deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Windows Gather User Credentials (phishing)
Type: post
Path: modules/post/windows/gather/phish_windows_credentials.rb
References: URL-https://forsec.nl/2015/02/windows-credentials-phishing-using-metasploit

Description:
This module is able to perform a phishing attack on the target by popping up a loginprompt.
          When the user fills credentials in the loginprompt, the credentials will be sent to the attacker.
          The module is able to monitor for new processes and popup a loginprompt when a specific process is starting. Tested on Windows 7.
Metasploit Module: Windows Gather Active Directory Computers
Type: post
Path: modules/post/windows/gather/enum_ad_computers.rb
References: URL-http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx

Description:
This module will enumerate computers in the default AD directory.

          Optional Attributes to use in ATTRIBS:
          objectClass, cn, description, distinguishedName, instanceType, whenCreated,
          whenChanged, uSNCreated, uSNChanged, name, objectGUID,
          userAccountControl, badPwdCount, codePage, countryCode,
          badPasswordTime, lastLogoff, lastLogon, localPolicyFlags,
          pwdLastSet, primaryGroupID, objectSid, accountExpires,
          logonCount, sAMAccountName, sAMAccountType, operatingSystem,
          operatingSystemVersion, operatingSystemServicePack, serverReferenceBL,
          dNSHostName, rIDSetPreferences, servicePrincipalName, objectCategory,
          netbootSCPBL, isCriticalSystemObject, frsComputerReferenceBL,
          lastLogonTimestamp, msDS-SupportedEncryptionTypes

          ActiveDirectory has a MAX_SEARCH limit of 1000 by default. Split search up
          if you hit that limit.

          Possible filters:
          (objectClass=computer) # All Computers
          (primaryGroupID=516)  # All Domain Controllers
          (&(objectCategory=computer)(operatingSystem=*server*)) # All Servers
Metasploit Module: Windows Gather Local and Domain Controller Account Password Hashes
Type: post
Path: modules/post/windows/gather/smart_hashdump.rb

Description:
This will dump local accounts from the SAM Database. If the target
          host is a Domain Controller, it will dump the Domain Account Database using the proper
          technique depending on privilege level, OS and role of the host.
Metasploit Module: Windows Enumerate LSA Secrets
Type: post
Path: modules/post/windows/gather/lsa_secrets.rb
Platform: win
Authors: Rob Bathurst <rob.bathurst[at]foundstone.com>

Description:
This module will attempt to enumerate the LSA Secrets keys within the registry. The registry value used is:
          HKEY_LOCAL_MACHINE\Security\Policy\Secrets\. Thanks goes to Maurizio Agazzini and Mubix for decrypt
          code from cachedump.
Metasploit Module: Windows Gather Bitcoin Wallet
Type: post
Path: modules/post/windows/gather/bitcoin_jacker.rb

Description:
This module downloads any Bitcoin wallet files from the target
          system. It currently supports both the classic Satoshi wallet and the
          more recent Armory wallets. Note that Satoshi wallets tend to be
          unencrypted by default, while Armory wallets tend to be encrypted by default.
Metasploit Module: Windows Gather SNMP Settings
Type: post
Path: modules/post/windows/gather/enum_snmp.rb
References: MSB-MS00-096, URL-https://docs.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-096

Description:
This module will enumerate the SNMP service configuration.
Metasploit Module: Advanced Browser Data Extraction for Chromium and Gecko Browsers
Type: post
Path: modules/post/windows/gather/enum_browsers.rb
Platform: win
Authors: Alexander "xaitax" Hagenah

Description:
This post-exploitation module extracts sensitive browser data from both Chromium-based and Gecko-based browsers
          on the target system. It supports the decryption of passwords and cookies using Windows Data Protection API (DPAPI)
          and can extract additional data such as browsing history, keyword search history, download history, autofill data,
          credit card information, browser cache and installed extensions.
Metasploit Module: Windows Gather Enumerate Domain Group
Type: post
Path: modules/post/windows/gather/enum_domain_group_users.rb

Description:
This module extracts user accounts from the specified domain group
          and stores the results in the loot. It will also verify if session
          account is in the group. Data is stored in loot in a format that
          is compatible with the token_hunter plugin. This module must be
          run on a session running as a domain user.
Metasploit Module: Windows Gather Enumerate Domain Tokens
Type: post
Path: modules/post/windows/gather/enum_domain_tokens.rb

