deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Oracle Event Processing FileUploadServlet Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/oracle_event_processing_upload.rb
Platform: win
Disclosure date: 2014-04-21
References: CVE-2014-2424, ZDI-14-106, BID-66871, URL-http://www.oracle.com/technetwork/topics/security/cpuapr2[PII_REDACTED].html

Description:
This module exploits an arbitrary file upload vulnerability in Oracle Event Processing
          11.1.1.7.0. The FileUploadServlet component, which requires no authentication, can be
          abused to upload a malicious file onto an arbitrary location due to a directory traversal
          flaw, and compromise the server. By default Oracle Event Processing uses a Jetty
          Application Server without JSP support, which limits the attack to WbemExec. The current
          WbemExec technique only requires arbitrary write to the file system, but at the moment the
          module only supports Windows 2003 SP2 or older.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => '/ohw/help/state',
      'method' => 'GET',
      'vars_get' => {
        'navSetId' => 'cepvi',
        'navId' => '0',
        'destination' => ''
      }
    })

    if res && res.code == 200
      if res.body.to_s.include?("Oracle Event Processing 11g Release 1 (11.1.1.7.0)")
        return Exploit::CheckCode::Detected('Target service detected')
      elsif res.body.to_s.include?("Oracle Event Processing 12")
        return Exploit::CheckCode::Safe('Target is not vulnerable')
      end
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: SAP DB 7.4 WebTools Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/sapdb_webtools.rb
Platform: win
Disclosure date: 2007-07-05
References: CVE-2007-3614, OSVDB-37838, BID-24773

Description:
This module exploits a stack buffer overflow in SAP DB 7.4 WebTools.
          By sending an overly long GET request, it may be possible for
          an attacker to execute arbitrary code.
Metasploit Module: HP Power Manager 'formExportDataLogs' Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_power_manager_filename.rb
Platform: win
Disclosure date: 2011-10-19
References: CVE-2009-3999, OSVDB-61848, BID-37867

Description:
This module exploits a buffer overflow in HP Power Manager's 'formExportDataLogs'.
          By creating a malformed request specifically for the fileName parameter, a stack-based
          buffer overflow occurs due to a long error message (which contains the fileName),
          which may result in arbitrary remote code execution under the context of 'SYSTEM'.
Metasploit Module: HTTPDX tolog() Function Format String Vulnerability
Type: exploit
Path: modules/exploits/windows/http/httpdx_tolog_format.rb
Platform: win
Disclosure date: 2009-11-17
References: CVE-2009-4769, OSVDB-60182

Description:
This module exploits a format string vulnerability in HTTPDX HTTP server.
          By sending a specially crafted HTTP request containing format specifiers, an
          attacker can corrupt memory and execute arbitrary code.

          By default logging is off for HTTP, but enabled for the 'moderator' user
          via FTP.

Check method (fingerprinting):
version = get_version
    if version
      print_status("HTTPDX version detected : #{version}")
      if (version =~ /1\.4/) or (version == "1.5")
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
      end
    end
    Exploit::CheckCode::Safe("Target is not vulnerable#{version ? " based on version: #{version}" : ''}")
  end
Metasploit Module: Novell Messenger Server 2.0 Accept-Language Overflow
Type: exploit
Path: modules/exploits/windows/http/novell_messenger_acceptlang.rb
Platform: win
Disclosure date: 2006-04-13
References: CVE-2006-0992, OSVDB-24617, BID-17503

Description:
This module exploits a stack buffer overflow in Novell GroupWise
          Messenger Server v2.0. This flaw is triggered by any HTTP
          request with an Accept-Language header greater than 16 bytes.
          To overwrite the return address on the stack, we must first
          pass a memcpy() operation that uses pointers we supply. Due to the
          large list of restricted characters and the limitations of the current
          encoder modules, very few payloads are usable.
Metasploit Module: HP OpenView NNM nnmRptConfig.exe schdParams Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_nnmrptconfig_schdparams.rb
Platform: win
Disclosure date: 2011-01-10
Authors: sinn3r
References: CVE-2011-0267, OSVDB-70473, ZDI-11-009

