deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HP SiteScope Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/hp_sitescope_runomagentcommand.rb
Platform: win
Disclosure date: 2013-07-29
References: CVE-2013-2367, OSVDB-95824, BID-61506, ZDI-13-205

Description:
This module exploits a code execution flaw in HP SiteScope.
          The vulnerability exists in the opcactivate.vbs script, which
          is reachable from the APIBSMIntegrationImpl AXIS service, and
          uses WScript.Shell.run() to execute cmd.exe with user provided
          data. Note that the opcactivate.vbs component is installed
          with the (optional) HP Operations Agent component. The module
          has been tested successfully on HP SiteScope 11.20 (with HP
          Operations Agent) over Windows 2003 SP2.

Check method (fingerprinting):
op = rand_text_alpha(8 + rand(10))
    key = rand_text_alpha(8 + rand(10))
    value = rand_text_alpha(8 + rand(10))

    res = send_soap_request(op, key, value)

    if res and res.code == 200 and res.body =~ /runOMAgentCommandResponse/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Microsoft Exchange Server DlpUtils AddTenantDlpPolicy RCE
Type: exploit
Path: modules/exploits/windows/http/exchange_ecp_dlp_policy.rb
Platform: win
Disclosure date: 2021-01-12
References: CVE-2020-16875, CVE-2020-17132, URL-https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875, URL-https://support.microsoft.com/en-us/help/4577352/security-update-for-exchange-server-2019-and-2016, URL-https://srcincite.io/advisories/src-2020-0019/, URL-https://srcincite.io/pocs/cve-2020-16875.py.txt, URL-https://srcincite.io/pocs/cve-2020-16875.ps1.txt, URL-https://srcincite.io/blog/2021/01/12/making-clouds-rain-rce-in-office-365.html, URL-https://www.x41-dsec.de/security/advisory/exploit/research/2020/12/21/x41-microsoft-exchange-rce-dlp-bypass/

Description:
This vulnerability allows remote attackers to execute arbitrary code
          on affected installations of Exchange Server. Authentication is
          required to exploit this vulnerability. Additionally, the target user
          must have the "Data Loss Prevention" role assigned and an active
          mailbox.

          If the user is in the "Compliance Management" or greater "Organization
          Management" role groups, then they have the "Data Loss Prevention"
          role. Since the user who installed Exchange is in the "Organization
          Management" role group, they transitively have the "Data Loss
          Prevention" role.

          The specific flaw exists within the processing of the New-DlpPolicy
          cmdlet. The issue results from the lack of proper validation of
          user-supplied template data when creating a DLP policy. An attacker
          can leverage this vulnerability to execute code in the context of
          SYSTEM.

          Tested against Exchange Server 2016 CU19 on Windows Server 2016.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/owa/auth/logon.aspx')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    # Hat tip @tsellers-r7
    #
    # <link rel="shortcut icon" href="/owa/auth/15.1.2044/themes/resources/favicon.ico" type="image/x-icon">
    unless res.code == 200 && %r{/owa/auth/(?<build>[\d.]+)/} =~ res.body
      return CheckCode::Unknown('Target does not appear to be running Exchange Server.')
    end

    if vuln_builds.any? { |build_range| Rex::Version.new(build).between?(*build_range) }
      return CheckCode::Appears("Exchange Server #{build} is a vulnerable build.")
    end

    CheckCode::Safe("Exchange Server #{build} is not a vulnerable build.")
  end
Metasploit Module: Geutebrueck GCore - GCoreServer.exe Buffer Overflow RCE
Type: exploit
Path: modules/exploits/windows/http/geutebrueck_gcore_x64_rce_bo.rb
Platform: win
Disclosure date: 2017-01-24
References: EDB-41153, CVE-2017-11517, URL-https://www.geutebrueck.com
Targets: Automatic Targeting, GCore 1.3.8.42, Windows x64 (Win7+), GCore 1.4.2.37, Windows x64 (Win7+)

Description:
This module exploits a stack Buffer Overflow in the GCore server (GCoreServer.exe).
          The vulnerable webserver is running on Port 13003 and Port 13004, does not require
          authentication and affects all versions from 2003 till July 2016 (Version 1.4.YYYYY).

