deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Polkit D-Bus Authentication Bypass
Type: exploit
Path: modules/exploits/linux/local/polkit_dbus_auth_bypass.rb
Platform: unix
Disclosure date: 2021-06-03
References: URL-https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/, CVE-2021-3560, EDB-50011

Description:
A vulnerability exists within the polkit system service that can be leveraged by a local, unprivileged
          attacker to perform privileged operations. In order to leverage the vulnerability, the attacker invokes a
          method over D-Bus and kills the client process. This will occasionally cause the operation to complete without
          being subjected to all of the necessary authentication.
          The exploit module leverages this to add a new user with a sudo access and a known password. The new account
          is then leveraged to execute a payload with root privileges.

Check method (fingerprinting):
if datastore['TIMEOUT'] < 26
      return CheckCode::Unknown("TIMEOUT is set to less than 26 seconds, so we can't detect if polkit times out or not.")
    end

    unless cmd_exec('pkexec --version') =~ /pkexec version (\d+\S*)/
      return CheckCode::Safe('The polkit framework is not installed.')
    end

    # The version as returned by pkexec --version is insufficient to identify whether or not the patch is installed. To
    # do that, the distro specific package manager would need to be queried. See #check_via_version.
    polkit_version = Rex::Version.new(Regexp.last_match(1))

    unless cmd_exec('dbus-send -h') =~ /Usage: dbus-send/
      return CheckCode::Detected('The dbus-send command is not accessible, however the polkit framework is installed.')
    end

    # Calculate the round trip time for the dbus command we want to kill half way through in order to trigger the exploit
    @cmd_delay = get_cmd_delay
    return CheckCode::Unknown('Failed to calculate the round trip time for the dbus command. This is necessary in order to exploit the target.') if @cmd_delay.nil?

    status = nil
    print_status('Checking for exploitability via attempt')
    status ||= check_via_attempt
    print_status('Checking for exploitability via version') unless status
    status ||= check_via_version
    status ||= CheckCode::Detected("Detected polkit framework version #{polkit_version}.")

    status
  end
Metasploit Module: Serv-U FTP Server prepareinstallation Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/servu_ftp_server_prepareinstallation_priv_esc.rb
Platform: linux
Disclosure date: 2019-06-05
References: CVE-2019-12181, EDB-47009, URL-https://github.com/guywhataguy/CVE-2019-12181, URL-https://github.com/bcoles/local-exploits/tree/master/CVE-2019-12181, URL-http://web.archive.org/web/[PII_REDACTED]3621/https://blog.vastart.dev/2019/06/cve-2019-12181-serv-u-exploit-writeup.html, URL-https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-1-7_release_notes.htm, URL-http://web.archive.org/web/[PII_REDACTED]3448/https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-Potential-elevation-of-privileges-on-Linux-systems

Description:
This module attempts to gain root privileges on systems running
          Serv-U FTP Server versions prior to 15.1.7.

          The `Serv-U` executable is setuid `root`, and uses `ARGV[0]`
          in a call to `system()`, without validation, when invoked with
          the `-prepareinstallation` flag, resulting in command execution
          with root privileges.

          This module has been tested successfully on Serv-U FTP Server
          version 15.1.6 (x64) on Debian 9.6 (x64).

Check method (fingerprinting):
return CheckCode::Safe('bash shell is not available') unless command_exists? 'bash'

    vprint_good 'bash shell is available'

    return CheckCode::Safe("#{servu_path} file not found") unless file? servu_path

    return CheckCode::Safe("#{servu_path} is not executable") unless executable?(servu_path)

    vprint_good "#{servu_path} is executable"

    return CheckCode::Safe("#{servu_path} is not setuid") unless setuid? servu_path

    vprint_good "#{servu_path} is setuid"

    CheckCode::Detected('Serv-U FTP server is installed and setuid')
  end
Metasploit Module: Linux Kernel 4.6.3 Netfilter Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb
Disclosure date: 2016-06-03
References: EDB-40049, CVE-2016-4997, CVE-2016-4998, URL-https://www.openwall.com/lists/oss-security/2016/06/24/5, URL-http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c, URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91

Description:
This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently
          only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic.