Description:
This module enumerates domain account tokens, processes running under
          domain accounts, and domain users in the local Administrators, Users
          and Backup Operator groups.
Metasploit Module: Windows Gather Virtual Environment Detection
Type: post
Path: modules/post/windows/gather/checkvm.rb
References: URL-https://handlers.sans.org/tliston/ThwartingVMDetection_Liston_Skoudis.pdf, URL-https://www.heise.de/security/downloads/07/1/1/8/3/5/5/9/vmde.pdf, URL-https://evasions.checkpoint.com/techniques/registry.html

Description:
This module attempts to determine whether the system is running
          inside of a virtual environment and if so, which one. This
          module supports detection of Hyper-V, VMWare, VirtualBox, Xen, QEMU,
          and Parallels.
Metasploit Module: Windows Gather Microsoft Office Trusted Locations
Type: post
Path: modules/post/windows/gather/enum_trusted_locations.rb

Description:
This module will enumerate the Microsoft Office trusted locations on the target host.
Metasploit Module: AD Computer, Group and Recursive User Membership to Local SQLite DB
Type: post
Path: modules/post/windows/gather/ad_to_sqlite.rb

Description:
This module will gather a list of AD groups, identify the users (taking into account recursion)
          and write this to a SQLite database for offline analysis and query using normal SQL syntax.
Metasploit Module: Windows Gather Active Directory BitLocker Recovery
Type: post
Path: modules/post/windows/gather/enum_ad_bitlocker.rb
Platform: win
Authors: Ben Campbell <ben.campbell[at]mwrinfosecurity.com>
References: URL-https://technet.microsoft.com/en-us/library/cc771778%28v=ws.10%29.aspx

Description:
This module will enumerate BitLocker recovery passwords in the default AD
          directory. This module does require Domain Admin or other delegated privileges.
Metasploit Module: Post Windows Gather NTDS.DIT Location
Type: post
Path: modules/post/windows/gather/ntds_location.rb
Platform: win
Authors: Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>

Description:
This module will find the location of the NTDS.DIT file (from the Registry),
          check that it exists, and display its location on the screen, which is useful
          if you wish to manually acquire the file using ntdsutil or vss.
Metasploit Module: Windows Gather Directory Permissions Enumeration
Type: post
Path: modules/post/windows/gather/enum_dirperms.rb
Platform: win

Description:
This module enumerates directories and lists the permissions set
          on found directories. Please note: if the PATH option isn't specified,
          then the module will start enumerate whatever is in the target machine's
          %PATH% variable.
Metasploit Module: Bookmarked Sites Retriever
Type: post
Path: modules/post/windows/gather/get_bookmarks.rb

Description:
This module discovers information about a target by retrieving their bookmarked websites on Google Chrome, Opera and Microsoft Edge.
Metasploit Module: OneDrive Sync Provider Enumeration Module
Type: post
Path: modules/post/windows/gather/enum_onedrive.rb
Platform: win
Authors: Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>

Description:
This module will identify the Office 365 OneDrive endpoints for both business and personal accounts
          across all users (providing access is permitted). It is useful for identifying document libraries
          that may otherwise not be obvious which could contain sensitive or useful information.
Metasploit Module: Windows Gather Logged On User Enumeration (Registry)
Type: post
Path: modules/post/windows/gather/enum_logged_on_users.rb

Description:
This module will enumerate current and recently logged on Windows users.
Metasploit Module: Windows Active Directory Wordlist Builder
Type: post
Path: modules/post/windows/gather/enum_ad_to_wordlist.rb
Platform: win
Authors: Thomas Ring

Description:
This module will gather information from the default Active Domain (AD) directory
          and use these words to seed a wordlist. By default it enumerates user accounts to
          build the wordlist.
Metasploit Module: NTDS Grabber
Type: post
Path: modules/post/windows/gather/ntds_grabber.rb
Authors: Koen Riepe (koen.riepe@fox-it.com)

Description:
This module uses a powershell script to obtain a copy of the ntds,dit SAM and SYSTEM files on a domain controller.
          It compresses all these files in a cabinet file called All.cab.
Metasploit Module: Windows Gather Local User Account SID Lookup
Type: post
Path: modules/post/windows/gather/resolve_sid.rb

Description:
This module prints information about a given SID from the perspective
          of this session.
Metasploit Module: Windows Gather Prefetch File Information
Type: post
Path: modules/post/windows/gather/enum_prefetch.rb
Platform: win
Authors: TJ Glad <tjglad[at]cmail.nu>