Check method (fingerprinting):
fingerprint
  end
Metasploit Module: HP Managed Printing Administration jobAcct Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/hp_mpa_job_acct.rb
Platform: win
Disclosure date: Dec 21 2011
References: CVE-2011-4166, OSVDB-78015, BID-51174, ZDI-11-352, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03128469

Description:
This module exploits an arbitrary file upload vulnerability on HP Managed Printing
        Administration 2.6.3 and prior versions. The vulnerability exists in the UploadFiles()
        function from the MPAUploader.Uploader.1 control, loaded and used by the server.
        The function can be abused via directory traversal and null byte injection in order
        to achieve arbitrary file upload. In order to exploit successfully, a few conditions
        must be met. First, a writable location under the context of Internet Guest Account
        (IUSR_*) or Everyone is required. By default, this module will attempt to write to
        /hpmpa/userfiles/, but the WRITEWEBFOLDER option can be used to provide
        another writable path. Second, the writable path must also be readable by a browser,
        so this typically means a location under wwwroot. Finally, you cannot overwrite
        a file with the same name as the payload.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => normalize_uri("hpmpa", "home", "Default.asp") })
    version = nil
    if res and res.code == 200 and res.body =~ /HP Managed Printing Administration/ and res.body =~ /<dd>v(.*)<\/dd>/
      version = $1
    else
      return Exploit::CheckCode::Safe('HP Managed Printing Administration not detected')
    end

    vprint_status("HP MPA Version Detected: #{version}")

    if version <= "2.6.3"
      return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: Trend Micro OfficeScan Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/trendmicro_officescan_widget_exec.rb
Platform: win
Disclosure date: 2017-10-07
References: CVE-2017-11394, URL-https://pentest.blog/one-ring-to-rule-them-all-same-rce-on-multiple-trend-micro-products/, URL-http://www.zerodayinitiative.com/advisories/ZDI-17-521/

Description:
This module exploits the authentication bypass and command injection vulnerability together. Unauthenticated users can execute a
          terminal command under the context of the web server user.

          The specific flaw exists within the management interface, which listens on TCP port 443 by default. The Trend Micro Officescan product
          has a widget feature which is implemented with PHP. Talker.php takes ack and hash parameters but doesn't validate these values, which
          leads to an authentication bypass for the widget. Proxy.php files under the mod TMCSS folder take multiple parameters but the process
          does not properly validate a user-supplied string before using it to execute a system call. Due to combination of these vulnerabilities,
          unauthenticated users can execute a terminal command under the context of the web server user.

Check method (fingerprinting):
my_target = auto_target
    token = auth(my_target)
    # If we dont have a cookie that means authentication bypass issue has been patched on target system.
    if token.nil?
      Exploit::CheckCode::Safe('Target is not vulnerable')
    else
      # Authentication bypass does not mean that we have a command injection.
      # Accessing to the widget framework without having command injection means literally nothing.
      # So we gonna trigger command injection vulnerability without a payload.
      csrf_token = build_csrftoken(my_target, token)
      vprint_status('Trying to detect command injection vulnerability')
      res = send_request_cgi({
        'method' => 'POST',
        'uri' => normalize_uri(target_uri.path, 'officescan', 'console', 'html', 'widget', 'proxy_controller.php'),
        'headers' => {
          'X-CSRFToken' => csrf_token,
          'ctype' => 'application/x-www-form-urlencoded; charset=utf-8'
        },
        'cookie' => "LANG=en_US; LogonUser=root; wf_CSRF_token=#{csrf_token}; #{token}",
        'vars_post' => {
          'module' => 'modTMCSS',
          'serverid' => '1',
          'TOP' => ''
        }
      })
      if res && res.code == 200 && res.body.include?('Proxy execution failed: exec report.php failed')
        Exploit::CheckCode::Vulnerable('Target is vulnerable')
      else
        Exploit::CheckCode::Safe('Target is not vulnerable')
      end
    end
  end
Metasploit Module: Progress Software WS_FTP Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/ws_ftp_rce_cve_2023_40044.rb
Platform: %w[win
Disclosure date: 2023-09-27
References: CVE-2023-40044, URL-https://attackerkb.com/topics/bn32f9sNax/cve-2023-40044/rapid7-analysis, URL-https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023, URL-https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044

