deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Microsoft Windows Deployment Services Unattend Gatherer
Type: auxiliary
Path: modules/auxiliary/gather/windows_deployment_services_shares.rb
References: URL-http://technet.microsoft.com/en-us/library/cc749415(v=ws.10).aspx, URL-http://rewtdance.blogspot.com/2012/11/windows-deployment-services-clear-text.html

Description:
This module will search remote file shares for unattended installation files that may contain
          domain credentials. This is often used after discovering domain credentials with the
          auxiliary/scanner/dcerpc/windows_deployment_services module or in cases where you already
          have domain credentials. This module will connect to the RemInst share and any Microsoft
          Deployment Toolkit shares indicated by the share name comments.
Metasploit Module: Samsung Internet Browser SOP Bypass
Type: auxiliary
Path: modules/auxiliary/gather/samsung_browser_sop_bypass.rb
Disclosure date: 2017-11-08
References: CVE-2017-17692, URL-http://fr.0day.today/exploit/description/28434

Description:
This module takes advantage of a Same-Origin Policy (SOP) bypass vulnerability in the
          Samsung Internet Browser, a popular mobile browser shipping with Samsung Android devices.
          By default, it initiates a redirect to a child tab, and rewrites the innerHTML to gather
          credentials via a fake pop-up.
Metasploit Module: Apple OSX/iOS/Windows Safari Non-HTTPOnly Cookie Theft
Type: auxiliary
Path: modules/auxiliary/gather/apple_safari_ftp_url_cookie_theft.rb
Disclosure date: 2015-04-08
References: CVE-2015-1126, URL-https://seclists.org/fulldisclosure/2015/Apr/30

Description:
A vulnerability exists in versions of OSX, iOS, and Windows Safari released
          before April 8, 2015 that allows the non-HTTPOnly cookies of any
          domain to be stolen.
Metasploit Module: Adobe ColdFusion Unauthenticated Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/adobe_coldfusion_fileread_cve_2023_26360.rb
References: CVE-2023-26360, URL-https://attackerkb.com/topics/F36ClHTTIQ/cve-2023-26360/rapid7-analysis

Description:
This module exploits a remote unauthenticated deserialization of untrusted data vulnerability in Adobe
          ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier, in order to read
          an arbitrary file from the server.

          To run this module you must provide a valid ColdFusion Component (CFC) endpoint via the CFC_ENDPOINT option,
          and a valid remote method name from that endpoint via the CFC_METHOD option. By default an endpoint in the
          ColdFusion Administrator (CFIDE) is provided. If the CFIDE is not accessible you will need to choose a
          different CFC endpoint, method and parameters.
Metasploit Module: WordPress Ultimate CSV Importer User Table Extract
Type: auxiliary
Path: modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb
Disclosure date: 2015-02-02

Description:
Due to lack of verification of a visitor's permissions, it is possible
          to execute the 'export.php' script included in the default installation of the
          Ultimate CSV Importer plugin and retrieve the full contents of the user table
          in the WordPress installation. This results in full disclosure of usernames,
          hashed passwords and email addresses for all users.

Check method (fingerprinting):
check_plugin_version_from_readme('wp-ultimate-csv-importer', '3.6.7' '3.6.0')
  end
Metasploit Module: Citrix MetaFrame ICA Published Applications Scanner
Type: auxiliary
Path: modules/auxiliary/gather/citrix_published_applications.rb
References: URL-http://www.securiteam.com/exploits/5CP0B1F80S.html

Description:
This module attempts to query Citrix Metaframe ICA server to obtain
          a published list of applications.
Metasploit Module: TeamTalk Gather Credentials
Type: auxiliary
Path: modules/auxiliary/gather/teamtalk_creds.rb
Authors: bcoles
References: URL-https://github.com/BearWare/TeamTalk5/blob/master/ttphpadmin/tt5admin.php

Description:
This module retrieves user credentials from BearWare TeamTalk.

          Valid administrator credentials are required.

          This module has been tested successfully on TeamTalk versions
          5.2.2.4885 and 5.2.3.4893.
Metasploit Module: NIS ypserv Map Dumper
Type: auxiliary
Path: modules/auxiliary/gather/nis_ypserv_map.rb
Authors: wvu
References: URL-https://datatracker.ietf.org/doc/html/rfc1831, URL-https://datatracker.ietf.org/doc/html/rfc4506

Description:
This module dumps the specified map from NIS ypserv.