Description:
This module gathers prefetch file information from WinXP, Win2k3 and Win7 systems
          and current values of related registry keys. From each prefetch file we'll collect
          filetime (converted to utc) of the last execution, file path hash, run count, filename
          and the execution path.
Metasploit Module: Windows Gather Applied Patches
Type: post
Path: modules/post/windows/gather/enum_patches.rb
Platform: win
References: URL-http://msdn.microsoft.com/en-us/library/aa394391(v=vs.85).aspx

Description:
This module enumerates patches applied to a Windows system using the
          WMI query: SELECT HotFixID, InstalledOn FROM Win32_QuickFixEngineering.
Metasploit Module: Avast AV Memory Dumping Utility
Type: post
Path: modules/post/windows/gather/avast_memory_dump.rb

Description:
This module leverages an Avast Anti-Virus memory dump utility that is shipped
          by default with Avast Anti-Virus Home software suite.
Metasploit Module: Windows Gather Terminal Server Client Connection Information Dumper
Type: post
Path: modules/post/windows/gather/enum_termserv.rb

Description:
This module dumps MRU and connection data for RDP sessions.
Metasploit Module: Windows Gather DNS Cache
Type: post
Path: modules/post/windows/gather/dnscache_dump.rb

Description:
This module displays the records stored in the DNS cache.
Metasploit Module: Windows Gather Dump Recent Files lnk Info
Type: post
Path: modules/post/windows/gather/dumplinks.rb

Description:
The dumplinks module is a modified port of Harlan Carvey's lslnk.pl Perl script.
          This module will parse .lnk files from a user's Recent Documents folder
          and Microsoft Office's Recent Documents folder, if present.
          Windows creates these link files automatically for many common file types.
          The .lnk files contain time stamps, file locations, including share
          names, volume serial numbers, and more.
Metasploit Module: Windows Gather Process Memory Grep
Type: post
Path: modules/post/windows/gather/memory_grep.rb
Platform: win
Authors: bannedit

Description:
This module allows for searching the memory space of a process for potentially
          sensitive data.  Please note: When the HEAP option is enabled, the module will have
          to migrate to the process you are grepping, and will not migrate back automatically.
          This means that if the user terminates the application after using this module, you
          may lose your session.
Metasploit Module: Windows Gather Run WMIC Commands
Type: post
Path: modules/post/windows/gather/wmic_command.rb

Description:
This module executes WMIC commands on the specified host.
Metasploit Module: Windows Gather Exchange Server Mailboxes
Type: post
Path: modules/post/windows/gather/exchange.rb
References: URL-https://github.com/sophoslabs/metasploit_gather_exchange, URL-https://news.sophos.com/en-us/2021/03/09/sophoslabs-offensive-security-releases-post-exploitation-tool-for-exchange/

Description:
This module will gather information from an on-premise Exchange Server running on the target machine.

          Two actions are supported:
          LIST (default action): List basic information about all Exchange servers and mailboxes hosted on the target.
          EXPORT: Export and download a chosen mailbox in the form of a .PST file, with support for an optional filter keyword.

          For a list of valid filters, see https://docs.microsoft.com/en-us/exchange/filterable-properties-for-the-contentfilter-parameter

          The executing user has to be assigned to the "Organization Management" role group for the module to successfully run.

          Tested on Exchange Server 2010 on Windows Server 2012 R2 and Exchange Server 2016 on Windows Server 2016.
Metasploit Module: Windows Gather Enumerate Active Domain Users
Type: post
Path: modules/post/windows/gather/enum_domain_users.rb

Description:
This module will enumerate computers included in the primary Domain and attempt
          to list all locations the targeted user has sessions on. If the HOST option is specified
          the module will target only that host. If the HOST is specified and USER is set to nil, all users
          logged into that host will be returned.'
Metasploit Module: Windows Gather Enumerate Domain
Type: post
Path: modules/post/windows/gather/enum_domain.rb
Platform: win
Authors: Joshua Abraham <jabra[at]rapid7.com>

Description:
This module identifies the primary Active Directory domain name
          and domain controller.
Metasploit Module: Windows Gather File and Registry Artifacts Enumeration
Type: post
Path: modules/post/windows/gather/enum_artifacts.rb

Description:
This module will check the file system and registry for particular artifacts.