Description:
This module exploits an unsafe .NET deserialization vulnerability to achieve unauthenticated remote code
          execution against a vulnerable WS_FTP server running the Ad Hoc Transfer module. All versions of WS_FTP Server
          prior to 2020.0.4 (version 8.7.4) and 2022.0.2 (version 8.8.2) are vulnerable to this issue. The vulnerability
          was originally discovered by AssetNote.

Check method (fingerprinting):
# As the vulnerability lies in the WS_FTP Ad Hoc Transfer (AHT) module, we query the index HTML file for AHT.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/AHT/AHT_UI/public/index.html'
    )

    return CheckCode::Unknown('Connection failed') unless res

    title = Nokogiri::HTML(res.body).xpath('//head/title')&.text

    # We verify the target is running the AHT module, by inspecting the HTML heads title.
    if title == 'Ad Hoc Transfer'
      res = send_request_cgi(
        'method' => 'GET',
        'uri' => '/AHT/AHT_UI/public/js/app.min.js'
      )

      return CheckCode::Unknown('Connection failed') unless res

      # The patched versions were released on September 2023. We can query the date stamp in the app.min.js file
      # to see when this file was built. If it is before Sept 2023, then we have a vulnerable version of WS_FTP,
      # but if it was build on Sept 2023 or after, it is not vulnerable.

      if res.code == 200 && res.body =~ %r{/\*! fileTransfer (\d+)-(\d+)-(\d+) \*/}
        day = ::Regexp.last_match(1).to_i
        month = ::Regexp.last_match(2).to_i
        year = ::Regexp.last_match(3).to_i

        description = "Detected a build date of #{day}-#{month}-#{year}"

        if year > 2023 || (year == 2023 && month >= 9)
          return CheckCode::Safe(description)
        end

        return CheckCode::Appears(description)
      end

      # If we couldn't get the JS build date, we at least know the target is WS_FTP wit
Metasploit Module: ManageEngine OpManager Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/manage_engine_opmanager_rce.rb
Platform: java
Disclosure date: 2015-09-14
References: EDB-38174, CVE-2015-7765, CVE-2015-7766, URL-https://seclists.org/fulldisclosure/2015/Sep/66, URL-https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability

Description:
This module exploits a default credential vulnerability in ManageEngine OpManager, where a
          default hidden account "IntegrationUser" with administrator privileges exists. The account
          has a default password of "plugin" which cannot be reset through the user interface. By
          log-in and abusing the default administrator's SQL query functionality, it's possible to
          write a WAR payload to disk and trigger an automatic deployment of this payload. This
          module has been tested successfully on OpManager v11.0 and v11.4-v11.6 for Windows.

Check method (fingerprinting):
# Check version
    vprint_status("Trying to detect ManageEngine OpManager")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(uri, 'LoginPage.do')
    })

    unless res && res.code == 200
      return Exploit::CheckCode::Safe('Target did not respond as expected')
    end

    if res.body =~ /OpManager.*v\.([0-9]+\.[0-9]+)<\/span>/
      version = $1
      if Rex::Version.new(version) <= Rex::Version.new('11.6')
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
      else
        # Patch unknown
        return Exploit::CheckCode::Detected("Target detected with version: #{version}")
      end
    elsif res.body =~ /OpManager/
      return Exploit::CheckCode::Detected('OpManager detected but version not identified')
    else
      return Exploit::CheckCode::Safe('Target does not appear to be OpManager')
    end
  end
Metasploit Module: Microsoft Exchange ProxyNotShell RCE
Type: exploit
Path: modules/exploits/windows/http/exchange_proxynotshell_rce.rb
Platform: windows
Disclosure date: 2022-09-28
References: CVE-2022-41040, CVE-2022-41082, URL-https://www.zerodayinitiative.com/blog/2022/11/14/control-your-types-or-get-pwned-remote-code-execution-in-exchange-powershell-backend, URL-https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/, URL-https://doublepulsar.com/proxynotshell-the-story-of-the-claimed-zero-day-in-microsoft-exchange-5c63d963a9e9, URL-https://rw.md/2022/11/09/ProxyNotRelay.html
Targets: Windows Dropper, Windows Command