          The following examples are from ypcat -x:

          Use "ethers"    for map "ethers.byname"
          Use "aliases"   for map "mail.aliases"
          Use "services"  for map "services.byname"
          Use "protocols" for map "protocols.bynumber"
          Use "hosts"     for map "hosts.byname"
          Use "networks"  for map "networks.byaddr"
          Use "group"     for map "group.byname"
          Use "passwd"    for map "passwd.byname"

          You may specify a map by one of the nicknames above.
Metasploit Module: Jenkins cli Ampersand Replacement Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/gather/jenkins_cli_ampersand_arbitrary_file_read.rb
Disclosure date: 2024-01-24
References: URL-https://www.jenkins.io/security/advisory/2024-01-24/, URL-https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/, URL-https://github.com/binganao/CVE-2024-23897, URL-https://github.com/h4x0r-dz/CVE-2024-23897, URL-https://github.com/Vozec/CVE-2024-23897, CVE-2024-23897

Description:
This module utilizes the Jenkins cli protocol to run the `help` command.
          The cli is accessible with read-only permissions by default, which are
          all thats required.

          Jenkins cli utilizes `args4j's` `parseArgument`, which calls `expandAtFiles` to
          replace any `@<filename>` with the contents of a file. We are then able to retrieve
          the error message to read up to the first two lines of a file.

          Exploitation by hand can be done with the cli, see markdown documents for additional
          instructions.

          There are a few exploitation oddities:
          1. The injection point for the `help` command requires 2 input arguments.
          When the `expandAtFiles` is called, each line of the `FILE_PATH` becomes an input argument.
          If a file only contains one line, it will throw an error: `ERROR: You must authenticate to access this Jenkins.`
          However, we can pad out the content by supplying a first argument.
          2. There is a strange timing requirement where the `download` (or first) request must get
          to the server first, but the `upload` (or second) request must be very close behind it.
          From testing against the docker image, it was found values between `.01` and `1.9` were
          viable. Due to the round trip time of the first request and response happening before
          request 2 would be received, it is necessary to use threading to ensure the requests
          happen within rapid succession.

          Files of value:
          * /var/jenkins_home/secret.key
          * /var/jenkins_home/secrets/master.key
          * /var/jenkins_home/secrets/initialAdminPassword
          * /etc/passwd
          * /etc/shadow
          * Project secrets and credentials
          * Source code, build artifacts

Check method (fingerprinting):
version = jenkins_version

    return Exploit::CheckCode::Safe('Unable to determine Jenkins version number') if version.blank?

    version = Rex::Version.new(version)

    if version <= Rex::Version.new('2.426.2') || # LTS check
       (version >= Rex::Version.new('2.427') && version <= Rex::Version.new('2.441')) # non-lts
      return Exploit::CheckCode::Appears("Found exploitable version: #{version}")
    end

    Exploit::CheckCode::Safe("Found non-exploitable version: #{version}")
  end
Metasploit Module: Camaleon CMS Directory Traversal CVE-2024-46987
Type: auxiliary
Path: modules/auxiliary/gather/camaleon_download_private_file.rb
Platform: linux
Disclosure date: 2024-08-08
References: CVE-2024-46987

Description:
Exploits CVE-2024-46987, an authenticated directory traversal
          vulnerability in Camaleon CMS versions <= 2.8.0 and 2.9.0

Check method (fingerprinting):
cookie_jar.clear

    authenticate(datastore['USERNAME'], datastore['PASSWORD'])

    version = get_version

    if version.nil?
      return Exploit::CheckCode::Unknown('Failed to get build version')
    elsif vuln_version?(version) != true
      return Exploit::CheckCode::Safe('Camaleon CMS version is not vulnerable')
    end

    res = get_file(datastore['FILEPATH'])

    if res.nil? || res == false || !res.is_a?(String)
      print_error('Failed to obtain file')
      return Exploit::CheckCode::Appears('Camaleon CMS version appears vulnerable but file download failed')
    end

    Exploit::CheckCode::Vulnerable('Successfully downloaded private file from Camaleon CMS')
  end
Metasploit Module: AVTECH 744 DVR Account Information Retrieval
Type: auxiliary
Path: modules/auxiliary/gather/avtech744_dvr_accounts.rb