          Several conditions have to be met for successful exploitation:
          Ubuntu:
          1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such)
          2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile
          Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP.

          We write the ascii files and compile on target instead of locally since metasm bombs for not
          having cdefs.h (even if locally installed)

Check method (fingerprinting):
def iptables_loaded?()
      # user@ubuntu:~$ grep ip_tables /proc/modules
      # ip_tables 28672 1 iptable_filter, Live 0x[PII_REDACTED]000000
      # x_tables 36864 2 iptable_filter,ip_tables, Live 0x[PII_REDACTED]000000
      vprint_status('Checking if ip_tables is loaded in kernel')
      if target.name == "Ubuntu"
        iptables = read_file('/proc/modules').to_s
        if iptables.include?('ip_tables')
          vprint_good('ip_tables.ko is loaded')
        else
          print_error('ip_tables.ko is not loaded.  root needs to run iptables -L or similar command')
        end
        return iptables.include?('ip_tables')
      elsif target.name == "Fedora"
        iptables = read_file('/proc/modules').to_s
        if iptables.include?('iptable_raw')
          vprint_good('iptable_raw is loaded')
        else
          print_error('iptable_raw is not loaded.  root needs to run iptables -L or similar command')
        end
        return iptables.include?('iptable_raw')
      else
        return false
      end
    end

    return CheckCode::Safe('iptables is not loaded') unless iptables_loaded?

    if smep_enabled?
      print_error('SMEP enabled, system not vulnerable.')
      return CheckCode::Safe('SMEP is enabled')
    end
    vprint_good('SMEP is not enabled')

    if smap_enabled?
      print_error('SMAP enabled, system not vulnerable.')
      return CheckCode::Safe('SMAP is enabled')
    end
    vprint_good('SMAP is not enabled')

    unless userns_enabled?
      vprint
Metasploit Module: Zimbra zmslapd arbitrary module load
Type: exploit
Path: modules/exploits/linux/local/zimbra_slapper_priv_esc.rb
Disclosure date: 2021-10-27
References: CVE-2022-37393, URL-https://web.archive.org/web/[PII_REDACTED]1602/https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/

Description:
This module exploits CVE-2022-37393, which is a vulnerability in
          Zimbra's sudo configuration that permits the zimbra user to execute
          the zmslapd binary as root with arbitrary parameters. As part of its
          intended functionality, zmslapd can load a user-defined configuration
          file, which includes plugins in the form of .so files, which also
          execute as root.

Check method (fingerprinting):
# Sanity check
    if is_root?
      fail_with(Failure::None, 'Session already has root privileges')
    end

    unless file_exist?("#{datastore['ZIMBRA_BASE']}/libexec/zmslapd")
      print_error("zmslapd executable not detected: #{datastore['ZIMBRA_BASE']}/libexec/zmslapd (set ZIMBRA_BASE if Zimbra is installed in an unusual location)")
      return CheckCode::Safe('zmslapd executable not detected')
    end

    unless command_exists?(datastore['SUDO_PATH'])
      print_error("Could not find sudo: #{datastore['SUDO_PATH']} (set SUDO_PATH if sudo isn't in $PATH)")
      return CheckCode::Safe('sudo not found')
    end

    # Run `sudo -n -l` to make sure we have access to the target command
    cmd = "#{datastore['SUDO_PATH']} -n -l"
    print_status "Executing: #{cmd}"
    output = cmd_exec(cmd).to_s

    if !output || output.start_with?('usage:') || output.include?('illegal option') || output.include?('a password is required')
      print_error('Current user could not execute sudo -l')
      return CheckCode::Safe('Current user could not execute sudo')
    end

    if !output.include?("(root) NOPASSWD: #{datastore['ZIMBRA_BASE']}/libexec/zmslapd")
      print_error('Current user does not have access to run zmslapd')
      return CheckCode::Safe('Current user does not have access to run zmslapd')
    end