Description:
This module chains two vulnerabilities on Microsoft Exchange Server
          that, when combined, allow an authenticated attacker to interact with
          the Exchange Powershell backend (CVE-2022-41040), where a
          deserialization flaw can be leveraged to obtain code execution
          (CVE-2022-41082). This exploit only support Exchange Server 2019.

          These vulnerabilities were patched in November 2022.

Check method (fingerprinting):
@ssrf_email ||= Faker::Internet.email
    res = send_http('GET', '/mapi/nspi/')
    return CheckCode::Unknown('No response received from target') if res.nil?
    return CheckCode::Unknown('Server responded with 401 Unauthorized.') if res.code == 401
    return CheckCode::Safe('Exchange MAPI/HTTP endpoint not detected') unless res.code == 200 && res.get_html_document.xpath('//head/title').text == 'Exchange MAPI/HTTP Connectivity Endpoint'

    # actually run the powershell cmdlet and see if it works, this will fail if:
    #   * the credentials are incorrect (USERNAME, PASSWORD, DOMAIN)
    #   * the exchange emergency mitigation service M1 rule is in place
    return CheckCode::Safe('PowerShell Get-Mailbox cmdlet failed') unless execute_powershell('Get-Mailbox')

    CheckCode::Vulnerable('Target is vulnerable')
  rescue Msf::Exploit::Failed => e
    CheckCode::Safe(e.to_s)
  end
Metasploit Module: Oracle Application Testing Suite WebLogic Server Administration Console War Deployment
Type: exploit
Path: modules/exploits/windows/http/oats_weblogic_console.rb
Platform: java
Disclosure date: 2019-03-13
References: CVE-2007-2699

Description:
This module abuses a feature in WebLogic Server's Administration Console to install
          a malicious Java application in order to gain remote code execution. Authentication
          is required, however by default, Oracle ships with a "oats" account that you could
          log in with, which grants you administrator access.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'console', 'login', 'LoginForm.jsp')
    })

    if res && res.body.include?('Oracle WebLogic Server Administration Console')
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Disk Pulse Enterprise Login Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/disk_pulse_enterprise_bof.rb
Platform: win
Disclosure date: 2016-10-03
References: CVE-2025-34108, EDB-40452

Description:
This module exploits a stack buffer overflow in Disk Pulse Enterprise
          9.0.34. If a malicious user sends a malicious HTTP login request,
          it is possible to execute a payload that would run under the Windows
          NT AUTHORITY\SYSTEM account. Due to size constraints, this module
          uses the Egghunter technique.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/',
      'method' => 'GET'
    })

    if res and res.code == 200 and res.body =~ /Disk Pulse Enterprise v9\.0\.34/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: FortiLogger Arbitrary File Upload Exploit
Type: exploit
Path: modules/exploits/windows/http/fortilogger_arbitrary_fileupload.rb
Platform: win
Disclosure date: 2021-02-26
References: CVE-2021-3378, URL-https://erberkan.github.io/2021/cve-2021-3378/

Description:
This module exploits an unauthenticated arbitrary file upload
          via insecure POST request. It has been tested on versions < 5.2.0 in
          Windows 10 Enterprise.

Check method (fingerprinting):
res = check_product_info

    unless res
      return CheckCode::Unknown('Target is unreachable.')
    end

    unless res.code == 200
      return CheckCode::Unknown("Unexpected server response: #{res.code}")
    end

    version = Rex::Version.new(JSON.parse(res.body)['Version'])

    if version <= Rex::Version.new('4.4.2.2')
      CheckCode::Vulnerable("FortiLogger version #{version}")
    else
      CheckCode::Safe("FortiLogger version #{version}")
    end
  rescue JSON::ParserError
    fail_with(Failure::UnexpectedReply, 'The target may have been updated')
  end
Metasploit Module: Novell ZENworks Asset Management Remote Execution
Type: exploit
Path: modules/exploits/windows/http/zenworks_assetmgmt_uploadservlet.rb
Platform: java
Disclosure date: 2011-11-02
References: CVE-2011-2653, OSVDB-77583, BID-50966, ZDI-11-342, URL-http://download.novell.com/Download?buildid=hPvHtXeNmCU~
Targets: Java Universal