Description:
This module will extract the account information from the AVTECH 744 DVR devices,
          including usernames, cleartext passwords, and the device PIN, along with
          a few other miscellaneous details. In order to extract the information, hardcoded
          credentials admin/admin are used. These credentials can't be changed from the device
          console UI nor from the web UI.
Metasploit Module: ManageEngine DataSecurity Plus Xnode Enumeration
Type: auxiliary
Path: modules/auxiliary/gather/manageengine_datasecurity_plus_xnode_enum.rb
References: CVE-2020-11532

Description:
This module exploits default admin credentials for the DataEngine
        Xnode server in DataSecurity Plus versions prior to 6.0.1 (6011)
        in order to dump the contents of Xnode data repositories (tables),
        which may contain (a limited amount of) Active Directory
        information including domain names, host names, usernames and SIDs.
        This module can also be used against patched DataSecurity Plus
        versions if the correct credentials are provided.

        By default, this module dumps only the data repositories and fields
        (columns) specified in the configuration file (set via the
        CONFIG_FILE option). The configuration file is also used to
        add labels to the values sent by Xnode in response to a query.

        It is also possible to use the DUMP_ALL option to obtain all data
        in all known data repositories without specifying data field names.
        However, note that when using the DUMP_ALL option, the data won't be labeled.

        This module has been successfully tested against ManageEngine
        DataSecurity Plus 6.0.1 (6010) running on Windows Server 2012 R2.

Check method (fingerprinting):
# create a socket
    res_code, sock_or_msg = create_socket_for_xnode(rhost, rport)
    if res_code == 1
      return Exploit::CheckCode::Unknown(sock_or_msg)
    end

    @sock = sock_or_msg

    # perform basic checks to see if Xnode is running and if so, if it is exploitable
    res_code, res_msg = xnode_check(@sock, username, password)
    case res_code
    when 0
      return Exploit::CheckCode::Appears(res_msg)
    when 1
      return Exploit::CheckCode::Safe(res_msg)
    when 2
      return Exploit::CheckCode::Unknown(res_msg)
    else
      return Exploit::CheckCode::Unknown('An unexpected error occurred whilst running this module. Please raise a bug ticket!')
    end
  end

  # noinspection RubyMismatchedArgumentType
Metasploit Module: Gladinet CentreStack/Triofox Path Traversal
Type: auxiliary
Path: modules/auxiliary/gather/gladinet_storage_path_traversal_cve_2025_11371.rb
Disclosure date: 2025-04-03
References: CVE-2025-11371, URL-https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild

Description:
This module exploits a path traversal vulnerability (CVE-2025-11371) in
          Gladinet CentreStack and Triofox that allows an unauthenticated attacker to read
          arbitrary files from the server's file system.

          The vulnerability exists in the `/storage/t.dn` endpoint which does not properly
          sanitize the `s` parameter, allowing path traversal attacks. This can be used
          to read sensitive files such as Web.config which contains the machineKey used for
          ViewState deserialization attacks (CVE-2025-30406).

          Gladinet CentreStack versions up to 16.10.10408.56683 are vulnerable.
          Gladinet Triofox versions up to 16.10.10408.56683 are vulnerable.

Check method (fingerprinting):
version = gladinet_version
    return Exploit::CheckCode::Detected('Gladinet detected but version could not be determined') if version.nil?

    rex_version = Rex::Version.new(version)
    return Exploit::CheckCode::Vulnerable("Path traversal vulnerability confirmed (Build #{version})") if rex_version <= Rex::Version.new('16.10.10408.56683')

    Exploit::CheckCode::Detected("Version #{version} detected, attempting path traversal anyway")
  end
Metasploit Module: osTicket Arbitrary File Read via PHP Filter Chains in mPDF
Type: auxiliary
Path: modules/auxiliary/gather/osticket_arbitrary_file_read.rb
Disclosure date: 2026-01-13
References: CVE-2026-22200, URL-https://horizon3.ai/attack-research/attack-blogs/ticket-to-shell-exploiting-php-filters-and-cnext-in-osticket-cve-2026-22200, URL-https://github.com/horizon3ai/CVE-2026-22200/tree/main

Description:
This module exploits an arbitrary file read vulnerability in osTicket
          (CVE-2026-22200). The vulnerability exists in osTicket's PDF export
          functionality which uses mPDF. By injecting a specially crafted HTML payload
          containing PHP filter chain URIs into a ticket reply, an attacker can read
          arbitrary files from the server when the ticket is exported to PDF.

          The PHP filter chain constructs a BMP image header that is prepended to the
          target file contents. When mPDF renders the ticket as a PDF, it processes
          the php://filter URI, reads the target file, and embeds it as a bitmap image
          in the resulting PDF. The module then extracts the file contents from the PDF.