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Netfilter nft_set_elem_init Heap Overflow Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/netfilter_nft_set_elem_init_privesc.rb
Platform: linux
Disclosure date: 2022-02-07
References: CVE-2022-34918, URL-https://nvd.nist.gov/vuln/detail/CVE-2022-34918, URL-https://ubuntu.com/security/CVE-2022-34918, URL-https://www.randorisec.fr/crack-linux-firewall/, URL-https://github.com/randorisec/CVE-2022-34918-LPE-PoC

Description:
An issue was discovered in the Linux kernel through 5.18.9.
          A type confusion bug in nft_set_elem_init (leading to a buffer overflow)
          could be used by a local attacker to escalate privileges.
          The attacker can obtain root access, but must start with an unprivileged
          user namespace to obtain CAP_NET_ADMIN access.
          The issue exists in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.

Check method (fingerprinting):
config = kernel_config

    return CheckCode::Unknown('Could not retrieve kernel config') if config.nil?

    return CheckCode::Safe('Kernel config does not include CONFIG_USER_NS') unless config.include?('CONFIG_USER_NS=y')

    return CheckCode::Safe('Unprivileged user namespaces are not permitted') unless userns_enabled?

    return CheckCode::Safe('LKRG is installed') if lkrg_installed?

    arch = kernel_hardware

    return CheckCode::Safe("System architecture #{arch} is not supported") unless arch.include?('x86_64')

    release = kernel_release

    version, patchlvl = release.match(/^(\d+)\.(\d+)/)&.captures
    if version&.to_i == 5 && patchlvl && (7..19).include?(patchlvl.to_i)
      return CheckCode::Appears("The kernel #{version} appears to be vulnerable, but no offsets are available for this version")
    end

    CheckCode::Safe("Kernel release #{release} is not vulnerable")
  end
Metasploit Module: glibc '$ORIGIN' Expansion Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/glibc_origin_expansion_priv_esc.rb
Platform: linux
Disclosure date: 2010-10-18
References: CVE-2010-3847, BID-44154, EDB-15274, URL-https://seclists.org/fulldisclosure/2010/Oct/257, URL-https://www.ubuntu.com/usn/usn-1009-1, URL-https://security-tracker.debian.org/tracker/CVE-2010-3847, URL-https://access.redhat.com/security/cve/CVE-2010-3847
Targets: Linux x86, Linux x64

Description:
This module attempts to gain root privileges on Linux systems by abusing
          a vulnerability in the GNU C Library (glibc) dynamic linker.

          glibc `ld.so` versions before 2.11.3, and 2.12.x before 2.12.2 does not
          properly restrict use of the `LD_AUDIT` environment variable when loading
          setuid executables which allows control over the `$ORIGIN` library search
          path resulting in execution of arbitrary shared objects.

          This module opens a file descriptor to the specified suid executable via
          a hard link, then replaces the hard link with a shared object before
          instructing the linker to execute the file descriptor, resulting in
          arbitrary code execution.

          The specified setuid binary must be readable and located on the same
          file system partition as the specified writable directory.

          This module has been tested successfully on:

          glibc 2.5 on CentOS 5.4 (x86_64);
          glibc 2.5 on CentOS 5.5 (x86_64);
          glibc 2.12 on Fedora 13 (i386); and
          glibc 2.5-49 on RHEL 5.5 (x86_64).

          Some versions of `ld.so`, such as the version shipped with Ubuntu 14,
          hit a failed assertion in `dl_open_worker` causing exploitation to fail.

Check method (fingerprinting):
v = Rex::Version.new glibc_version
    return CheckCode::Safe('Could not determine the GNU C library version') if v.eql? ''

    if v >= Rex::Version.new('2.12.2') ||
       (v >= Rex::Version.new('2.11.3') && v < Rex::Version.new('2.12'))
      return CheckCode::Safe("GNU C Library version #{v} is not vulnerable")
    end

    vprint_good "GNU C Library version #{v} appears vulnerable"

    return CheckCode::Safe("#{suid_exe_path} file not found") unless file? suid_exe_path
    return CheckCode::Detected("#{suid_exe_path} is not setuid") unless setuid? suid_exe_path

    vprint_good "#{suid_exe_path} is setuid"

    return CheckCode::Detected("#{suid_exe_path} is not readable") unless readable?(suid_exe_path)

    vprint_good "#{suid_exe_path} is readable"

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Linux Kernel recvmmsg Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/recvmmsg_priv_esc.rb
Disclosure date: 2014-02-02
References: BID-65255, CVE-2014-0038, EDB-31347, EDB-31346, URL-https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1453900

Description:
This module attempts to exploit CVE-2014-0038, by sending a recvmmsg
          system call with a crafted timeout pointer parameter to gain root.