Description:
This module exploits a path traversal flaw in Novell ZENworks Asset Management
          7.5. By exploiting the CatchFileServlet, an attacker can upload a malicious file
          outside of the MalibuUploadDirectory and then make a secondary request that allows
          for arbitrary code execution.
Metasploit Module: IA WebMail 3.x Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ia_webmail.rb
Platform: win
Disclosure date: 2003-11-03
References: CVE-2003-1192, OSVDB-2757, BID-8965, URL-http://www.k-otik.net/exploits/11.19.iawebmail.pl.php

Description:
This exploits a stack buffer overflow in the IA WebMail server.
          This exploit has not been tested against a live system at
          this time.
Metasploit Module: ManageEngine Exchange Reporter Plus Unauthenticated RCE
Type: exploit
Path: modules/exploits/windows/http/manageengine_adshacluster_rce.rb
Platform: win
Disclosure date: 2018-06-28
References: URL-https://security.szurek.pl/en/manage-engine-exchange-reporter-plus-unauthenticated-rce/

Description:
This module exploits a remote code execution vulnerability that
          exists in Exchange Reporter Plus <= 5310, caused by execution of
          bcp.exe file inside ADSHACluster servlet

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'exchange', 'servlet', 'GetProductVersion')
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Safe('Target is not vulnerable')
    end

    unless res.code == 200
      vprint_status 'Target is not ManageEngine Exchange Reporter Plus'
      return CheckCode::Safe('Target is not vulnerable')
    end

    begin
      json = res.get_json_document
      raise if json.empty? || !json['BUILD_NUMBER']
    rescue
      vprint_status 'Target is not ManageEngine Exchange Reporter Plus'
      return CheckCode::Safe('Target is not vulnerable')
    end

    vprint_status "Version: #{json['BUILD_NUMBER']}"

    if json['BUILD_NUMBER'].to_i <= 5310
      return CheckCode::Appears('Target appears to be vulnerable')
    end

    CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: CA Arcserve D2D GWT RPC Credential Information Disclosure
Type: exploit
Path: modules/exploits/windows/http/ca_arcserve_rpc_authbypass.rb
Platform: win
Disclosure date: 2011-07-25
References: CVE-2011-3011, OSVDB-74162, EDB-17574

Description:
This module exploits an information disclosure vulnerability in the CA Arcserve
          D2D r15 web server. The information disclosure can be triggered by sending a
          specially crafted RPC request to the homepage servlet. This causes CA Arcserve to
          disclosure the username and password in cleartext used for authentication. This
          username and password pair are Windows credentials with Administrator access.
Metasploit Module: HP OpenView Network Node Manager ov.dll _OVBuildPath Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovbuildpath_textfile.rb
Platform: win
Disclosure date: 2011-11-01
References: CVE-2011-3167, OSVDB-76775, BID-50471, ZDI-12-002, URL-https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03054052

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node
          Manager 7.53 prior to NNM_01213 without the SSRT100649 hotfix. By specifying a long
          'textFile' argument when calling the 'webappmon.exe' CGI program, an attacker can
          cause a stack-based buffer overflow and execute arbitrary code.

          The vulnerable code is within the "_OVBuildPath" function within "ov.dll". There
          are no stack cookies, so exploitation is achieved by overwriting the saved return
          address.

          The vulnerability is due to the use of the function "_OVConcatPath" which finally
          uses "strcat" in an insecure way. User controlled data is concatenated to a string
          which contains the OpenView installation path.

          To achieve reliable exploitation a directory traversal in OpenView5.exe
          (OSVDB 44359) is being used to retrieve OpenView logs and disclose the installation
          path. If the installation path cannot be guessed the default installation path
          is used.