          Authentication is required. The module supports both staff panel (/scp/) and
          client portal login. An existing ticket number is also required.

          Default files extracted are /etc/passwd and include/ost-config.php. The
          osTicket config file contains database credentials and the SECRET_SALT value.

Check method (fingerprinting):
begin
      res = send_request_cgi!(
        { 'method' => 'GET', 'uri' => normalize_uri(datastore['TARGETURI']) },
        20,
        datastore['MAX_REDIRECTS']
      )
    rescue ::Rex::ConnectionError, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Errno::ETIMEDOUT => e
      return Exploit::CheckCode::Unknown("Could not connect to target: #{e.message}")
    end

    return Exploit::CheckCode::Unknown('No response from target') unless res

    return Exploit::CheckCode::Safe('Target does not appear to be an osTicket installation') unless osticket?(res)

    Exploit::CheckCode::Detected('Target appears to be an osTicket installation')
  end
Metasploit Module: Advantech WebAccess 8.1 Post Authentication Credential Collector
Type: auxiliary
Path: modules/auxiliary/gather/advantech_webaccess_creds.rb
Disclosure date: 2017-01-21
References: CVE-2016-5810, URL-https://github.com/rapid7/metasploit-framework/pull/7859#issuecomment-274305229

Description:
This module allows you to log into Advantech WebAccess 8.1, and collect all of the credentials.
          Although authentication is required, any level of user permission can exploit this vulnerability.

          Note that 8.2 is not suitable for this.
Metasploit Module: MS15-018 Microsoft Internet Explorer 10 and 11 Cross-Domain JavaScript Injection
Type: auxiliary
Path: modules/auxiliary/gather/ie_uxss_injection.rb
Platform: win
Disclosure date: 2015-02-01
References: CVE-2015-0072, OSVDB-117876, MSB-MS15-018, URL-http://innerht.ml/blog/ie-uxss.html, URL-https://seclists.org/fulldisclosure/2015/Feb/10

Description:
This module exploits a universal cross-site scripting (UXSS) vulnerability found in Internet
          Explorer 10 and 11. By default, you will steal the cookie from TARGET_URI (which cannot
          have X-Frame-Options or it will fail). You can also have your own custom JavaScript
          by setting the CUSTOMJS option. Lastly, you might need to configure the URIHOST option if
          you are behind NAT.
Metasploit Module: DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials
Type: auxiliary
Path: modules/auxiliary/gather/doliwamp_traversal_creds.rb
Disclosure date: 2014-01-12
Authors: bcoles
References: URL-https://doliforge.org/tracker/?func=detail&aid=1212&group_id=144, URL-https://github.com/Dolibarr/dolibarr/commit/8642e2027c840752c4357c4676af32fe342dc0cb

Description:
This module will extract user credentials from DoliWamp - a WAMP
          packaged installer distribution for Dolibarr ERP on Windows - versions
          3.3.0 to 3.4.2 by hijacking a user's session. DoliWamp stores session
          tokens in filenames in the 'tmp' directory. A directory traversal
          vulnerability in 'jqueryFileTree.php' allows unauthenticated users
          to retrieve session tokens by listing the contents of this directory.
          Note: All tokens expire after 30 minutes of inactivity by default.

Check method (fingerprinting):
get_session_tokens ? Exploit::CheckCode::Vulnerable('Session tokens found in tmp directory') : Exploit::CheckCode::Safe('No session tokens found in tmp directory')
  end
Metasploit Module: Android Browser File Theft
Type: auxiliary
Path: modules/auxiliary/gather/android_browser_file_theft.rb
References: URL-https://android.googlesource.com/platform/packages/apps/Browser/+/d2391b492dec778452238bc6d9d549d56d41c107%5E%21/#F0, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=90222

Description:
This module steals the cookie, password, and autofill databases from the
          Browser application on AOSP 4.3 and below.
Metasploit Module: Twonky Server Log Leak Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/gather/twonky_authbypass_logleak.rb
References: CVE-2025-13315, CVE-2025-13316, URL-https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed/

