deardaniel/secdata-raw huggingface dataset:
Metasploit Module: ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)
Type: exploit
Path: modules/exploits/linux/ftp/proftp_sreplace.rb
Disclosure date: 2006-11-26
References: CVE-2006-5815, OSVDB-68985, BID-20992, URL-https://seclists.org/bugtraq/2006/Nov/94, URL-https://seclists.org/bugtraq/2006/Nov/538, URL-http://bugs.proftpd.org/show_bug.cgi?id=2858, URL-http://proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?view=diff&r1=text&tr1=1.292&r2=text&tr2=1.294&diff_format=h

Description:
This module exploits a stack-based buffer overflow in versions 1.2 through
          1.3.0 of ProFTPD server. The vulnerability is within the "sreplace" function
          within the "src/support.c" file.

          The off-by-one heap overflow bug in the ProFTPD sreplace function has been
          discovered about 2 (two) years ago by Evgeny Legerov. We tried to exploit
          this off-by-one bug via MKD command, but failed. We did not work on this bug
          since then.

          Actually, there are exists at least two bugs in sreplace function, one is the
          mentioned off-by-one heap overflow bug the other is a stack-based buffer overflow
          via 'sstrncpy(dst,src,negative argument)'.

          We were unable to reach the "sreplace" stack bug on ProFTPD 1.2.10 stable
          version, but the version 1.3.0rc3 introduced some interesting changes, among them:

          1. another (integer) overflow in sreplace!
          2. now it is possible to reach sreplace stack-based buffer overflow bug via
          the "pr_display_file" function!
          3. stupid '.message' file display bug

          So we decided to choose ProFTPD 1.3.0 as a target for our exploit.
          To reach the bug, you need to upload a specially created .message file to a
          writeable directory, then do "CWD <writeable directory>" to trigger the invocation
          of sreplace function.

          Note that ProFTPD 1.3.0rc3 has introduced a stupid bug: to display '.message'
          file you also have to upload a file named '250'. ProFTPD 1.3.0 fixes this bug.

          The exploit is a part of VulnDisco Pack since Dec 2005.

Check method (fingerprinting):
# NOTE: We don't care if the login failed here...
    connect

    # We just want the banner to check against our targets..
    vprint_status("FTP Banner: #{banner.strip}")

    status = CheckCode::Safe

    if banner =~ /ProFTPD (1\.[23]\.[^ ])/i
      ver = ::Regexp.last_match(1)
      _maj, _min, rel = ver.split('.')
      relv = rel.slice!(0, 1)
      case relv
      when '2'
        status = CheckCode::Appears

      when '3'
        # 1.3.x before 1.3.1 is vulnerable
        status = CheckCode::Appears
        if !rel.empty?
          if rel.to_i > 0
            status = CheckCode::Safe
          else
            status = CheckCode::Appears
          end
        end
      end
    end

    disconnect
    return status
  end
Metasploit Module: ProFTPD 1.3.2rc3 - 1.3.3b Telnet IAC Buffer Overflow (Linux)
Type: exploit
Path: modules/exploits/linux/ftp/proftp_telnet_iac.rb
Disclosure date: 2010-11-01
References: CVE-2010-4221, OSVDB-68985, BID-44562

Description:
This module exploits a stack-based buffer overflow in versions of ProFTPD
          server between versions 1.3.2rc3 and 1.3.3b. By sending data containing a
          large number of Telnet IAC commands, an attacker can corrupt memory and
          execute arbitrary code.

          The Debian Squeeze version of the exploit uses a little ROP stub to indirectly
          transfer the flow of execution to a pool buffer (the cmd_rec "res" in
          "pr_cmd_read").

          The Ubuntu version uses a ROP stager to mmap RWX memory, copy a small stub
          to it, and execute the stub. The stub then copies the remainder of the payload
          in and executes it.

          NOTE: Most Linux distributions either do not ship a vulnerable version of
          ProFTPD, or they ship a version compiled with stack smashing protection.

          Although SSP significantly reduces the probability of a single attempt
          succeeding, it will not prevent exploitation. Since the daemon forks in a
          default configuration, the cookie value will remain the same despite
          some attempts failing. By making repeated requests, an attacker can eventually
          guess the cookie value and exploit the vulnerability.

          The cookie in Ubuntu has 24-bits of entropy. This reduces the effectiveness
          and could allow exploitation in semi-reasonable amount of time.