          The list of artifacts is read in YAML format from data/post/enum_artifacts_list.txt
          or a user specified file. Any matches are written to the loot.
Metasploit Module: Windows File Gather File from Raw NTFS
Type: post
Path: modules/post/windows/gather/file_from_raw_ntfs.rb
Platform: win
Authors: Danil Bazin <danil.bazin[at]hsc.fr>
References: URL-http://www.amazon.com/System-Forensic-Analysis-Brian-Carrier/dp/[PII_REDACTED]/

Description:
This module gathers a file using the raw NTFS device, bypassing some Windows restrictions
          such as open file with write lock. Because it avoids the usual file locking issues, it can
          be used to retrieve files such as NTDS.dit.
Metasploit Module: Windows Gather ARP Scanner
Type: post
Path: modules/post/windows/gather/arp_scanner.rb

Description:
This module will perform an ARP scan for a given IP range through a
          Meterpreter session.
Metasploit Module: Windows Gather Deleted Files Enumeration and Recovering
Type: post
Path: modules/post/windows/gather/forensics/recovery_files.rb
Platform: win
Authors: Borja Merino <bmerinofe[at]gmail.com>
References: URL-https://www.youtube.com/watch?v=9yzCf360ujY&hd=1

Description:
This module lists and attempts to recover deleted files from NTFS file systems. Use
          the FILES option to guide recovery. Leave this option empty to enumerate deleted files in the
          DRIVE. Set FILES to an extension (e.g., "pdf") to recover deleted files with that
          extension, or set FILES to a comma separated list of IDs (from enumeration) to
          recover those files. The user must have account file enumeration. Recovery
          may take a long time; use the TIMEOUT option to abort enumeration or recovery by
          extension after a specified period (in seconds).
Metasploit Module: Windows Gather Forensics Duqu Registry Check
Type: post
Path: modules/post/windows/gather/forensics/duqu_check.rb
References: CVE-2011-3402, URL-http://r-7.co/w5h7fY

Description:
This module searches for CVE-2011-3402 (Duqu) related registry artifacts.
Metasploit Module: Windows Gather Local NBD Server
Type: post
Path: modules/post/windows/gather/forensics/nbd_server.rb
Platform: win
Authors: Wesley McGrew <wesley[at]mcgrewsecurity.com>

Description:
Maps remote disks and logical volumes to a local Network Block Device server.
          Allows for forensic tools to be executed on the remote disk directly.
Metasploit Module: Windows Gather Forensic Imaging
Type: post
Path: modules/post/windows/gather/forensics/imager.rb
Platform: win
Authors: Wesley McGrew <wesley[at]mcgrewsecurity.com>

Description:
This module will perform byte-for-byte imaging of remote disks and volumes.
Metasploit Module: Windows Gather Physical Drives and Logical Volumes
Type: post
Path: modules/post/windows/gather/forensics/enum_drives.rb
Platform: win
Authors: Wesley McGrew <wesley[at]mcgrewsecurity.com>

Description:
This module will list physical drives and logical volumes
Metasploit Module: Windows Gather Skype, Firefox, and Chrome Artifacts
Type: post
Path: modules/post/windows/gather/forensics/browser_history.rb
Platform: %w[win

Description:
Gathers Skype chat logs, Firefox history, and Chrome history data from the target machine.
Metasploit Module: FannyBMP or DementiaWheel Detection Registry Check
Type: post
Path: modules/post/windows/gather/forensics/fanny_bmp_check.rb
Platform: win
Authors: William M.
References: URL-https://securelist.com/a-fanny-equation-i-am-your-father-stuxnet/68787, CVE-2010-2568

Description:
This module searches for the Fanny.bmp worm related reg keys.
          fannybmp is a worm that exploited zero day vulns
          (more specifically, the LNK Exploit CVE-2010-2568).
          Which allowed it to spread even if USB Autorun was turned off.
          This is the same exploit that was used in StuxNet.
Metasploit Module: Windows Gather Trillian Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/trillian.rb

Description:
This module extracts account password from Trillian & Trillian Astra
          v4.x-5.x instant messenger.
Metasploit Module: McAfee Virus Scan Enterprise Password Hashes Dump
Type: post
Path: modules/post/windows/gather/credentials/mcafee_vse_hashdump.rb
References: URL-https://www.dionach.com/blog/disabling-mcafee-on-access-scanning