Description:
This module exploits NNM's nnmRptConfig.exe. Similar to other NNM CGI bugs,
          the overflow occurs during a ov.sprintf_new() call, which allows an attacker to
          overwrite data on the stack, and gain arbitrary code execution.
Metasploit Module: LG Simple Editor Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/lg_simple_editor_rce.rb
Platform: %w[win
Disclosure date: 2023-08-24
References: ZDI-23-1204, CVE-2023-40498

Description:
This Metasploit module exploits broken access control and directory traversal
          vulnerabilities in LG Simple Editor software for gaining code execution.
          The vulnerabilities exist in versions of LG Simple Editor prior to v3.21.
          By exploiting this flaw, an attacker can upload and execute a malicious JSP
          payload with the SYSTEM user permissions.

Check method (fingerprinting):
res = send_request_cgi(
      {
        'method' => 'GET',
        'uri' => normalize_uri(target_uri, 'simpleeditor', 'common', 'commonReleaseNotes.do')
      }
    )

    return Exploit::CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?

    version_text = res.get_html_document.xpath('//h2')[0]&.text&.gsub('v', '')
    return Exploit::CheckCode::Unknown('Could not determine version') if version_text.blank? || version_text == 'Unknown'

    version = Rex::Version.new(version_text)
    return Exploit::CheckCode::Unknown('Could not parse version') if version == Rex::Version.new('0')
    return Exploit::CheckCode::Appears("Version: #{version}") if version <= Rex::Version.new('3.21.0')

    Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: Kentico CMS Staging SyncServer Unserialize Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/kentico_staging_syncserver.rb
Platform: win
Disclosure date: 2019-04-15
References: CVE-2019-10068, URL-https://www.aon.com/cyber-solutions/aon_cyber_labs/unauthenticated-remote-code-execution-in-kentico-cms/
Targets: Windows EXE Dropper, Windows Command, Windows Powershell

Description:
This module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier.
          Remote Command Execution is possible via unauthenticated XML requests to the Staging Service
          SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML
          input is passed to an insecure .NET deserialize call which allows for remote command execution.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    })

    if res && res.body =~ /SyncServer Web Service/i # SOAP endpoint disco / WSDL
      return CheckCode::Detected('Target service detected')
    end

    return CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: NSClient++ 0.5.2.35 - ExternalScripts Authenticated Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/nscp_authenticated_rce.rb
Platform: %w[windows
Disclosure date: 2020-10-20
References: CVE-2025-34079, EDB-48360
Targets: Windows

Description:
This module allows an attacker with knowledge of the admin password of NSClient++
          to start a privilege shell.
          For this module to work, both web interface of NSClient++ and `ExternalScripts` feature
          should be enabled.

Check method (fingerprinting):
token = get_auth_token

    if token == :failed_to_connect
      CheckCode::Safe("Can't access to NSClient web interface, maybe the web interface is not activated or something is wrong with the targeted host")
    elsif token == :wrong_password
      CheckCode::Unknown('Unable to connect to NSClient web interface because the admin password given is wrong')
    elsif token == :no_token_found
      CheckCode::Unknown('Unable to get an authentication token, maybe the target is safe')
    else
      print_good('Got auth token: ' + token)
      if external_scripts_feature_enabled?(token)
        CheckCode::Vulnerable('External scripts feature enabled !')
      else
        CheckCode::Safe('External scripts feature disabled !')
      end
    end
  end
Metasploit Module: Ivanti Avalanche FileStoreConfig File Upload
Type: exploit
Path: modules/exploits/windows/http/ivanti_avalanche_filestoreconfig_upload.rb
Platform: win
Disclosure date: 2023-04-24
References: URL-https://www.zerodayinitiative.com/advisories/ZDI-23-456/, URL-https://forums.ivanti.com/s/article/ZDI-CAN-17812-Ivanti-Avalanche-FileStoreConfig-Arbitrary-File-Upload-Remote-Code-Execution-Vulnerability?language=en_US, URL-https://attackerkb.com/topics/jcdcN9SN9V/cve-2023-28128, CVE-2023-28128