Check method (fingerprinting):
# NOTE: We don't care if the login failed here...
    connect
    banner = sock.get_once || ''

    # We just want the banner to check against our targets..
    vprint_status("FTP Banner: #{banner.strip}")

    status = CheckCode::Safe
    if banner =~ /ProFTPD (1\.3\.[23])/i
      banner_array = banner.split('.')

      if banner_array.count > 0 && !banner_array[3].nil?
        # gets 1 char on the third part of version number.
        relnum = banner_array[2][0..0]
        tmp = banner_array[2].split(' ')
        # gets extra string info of version number.
        # example: 1.2.3rc ('rc' string)
        extra = tmp[0][1..(tmp[0].length - 1)]
        if relnum == '2'
          if !extra.empty?
            if extra[0..1] == 'rc'
              v = extra[2..extra.length].to_i
              if v && v > 2
                status = CheckCode::Appears
              end
            else
              status = CheckCode::Appears
            end
          end
        elsif relnum == '3'
          if [ '', 'a', 'b', ].include?(extra)
            status = CheckCode::Appears
          end
        end
      end
    end

    disconnect
    return status
  end
Metasploit Module: Cyrus IMAPD pop3d popsubfolders USER Buffer Overflow
Type: exploit
Path: modules/exploits/linux/pop3/cyrus_pop3d_popsubfolders.rb
Platform: linux
Disclosure date: 2006-05-21
References: CVE-2006-2502, OSVDB-25853, BID-18056, EDB-2053, EDB-2185, URL-http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0527.html

Description:
This exploit takes advantage of a stack based overflow.  Once the stack
          corruption has occurred it is possible to overwrite a pointer which is
          later used for a memcpy. This gives us a write anything anywhere condition
          similar to a format string vulnerability.

          NOTE: The popsubfolders option is a non-default setting.

          I chose to overwrite the GOT with my shellcode and return to it. This
          defeats the VA random patch and possibly other stack protection features.

          Tested on gentoo-sources Linux 2.6.16. Although Fedora CORE 5 ships with
          a version containing the vulnerable code, it is not exploitable due to the
          use of the FORTIFY_SOURCE compiler enhancement.
Metasploit Module: IBM Data Risk Manager a3user Default Password
Type: exploit
Path: modules/exploits/linux/ssh/ibm_drm_a3user.rb
Platform: unix
Disclosure date: 2020-04-21
References: CVE-2020-4429, URL-https://github.com/pedrib/PoC/blob/master/advisories/IBM/ibm_drm/ibm_drm_rce.md, URL-https://seclists.org/fulldisclosure/2020/Apr/33, URL-https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-exist-in-ibm-data-risk-manager-cve-2020-4427-cve-2020-4428-cve-2020-4429-and-cve-2020-4430/

Description:
This module abuses a known default password in IBM Data Risk Manager. The 'a3user'
          has the default password 'idrm' and allows an attacker to log in to the virtual appliance
          via SSH. This can be escalate to full root access, as 'a3user' has sudo access with the default password.
          At the time of disclosure this was an 0day, but it was later confirmed and patched by IBM.
          Versions <= 2.0.6.1 are confirmed to be vulnerable.
Metasploit Module: Cisco UCS Director default scpuser password
Type: exploit
Path: modules/exploits/linux/ssh/cisco_ucs_scpuser.rb
Platform: unix
Disclosure date: 2019-08-21
References: CVE-2019-1935, URL-https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred, URL-https://seclists.org/fulldisclosure/2019/Aug/36, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Cisco/cisco-ucs-rce.txt

Description:
This module abuses a known default password on Cisco UCS Director. The 'scpuser'
          has the password of 'scpuser', and allows an attacker to login to the virtual appliance
          via SSH.
          This module  has been tested with Cisco UCS Director virtual machines 6.6.0 and 6.7.0.
          Note that Cisco also mentions in their advisory that their IMC Supervisor and
          UCS Director Express are also affected by these vulnerabilities, but this module
          was not tested with those products.
Metasploit Module: Ceragon FibeAir IP-10 SSH Private Key Exposure
Type: exploit
Path: modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb
Platform: unix
Disclosure date: 2015-04-01
References: CVE-2015-0936, URL-https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15

