]/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end