Description:
Ivanti Avalanche prior to v6.4.0.186 permits MS-DOS style short
          names in the configuration path for the Central FileStore. Because of
          this, an administrator can change the default path to the web root
          of the applications, upload a JSP file, and achieve RCE as NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
# Cleanup should not be needed after doing just a check.
    @cleanup_needed = false

    res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path, 'login.jsf'),
      'method' => 'GET'
    )

    return CheckCode::Unknown('Failed to receive a response from the application') unless res

    unless res.body.include?('Avalanche - User Login')
      return CheckCode::Safe('Application does not appear to be Ivanti Avalanche')
    end

    html = res.get_html_document
    elem = html.search('link')&.find { |link| link&.at('@href')&.text&.match(/\d+\.\d+\.\d+\.\d{1,4}/) }
    return CheckCode::Detected('Couldn\'t retrieve element containing Avalanche version') unless elem

    version = elem&.at('@href')&.value&.match(/(\d+\.\d+\.\d+\.\d{1,4})/)
    return CheckCode::Detected('Failed to retrieve software version') unless version && version.length >= 2

    version = version[1]
    vprint_status("Version of Ivanti Avalanche appears to be v#{version}")
    ver_no = Rex::Version.new(version)
    patched_version = Rex::Version.new('6.4.0.186')

    if ver_no >= patched_version
      CheckCode::Safe('Target has been patched!')
    elsif ver_no < patched_version
      CheckCode::Appears('Target appears to be running an unpatched version of Ivanti Avalanche!')
    else
      CheckCode::Unknown("This should never be hit! Some error occurred when grabbing the target version: #{ver_no}")
    end
  end
Metasploit Module: Minishare 1.4.1 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/minishare_get_overflow.rb
Platform: win
Disclosure date: 2004-11-07
References: CVE-2004-2271, OSVDB-11530, BID-11620, URL-http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0208.html

Description:
This is a simple buffer overflow for the minishare web
          server. This flaw affects all versions prior to 1.4.2. This
          is a plain stack buffer overflow that requires a "jmp esp" to reach
          the payload, making this difficult to target many platforms
          at once. This module has been successfully tested against
          1.4.1. Version 1.3.4 and below do not seem to be vulnerable.
Metasploit Module: Kaseya uploadImage Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb
Platform: win
Disclosure date: 2013-11-11
References: CVE-2013-10034, OSVDB-99984, BID-63782, EDB-29675, URL-http://security-assessment.com/files/documents/advisory/Kaseya%20File%20Upload.pdf

Description:
This module exploits an arbitrary file upload vulnerability found in Kaseya versions below
          6.3.0.2. A malicious user can upload an ASP file to an arbitrary directory without previous
          authentication, leading to arbitrary code execution with IUSR privileges.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri('SystemTab', 'uploadImage.asp')
    })

    # the vuln was patched by removing uploadImage.asp. if the page is there, calling it without params will return 500, else 404
    unless res and res.code == 500
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    return Exploit::CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Simple Web Server Connection Header Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/sws_connection_bof.rb
Platform: win
Disclosure date: 2012-07-20
References: CVE-2012-10053, OSVDB-84310, EDB-19937, URL-http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/

Description:
This module exploits a vulnerability in Simple Web Server 2.2 rc2. A remote user
          can send a long string data in the Connection Header to causes an overflow on the
          stack when function vsprintf() is used, and gain arbitrary code execution. The
          module has been tested successfully on Windows 7 SP1 and Windows XP SP3.