Description:
Ceragon ships a public/private key pair on FibeAir IP-10 devices
            that allows passwordless authentication to any other IP-10 device.
            Since the key is easily retrievable, an attacker can use it to
            gain unauthorized remote access as the "mateidu" user.
Metasploit Module: Loadbalancer.org Enterprise VA SSH Private Key Exposure
Type: exploit
Path: modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb
Platform: unix
Disclosure date: 2014-03-17
Authors: xistence <xistence[at]0x90.nl>

Description:
Loadbalancer.org ships a public/private key pair on Enterprise virtual appliances
            version 7.5.2 that allows passwordless authentication to any other LB Enterprise box.
            Since the key is easily retrievable, an attacker can use it to gain unauthorized remote
            access as root.
Metasploit Module: VMWare Aria Operations for Networks (vRealize Network Insight) SSH Private Key Exposure
Type: exploit
Path: modules/exploits/linux/ssh/vmware_vrni_known_privkey.rb
Platform: unix
Disclosure date: 2023-08-29
References: CVE-2023-34039, URL-https://github.com/sinsinology/CVE-2023-34039, URL-https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/, URL-https://www.vmware.com/security/advisories/VMSA-2023-0018.html

Description:
VMWare Aria Operations for Networks (vRealize Network Insight) versions 6.0.0 through 6.10.0
            do not randomize the SSH keys on virtual machine initialization. Since the key is easily
            retrievable, an attacker can use it to gain unauthorized remote access as the "support" (root) user.
Metasploit Module: SolarWinds LEM Default SSH Password Remote Code Execution
Type: exploit
Path: modules/exploits/linux/ssh/solarwinds_lem_exec.rb
Platform: python
Disclosure date: 2017-03-17
References: CVE-2017-7722, URL-http://web.archive.org/web/[PII_REDACTED]5511/https://pentest.blog/unexpected-journey-4-escaping-from-restricted-shell-and-gaining-root-access-to-solarwinds-log-event-manager-siem-product/

Description:
This module exploits the default credentials of SolarWinds LEM. A menu system is encountered when the SSH
          service is accessed with the default username and password which is "cmc" and "password". By exploiting a
          vulnerability that exist on the menuing script, an attacker can escape from restricted shell.

          This module was tested against SolarWinds LEM v6.3.1.
Metasploit Module: VyOS restricted-shell Escape and Privilege Escalation
Type: exploit
Path: modules/exploits/linux/ssh/vyos_restricted_shell_privesc.rb
Platform: unix
Disclosure date: 2018-11-05
References: CVE-2018-18556, URL-https://blog.vyos.io/the-operator-level-is-proved-insecure-and-will-be-removed-in-the-next-releases, URL-https://blog.mirch.io/2018/11/05/cve-2018-18556-vyos-privilege-escalation-via-sudo-pppd-for-operator-users/, URL-https://github.com/mirchr/security-research/blob/master/vulnerabilities/VyOS/CVE-2018-18556.sh

Description:
This module exploits command injection vulnerabilities and an insecure
          default sudo configuration on VyOS versions 1.0.0 <= 1.1.8 to execute
          arbitrary system commands as root.

          VyOS features a `restricted-shell` system shell intended for use by
          low privilege users with operator privileges. This module exploits
          a vulnerability in the `telnet` command to break out of the restricted
          shell, then uses sudo to exploit a command injection vulnerability in
          `/opt/vyatta/bin/sudo-users/vyatta-show-lldp.pl` to execute commands
          with root privileges.

          This module has been tested successfully on VyOS 1.1.8 amd64 and
          VyOS 1.0.0 i386.

Check method (fingerprinting):
opts = ssh_client_defaults.merge({
      auth_methods: ['password', 'keyboard-interactive'],
      [CREDENTIAL_REDACTED],
      port: rport
    })

    begin
      ssh = nil
      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
        ssh = Net::SSH.start(rhost, username, opts)
      end
    rescue Rex::ConnectionError
      return CheckCode::Unknown('Connection failed')
    rescue Net::SSH::Disconnect, ::EOFError
      return CheckCode::Unknown('Disconnected during SSH negotiation')
    rescue Timeout::Error
      return CheckCode::Unknown('Connection timed out')
    rescue Net::SSH::AuthenticationFailed
      return CheckCode::Detected('SSH service detected but authentication failed')
    rescue Net::SSH::Exception
      return CheckCode::Unknown('SSH error occurred')
    end