Description:
This module leverages an authentication bypass in Twonky Server 8.5.2. By exploiting
          an authorization flaw to access a privileged web API endpoint and leak application logs,
          encrypted administrator credentials are leaked (CVE-2025-13315). The exploit will then decrypt
          these credentials using hardcoded keys (CVE-2025-13316) and login as the administrator.
          Expected module output is a username and plain text password for the administrator account.
Metasploit Module: Xymon Daemon Gather Information
Type: auxiliary
Path: modules/auxiliary/gather/xymon_info.rb
References: CVE-2016-2055, URL-http://web.archive.org/web/[PII_REDACTED]4648/https://lists.xymon.com/pipermail/xymon/2016-February/042986.html, URL-https://xymon.sourceforge.net/, URL-https://en.wikipedia.org/wiki/Xymon, URL-https://en.wikipedia.org/wiki/Big_Brother_(software)

Description:
This module retrieves information from a Xymon daemon service
        (formerly Hobbit, based on Big Brother), including server
        configuration information, a list of monitored hosts, and
        associated client log for each host.

        This module also retrieves usernames and password hashes from
        the `xymonpasswd` config file from Xymon servers before 4.3.25,
        which permit download arbitrary config files (CVE-2016-2055),
        and servers configured with `ALLOWALLCONFIGFILES` enabled.
Metasploit Module: Memcached Extractor
Type: auxiliary
Path: modules/auxiliary/gather/memcached_extractor.rb
References: URL-https://github.com/memcached/memcached/blob/master/doc/protocol.txt

Description:
This module extracts the slabs from a memcached instance.  It then
          finds the keys and values stored in those slabs.
Metasploit Module: CrushFTP AWS4-HMAC Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/gather/crushftp_authbypass_cve_2025_2825.rb
References: CVE-2025-2825, URL-https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis

Description:
This module leverages an authentication bypass in CrushFTP 11 < 11.3.1 and 10 < 10.8.4. Attackers
          with knowledge of a valid username can provide a crafted S3 authentication header to the CrushFTP web API
          to authenticate as that user without valid credentials. When successfully executed, the exploit will
          output working session cookies for the target user account.
Metasploit Module: SuiteCRM authenticated SQL injection in export functionality
Type: auxiliary
Path: modules/auxiliary/gather/suite_crm_export_sqli.rb
Disclosure date: 2022-05-24
References: CVE-2023-5350, URL-https://blog.exodusintel.com/2022/06/09/salesagility-suitecrm-export-request-sql-injection-vulnerability/, URL-https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_6

Description:
This module exploits an authenticated SQL injection in SuiteCRM in versions before 7.12.6. The vulnerability
          allows an authenticated attacker to send specially crafted requests to the export entry point of the application in order
          to retrieve all the usernames and their associated password from the database.

Check method (fingerprinting):
authenticated = authenticate
    return Exploit::CheckCode::Safe('Unable to authenticate to SuiteCRM') unless authenticated

    res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri, 'index.php'),
        'keep_cookies' => true,
        'vars_get' => {
          'module' => 'Home',
          'action' => 'About'
        }
      }
    )

    return Exploit::CheckCode::Safe('Trying to query the SuiteCRM version information failed') unless res&.body

    version = Rex::Version.new(res.body.match(/Version\s+((?:\d+\.)+\d+).*/)[1])
    return Exploit::CheckCode::Safe('Could not find retrieve the version of SuiteCRM from the version page') unless version

    print_status "Version detected: #{version}"

    return Exploit::CheckCode::Vulnerable("SuiteCRM version #{version} is vulnerable") if version <= Rex::Version.new('7.12.5')

    Exploit::CheckCode::Safe("SuiteCRM version #{version} is not vulnerable")
  end
Metasploit Module: WordPress Photo Gallery Plugin SQL Injection (CVE-2022-0169)
Type: auxiliary
Path: modules/auxiliary/gather/wp_photo_gallery_sqli.rb
Disclosure date: 2022-03-14
References: CVE-2022-0169, URL-https://github.com/X3RX3SSec/CVE-2022-0169

Description:
The Photo Gallery by 10Web WordPress plugin <= 1.6.0 is vulnerable to
          unauthenticated SQL injection via the 'bwg_tag_id_bwg_thumbnails_0[]'
          parameter in admin-ajax.php (action=bwg_frontend_data).

Check method (fingerprinting):
@sqli = get_sqli_object
    return Exploit::CheckCode::Unknown(GET_SQLI_OBJECT_FAILED_ERROR_MSG) if @sqli == GET_SQLI_OBJECT_FAILED_ERROR_MSG

    @sqli.test_vulnerable ? Exploit::CheckCode::Vulnerable('SQL injection confirmed') : Exploit::CheckCode::Safe('SQL injection test did not succeed')
  end