Check method (fingerprinting):
res = send_request_raw({ 'uri' => '/' })
    if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: SHOUTcast DNAS/win32 1.9.4 File Request Format String Overflow
Type: exploit
Path: modules/exploits/windows/http/shoutcast_format.rb
Platform: win
Disclosure date: 2004-12-23
References: CVE-2004-1373, OSVDB-12585, BID-12096

Description:
This module exploits a format string vulnerability in the
          Nullsoft SHOUTcast server for Windows. The vulnerability is
          triggered by requesting a file path that contains format
          string specifiers. This vulnerability was discovered by
          Tomasz Trojanowski and Damian Put.

Check method (fingerprinting):
r = send_request_raw({
      'uri' => uri
    }, 5)

    return Exploit::CheckCode::Safe('No response from target') if not r

    m = r.body.match(/Network Audio Server\/([^\s]+)\s+([^<]+)<BR/)
    return Exploit::CheckCode::Safe('Could not identify SHOUTcast version') if not m

    vprint_status("This system is running SHOUTcast #{m[1]} on #{m[2]}")

    # SHOUTcast Distributed Network Audio Server/win32 v1.9.2<BR>
    if (m[1] =~ /v1\.([0-8]\.|9\.[0-3])$/)
      if (m[2] == "win32")
        return Exploit::CheckCode::Appears('Target appears to be vulnerable')
      else
        return Exploit::CheckCode::Detected('Target service detected')
      end
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution
Type: exploit
Path: modules/exploits/windows/http/avaya_ccr_imageupload_exec.rb
Platform: win
Disclosure date: Jun 28 2012
References: CVE-2012-3811, OSVDB-83399, BID-54225, URL-https://downloads.avaya.com/css/P8/documents/100164021, ZDI-12-106

Description:
This module exploits an authentication bypass vulnerability on Avaya IP Office
        Customer Call Reporter, which allows a remote user to upload arbitrary files
        through the ImageUpload.ashx component. It can be abused to upload and execute
        arbitrary ASP .NET code. The vulnerability has been tested successfully on Avaya IP
        Office Customer Call Reporter 7.0.4.2 and 8.0.8.15 on Windows 2003 SP2.
Metasploit Module: MDaemon WorldClient form2raw.cgi Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
Platform: win
Disclosure date: 2003-12-29
References: CVE-2003-1200, OSVDB-3255, BID-9317

Description:
This module exploits a stack buffer overflow in Alt-N MDaemon SMTP server for
          versions 6.8.5 and earlier. When WorldClient HTTP server is installed (default),
          a CGI script is provided to accept html FORM based emails and deliver via MDaemon.exe,
          by writing the CGI output to the Raw Queue. When X-FromCheck is enabled (also default),
          the temporary form2raw.cgi data is copied by MDaemon.exe and a stack based
          overflow occurs when an excessively long From field is specified.
          The RawQueue is processed every 1 minute by default, to a maximum of 60 minutes.
          Keep this in mind when choosing payloads or setting WfsDelay... You'll need to wait.

          Furthermore, this exploit uses a direct memory jump into a nopsled (which isn't very
          reliable). Once the payload is written into the Raw Queue by Form2Raw, MDaemon will
          continue to crash/execute the payload until the CGI output is manually deleted
          from the queue in C:\MDaemon\RawFiles\*.raw.

Check method (fingerprinting):
connect
    sock.put("GET / HTTP/1.0\r\n\r\n")
    banner = sock.get_once
    disconnect

    if (banner.to_s =~ /WDaemon\/6\.8\.[0-5]/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: MiniWeb (Build 300) Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/miniweb_upload_wbem.rb
Platform: win
Disclosure date: 2013-04-09
References: CVE-2013-10047, OSVDB-92198, OSVDB-92200

Description:
This module exploits a vulnerability in MiniWeb HTTP server (build 300).
          The software contains a file upload vulnerability that allows an
          unauthenticated remote attacker to write arbitrary files to the file system.

          Code execution can be achieved by first uploading the payload to the remote
          machine as an exe file, and then upload another mof file, which enables
          WMI (Management Instrumentation service) to execute the uploaded payload.
          Please note that this module currently only works for Windows before Vista.