    CheckCode::Detected('SSH service detected.')
  end
Metasploit Module: Quantum DXi V1000 SSH Private Key Exposure
Type: exploit
Path: modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb
Platform: unix
Disclosure date: 2014-03-17
Authors: xistence <xistence[at]0x90.nl>

Description:
Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that
            allows passwordless authentication to any other DXi box. Since the key is
            easily retrievable, an attacker can use it to gain unauthorized remote
            access as root.
Metasploit Module: Mercurial Custom hg-ssh Wrapper Remote Code Exec
Type: exploit
Path: modules/exploits/linux/ssh/mercurial_ssh_exec.rb
Platform: python
Disclosure date: 2017-04-18
References: CVE-2017-9462, URL-https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29

Description:
This module takes advantage of custom hg-ssh wrapper implementations that don't
          adequately validate parameters passed to the hg binary, allowing users to trigger a
          Python Debugger session, which allows arbitrary Python code execution.
Metasploit Module: F5 BIG-IP SSH Private Key Exposure
Type: exploit
Path: modules/exploits/linux/ssh/f5_bigip_known_privkey.rb
Platform: unix
Disclosure date: 2012-06-11
Authors: egypt
References: URL-https://www.trustmatta.com/advisories/MATTA-2012-002.txt, CVE-2012-1493, OSVDB-82780, URL-https://www.rapid7.com/blog/post/2012/06/25/press-f5-for-root-shell

Description:
F5 ships a public/private key pair on BIG-IP appliances that allows
          passwordless authentication to any other BIG-IP box. Since the key is
          easily retrievable, an attacker can use it to gain unauthorized remote
          access as root.
Metasploit Module: VMware VDP Known SSH Key
Type: exploit
Path: modules/exploits/linux/ssh/vmware_vdp_known_privkey.rb
Platform: unix
Disclosure date: 2016-12-20
Authors: phroxvs
References: CVE-2016-7456, URL-https://www.vmware.com/security/advisories/VMSA-2016-0024.html

Description:
VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a known ssh private key for the local user admin who is a sudoer without password.
Metasploit Module: Erlang OTP Pre-Auth RCE Scanner and Exploit
Type: exploit
Path: modules/exploits/linux/ssh/ssh_erlangotp_rce.rb
Platform: linux
Disclosure date: 2025-04-16
References: CVE-2025-32433, URL-https://x.com/Horizon3Attack/status/[PII_REDACTED]02334793, URL-https://platformsecurity.com/blog/CVE-2025-32433-poc, URL-https://github.com/ProDefense/CVE-2025-32433
Targets: Linux Command, Unix Command

Description:
This module detect and exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH
          servers that allows remote command execution. By sending crafted SSH packets, it executes a payload to
          establish a reverse shell on the target system.

          The exploit leverages a flaw in the SSH protocol handling to execute commands via the Erlang `os:cmd`
          function without requiring authentication.

Check method (fingerprinting):
print_status('Starting scanner for CVE-2025-32433')

    connect
    sock.put("#{datastore['SSH_IDENT']}\r\n")
    banner = sock.get_once(1024, 10)
    unless banner
      return Exploit::CheckCode::Unknown('No banner received')
    end

    unless banner.to_s.downcase.include?('erlang')
      return Exploit::CheckCode::Safe("Not an Erlang SSH service: #{banner.strip}")
    end

    sleep(0.5)

    print_status('Sending SSH_MSG_KEXINIT...')
    kex_packet = build_kexinit
    sock.put(pad_packet(kex_packet, 8))
    sleep(0.5)

    response = sock.get_once(1024, 5)
    unless response
      return Exploit::CheckCode::Detected("Detected Erlang SSH service: #{banner.strip}, but no response to KEXINIT")
    end

    print_status('Sending SSH_MSG_CHANNEL_OPEN...')
    chan_open = build_channel_open(0)
    sock.put(pad_packet(chan_open, 8))
    sleep(0.5)

    print_status('Sending SSH_MSG_CHANNEL_REQUEST (pre-auth)...')
    chan_req = build_channel_request(0, Rex::Text.rand_text_alpha(rand(4..8)).to_s)
    sock.put(pad_packet(chan_req, 8))
    sleep(0.5)

    begin
      sock.get_once(1024, 5)
    rescue EOFError, Errno::ECONNRESET
      return Exploit::CheckCode::Safe('The target is not vulnerable to CVE-2025-32433.')
    end
    sock.close