          This exploit has offsets for 3 Ubuntu 13 kernels:
          3.8.0-19-generic (13.04 default);
          3.11.0-12-generic (13.10 default);
          3.11.0-15-generic (13.10).

          This exploit may take up to 13 minutes to run due to a decrementing
          (1/sec) pointer which starts at 0xff*3 (765 seconds)

Check method (fingerprinting):
arch = kernel_hardware
    unless arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    vprint_good "System architecture #{arch} is supported"

    version = kernel_version
    unless version.include? 'Ubuntu'
      vprint_error "System kernel #{version} is not based on Ubuntu"
      return CheckCode::Safe("System kernel #{version} is not based on Ubuntu")
    end
    vprint_good 'System kernel is based on Ubuntu'

    # Ubuntu 12.x kernels are not supported
    if version.include? 'precise'
      vprint_error "System kernel #{version} is not exploitable"
      return CheckCode::Safe("System kernel #{version} is not exploitable")
    end

    release = kernel_release
    unless release =~ /^3\.11\.0-(12|15)-generic/ || release.eql?('3.8.0-19-generic')
      vprint_error "Kernel #{release} #{version} is not exploitable"
      return CheckCode::Safe("Kernel #{release} #{version} is not exploitable")
    end
    vprint_good "Kernel #{release} #{version} is exploitable"

    CheckCode::Appears("Kernel #{release} #{version} appears to be vulnerable")
  end
Metasploit Module: Pi-Hole Remove Commands Linux Priv Esc
Type: exploit
Path: modules/exploits/linux/local/pihole_remove_commands_lpe.rb
Disclosure date: 2021-04-20
References: URL-https://www.compass-security.com/fileadmin/Research/Advisories/2021-02_CSNC-2021-008_Pi-hole_Privilege_Escalation.txt, CVE-2021-29449

Description:
Pi-Hole versions 3.0 - 5.3 allows for command line input to the removecustomcname,
          removecustomdns, and removestaticdhcp functions without properly validating
          the parameters before passing to sed.  When executed as the www-data user,
          this allows for a privilege escalation to root since www-data is in the
          sudoers.d/pihole file with no password.

Check method (fingerprinting):
w = whoami
    print_status("Current user: #{w}")
    v = pihole_version
    print_status("Pi-hole version: #{v}")
    unless v.between?(target['min'], Rex::Version.new('5.3'))
      return CheckCode::Safe("Pi-Hole version #{v} is >= 5.3 and not vulnerable")
    end
    unless w == 'www-data'
      return CheckCode::Safe("User must be www-data, currently #{w}")
    end

    CheckCode::Appears("Pi-Hole #{v} with user #{w} is vulnerable and exploitable")
  end
Metasploit Module: VMware vCenter vScalation Priv Esc
Type: exploit
Path: modules/exploits/linux/local/vcenter_java_wrapper_vmon_priv_esc.rb
Disclosure date: 2021-09-21
References: URL-https://pentera.io/blog/vscalation-cve-2021-22015-local-privilege-escalation-in-vmware-vcenter-pentera-labs/, CVE-2021-22015, URL-https://www.vmware.com/security/advisories/VMSA-2021-0020.html

Description:
This module exploits a privilege escalation in vSphere/vCenter due to improper permissions on the
          /usr/lib/vmware-vmon/java-wrapper-vmon file. It is possible for anyone in the
          cis group to write to the file, which will execute as root on vmware-vmon service
          restart or host reboot.