Description:
This module extracts the password hash from McAfee Virus Scan Enterprise (VSE)
          used to lock down the user interface. Hashcat supports cracking this type of
          hash using hash type sha1($salt.unicode($pass)) (-m 140) and a hex salt
          (--hex-salt) of 01000f000d003300 (unicode "\x01\x0f\x0d\x33"). A dynamic
          format is available for John the Ripper at the referenced URL.
Metasploit Module: Windows Gather mRemote Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/mremote.rb

Description:
This module extracts saved passwords from mRemote. mRemote stores
          connections for RDP, VNC, SSH, Telnet, rlogin and other protocols. It saves
          the passwords in an encrypted format. The module will extract the connection
          info and decrypt the saved passwords.
Metasploit Module: Windows Gather CoreFTP Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/coreftp.rb
Authors: theLightCosine

Description:
This module extracts saved passwords from the CoreFTP FTP client. These
          passwords are stored in the registry. They are encrypted with AES-128-ECB.
          This module extracts and decrypts these passwords.
Metasploit Module: Windows Gather Google Picasa Password Extractor
Type: post
Path: modules/post/windows/gather/credentials/enum_picasa_pwds.rb

Description:
This module extracts and decrypts the login passwords
          stored by Google Picasa.
Metasploit Module: Windows Gather Total Commander Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/total_commander.rb

Description:
This module extracts weakly encrypted saved FTP Passwords from Total Commander.
          It finds saved FTP connections in the wcx_ftp.ini file.
Metasploit Module: Windows Gather Local SQL Server Hash Dump
Type: post
Path: modules/post/windows/gather/credentials/mssql_local_hashdump.rb
References: URL-https://www.dionach.com/blog/easily-grabbing-microsoft-sql-server-password-hashes

Description:
This module extracts the usernames and password
          hashes from an MSSQL server and stores them as loot. It uses the
          same technique in mssql_local_auth_bypass.
Metasploit Module: Windows Live Mail Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/windowslivemail.rb
Platform: win

Description:
This module searches for Windows Live Mail credentials on a Windows host.
Metasploit Module: Windows Domain Controller Hashdump
Type: post
Path: modules/post/windows/gather/credentials/domain_hashdump.rb
Authors: theLightCosine

Description:
This module attempts to copy the NTDS.dit database from a live Domain Controller
          and then parse out all of the User Accounts. It saves all of the captured password
          hashes, including historical ones.
Metasploit Module: Incredimail Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/incredimail.rb
Platform: win

Description:
This module searches for Incredimail credentials on a Windows host.
Metasploit Module: CarotDAV Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/carotdav_ftp.rb
Platform: win

Description:
This module searches for credentials stored on CarotDAV FTP Client on a Windows host.
Metasploit Module: Windows Gather WinSCP Saved Password Extraction
Type: post
Path: modules/post/windows/gather/credentials/winscp.rb

Description:
This module extracts weakly encrypted saved passwords from
          WinSCP. It searches for saved sessions in the Windows Registry
          and the WinSCP.ini file. It cannot decrypt passwords if a master
          password is used.
Metasploit Module: QQ Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/qq.rb
Platform: win

Description:
This module searches for QQ credentials on a Windows host.
Metasploit Module: LINE Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/line.rb
Platform: win

Description:
This module searches for credentials in LINE desktop application on a Windows host. LINE is the most popular Instant Messenger app in Japan.
Metasploit Module: Delinea Thycotic Secret Server Dump
Type: post
Path: modules/post/windows/gather/credentials/thycotic_secretserver_dump.rb
Disclosure date: 2022-08-15
Authors: npm[at]cesium137.io
References: URL-https://github.com/denandz/SecretServerSecretStealer

Description:
This module exports and decrypts Secret Server credentials to a CSV file;
          it is intended as a post-exploitation module for Windows hosts with Delinea/Thycotic
          Secret Server installed. Master Encryption Key (MEK) and associated IV values are
          decrypted from encryption.config using a static key baked into the software. The
          module also supports parameter recovery for encryption configs configured with
          Windows DPAPI.
Metasploit Module: Maxthon Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/maxthon.rb
Platform: win

Description:
This module searches for Maxthon credentials on a Windows host.
Metasploit Module: Seamonkey Credential Gatherer
Type: post
Path: modules/post/windows/gather/credentials/seamonkey.rb
Platform: win

Description:
This module searches for seamonkey credentials on a Windows host.