    report_vuln(
      host: datastore['RHOST'],
      name: name,
      refs: references,
      info: 'The target is vulnerable to CVE-2025-32433.'
    )
    Exploit::CheckCode::Vulnerable
  rescue Rex::ConnectionError
    Exploit::CheckCode:
Metasploit Module: ExaGrid Known SSH Key and Default Password
Type: exploit
Path: modules/exploits/linux/ssh/exagrid_known_privkey.rb
Platform: unix
Disclosure date: 2016-04-07
Authors: egypt
References: CVE-2016-1560, CVE-2016-1561, URL-https://www.rapid7.com/blog/post/2016/04/07/r7-2016-04-exagrid-backdoor-ssh-keys-and-hardcoded-credentials

Description:
ExaGrid ships a public/private key pair on their backup appliances to
            allow passwordless authentication to other ExaGrid appliances.  Since
            the private key is easily retrievable, an attacker can use it to gain
            unauthorized remote access as root. Additionally, this module will
            attempt to use the default password for root, 'inflection'.
Metasploit Module: Quantum vmPRO Backdoor Command
Type: exploit
Path: modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb
Platform: unix
Disclosure date: 2014-03-17

Description:
This module abuses a backdoor command in Quantum vmPRO. Any user, even one without admin
          privileges, can get access to the restricted SSH shell. By using the hidden backdoor
          "shell-escape" command it's possible to drop to a real root bash shell. This module
          has been tested successfully on Quantum vmPRO 3.1.2.
Metasploit Module: Micro Focus Operations Bridge Reporter shrboadmin default password
Type: exploit
Path: modules/exploits/linux/ssh/microfocus_obr_shrboadmin.rb
Platform: unix
Disclosure date: 2020-09-21
References: CVE-2020-11857, ZDI-20-1215, URL-https://github.com/pedrib/PoC/blob/master/advisories/Micro_Focus/Micro_Focus_OBR.md, URL-https://softwaresupport.softwaregrp.com/doc/KM03710590

Description:
This module abuses a known default password on Micro Focus Operations Bridge Reporter.
          The 'shrboadmin' user, installed by default by the product has the password of 'shrboadmin',
          and allows an attacker to login to the server via SSH.
          This module has been tested with Micro Focus Operations Bridge Manager 10.40. Earlier
          versions are most likely affected too.
          Note that this is only exploitable in Linux installations.
Metasploit Module: Symantec Messaging Gateway 9.5 Default SSH Password Vulnerability
Type: exploit
Path: modules/exploits/linux/ssh/symantec_smg_ssh.rb
Platform: unix
Disclosure date: 2012-08-27
References: CVE-2012-3579, OSVDB-85028, BID-55143, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120827_00

Description:
This module exploits a default misconfiguration flaw on Symantec Messaging Gateway.
          The 'support' user has a known default password, which can be used to login to the
          SSH service, and gain privileged access from remote.
Metasploit Module: F5 iControl REST Unauthenticated SSRF Token Generation RCE
Type: exploit
Path: modules/exploits/linux/http/f5_icontrol_rest_ssrf_rce.rb
Platform: unix
Disclosure date: 2021-03-10
References: CVE-2021-22986, URL-https://support.f5.com/csp/article/K03009991, URL-https://attackerkb.com/assessments/f6b19d24-b24e-4abd-98cf-2988d7424311, URL-https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/
Targets: Unix Command, Linux Dropper

Description:
This module exploits a pre-auth SSRF in the F5 iControl REST API's
          /mgmt/shared/authn/login endpoint to generate an X-F5-Auth-Token that
          can be used to execute root commands on an affected BIG-IP or BIG-IQ
          device. This vulnerability is known as CVE-2021-22986.

          CVE-2021-22986 affects the following BIG-IP versions:

          * 12.1.0 - 12.1.5
          * 13.1.0 - 13.1.3
          * 14.1.0 - 14.1.3
          * 15.1.0 - 15.1.2
          * 16.0.0 - 16.0.1

          And the following BIG-IQ versions:

          * 6.0.0 - 6.1.0
          * 7.0.0
          * 7.1.0

          Tested against BIG-IP Virtual Edition 16.0.1 in VMware Fusion.

Check method (fingerprinting):
generate_token_ssrf ? CheckCode::Vulnerable('The target is vulnerable') : CheckCode::Safe('The target is not vulnerable')
  end