Check method (fingerprinting):
begin
      uri = normalize_uri(target_uri.path.to_s, "#{rand_text_alpha(rand(10) + 5)}")
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => uri
      })
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if !res or res.headers['Server'].empty?
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif res.headers['Server'] =~ /^MiniWeb$/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Apache Module mod_rewrite LDAP Protocol Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/apache_mod_rewrite_ldap.rb
Platform: win
Disclosure date: 2006-07-28
Authors: aushack
References: CVE-2006-3747, OSVDB-27588, BID-19204, URL-http://archives.neohapsis.com/archives/bugtraq/2006-07/0514.html, EDB-3680, EDB-3996, EDB-2237

Description:
This module exploits the mod_rewrite LDAP protocol scheme handling
          flaw discovered by Mark Dowd, which produces an off-by-one overflow.
          Apache versions 1.3.29-36, 2.0.47-58, and 2.2.1-2 are vulnerable.
          This module requires REWRITEPATH to be set accurately. In addition,
          the target must have 'RewriteEngine on' configured, with a specific
          'RewriteRule' condition enabled to allow for exploitation.

          The flaw affects multiple platforms, however this module currently
          only supports Windows based installations.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => '/',
      'version' => '1.1',
    }, 2)

    if (res.to_s =~ /Apache/) # This could be smarter.
      return Exploit::CheckCode::Detected('Target service detected')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: InterSystems Cache UtilConfigHome.csp Argument Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/intersystems_cache.rb
Platform: win
Disclosure date: 2009-09-29
References: CVE-2009-20005, OSVDB-60549, BID-37177

Description:
This module exploits a stack buffer overflow in InterSystems Cache 2009.1.
          By sending a specially crafted GET request, an attacker may be able to execute
          arbitrary code.
Metasploit Module: HP OpenView Network Node Manager ovwebsnmpsrv.exe main Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb
Platform: win
Disclosure date: 2010-06-16
References: CVE-2010-1964, OSVDB-65552, BID-40873, ZDI-10-108

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
          prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe'
          CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code.

          This vulnerability is triggerable via either a GET or POST request. The buffer being
          written to is 1024 bytes in size. It is important to note that this vulnerability must
          be exploited by overwriting SEH. Otherwise, CVE-2010-1961 is triggered!

          The vulnerable code is within the "main" function within "ovwebsnmpsrv.exe" with a
          timestamp prior to April 7th, 2010. There are no stack cookies, so exploitation is
          easily achieved by overwriting SEH structures.

          There exists some unreliability when running this exploit. It is not completely clear why
          at this time, but may be related to OVWDB or session management. Also, on some attempts
          OV NNM may report invalid characters in the URL. It is not clear what is causing this
          either.
Metasploit Module: HP OpenView Network Node Manager ovwebsnmpsrv.exe ovutil Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_ovutil.rb
Platform: win
Disclosure date: 2010-06-16
References: CVE-2010-1961, OSVDB-65428, BID-40638, ZDI-10-106, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02217439

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53
          prior to NNM_01203. By specifying a long 'arg' parameter when executing the 'jovgraph.exe'
          CGI program, an attacker can cause a stack-based buffer overflow and execute arbitrary code.

          This vulnerability is triggerable via either a GET or POST request. It is interesting to
          note that this vulnerability cannot be exploited by overwriting SEH, since attempting
          to would trigger CVE-2010-1964.

          The vulnerable code is within a sub-function called from "main" within "ovwebsnmpsrv.exe"
          with a timestamp prior to April 7th, 2010. This function contains a 256 byte stack buffer
          which is passed to the "getProxiedStorageAddress" function within ovutil.dll. When
          processing the address results in an error, the buffer is overflowed in a call to sprintf_new.
          There are no stack cookies present, so exploitation is easily achieved by overwriting the
          saved return address.

          There exists some unreliability when running this exploit. It is not completely clear why
          at this time, but may be related to OVWDB or session management. Also, on some attempts
          OV NNM may report invalid characters in the URL. It is not clear what is causing this
          either.