          This module was successfully tested against VMware VirtualCenter 6.5.0 build-7070488.
          The following versions should be vulnerable:
          vCenter 7.0 before U2c
          vCenter 6.7 before U3o
          vCenter 6.5 before U3q

Check method (fingerprinting):
return CheckCode::Safe("#{java_wrapper_vmon} not found on system") unless file?(java_wrapper_vmon)
    return CheckCode::Safe("#{java_wrapper_vmon} not writable") unless writable?(java_wrapper_vmon)

    group_owner = cmd_exec("stat -c \"%G\" \"#{java_wrapper_vmon}\"")
    if group_owner == 'cis'
      return CheckCode::Appears("#{java_wrapper_vmon} is writable and owned by cis group")
    end

    CheckCode::Safe("#{java_wrapper_vmon} not owned by 'cis' group (owned by '#{group_owner}'), or not writable")
  end
Metasploit Module: 2021 Ubuntu Overlayfs LPE
Type: exploit
Path: modules/exploits/linux/local/cve_2021_3493_overlayfs.rb
Disclosure date: 2021-04-12
References: CVE-2021-3493, URL-https://ssd-disclosure.com/ssd-advisory-overlayfs-pe/, URL-https://github.com/briskets/CVE-2021-3493
Targets: x86_64, aarch64

Description:
This module exploits a vulnerability in Ubuntu's implementation of overlayfs. The
          vulnerability is the result of failing to verify the ability of a user to set the
          attributes in a running executable. Specifically, when Overlayfs sends the set attributes
          data to the underlying file system via `vfs_setxattr`, it fails to first verify the data
          by calling `cap_convert_nscap`.
          This vulnerability was patched by moving the call to `cap_convert_nscap`
          into the `vfs_setxattr` function that sets the attribute, forcing verification every time the
          `vfs_setxattr` is called rather than trusting the data was already verified.

Check method (fingerprinting):
arch = kernel_hardware

    unless arch.include?('x86_64') || arch.include?('aarch64')
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end

    release = kernel_release
    version = kernel_version

    unless userns_enabled?
      return CheckCode::Safe('Unprivileged user namespaces are not permitted')
    end

    vprint_good('Unprivileged user namespaces are permitted')

    # If the target is Ubuntu...
    unless version =~ /[uU]buntu/
      return CheckCode::Safe('Target is not Ubuntu!')
    end

    version_array = release.split('-')
    if version_array.length < 2
      fail_with(Failure::UnexpectedReply, 'The target Ubuntu server does not have the expected kernel version format!')
    end
    vprint_status("Version array: #{version_array}")
    major_version = Rex::Version.new(version_array[0])
    vprint_status("major_version: #{major_version}")
    minor_version = version_array[1]
    vprint_status("minor_version: #{minor_version}")
    lower_bound_version = Rex::Version.new(3.13)
    upper_bound_version = Rex::Version.new(5.14)
    if major_version > upper_bound_version || major_version < lower_bound_version
      return CheckCode::Safe("The target version #{major_version} is outside the vulnerable version range #{lower_bound_version}-#{upper_bound_version}")
    end

    return CheckCode::Appears("Kernel version #{major_version} appears to be vulnerable")
  end
Metasploit Module: Linux BPF doubleput UAF Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/bpf_priv_esc.rb
Platform: linux
Disclosure date: 2016-05-04
References: BID-90309, CVE-2016-4557, EDB-39772, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=808, URL-https://usn.ubuntu.com/2965-1/, URL-https://launchpad.net/bugs/1578705, URL-http://changelogs.ubuntu.com/changelogs/pool/main/l/linux/linux_4.4.0-22.39/changelog, URL-https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-4557.html, URL-https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
Targets: Linux x86, Linux x64

Description:
Linux kernel 4.4 < 4.5.5 extended Berkeley Packet Filter (eBPF)
          does not properly reference count file descriptors, resulting
          in a use-after-free, which can be abused to escalate privileges.

          The target system must be compiled with `CONFIG_BPF_SYSCALL`
          and must not have `kernel.unprivileged_bpf_disabled` set to 1.

          Note, this module will overwrite the first few lines
          of `/etc/crontab` with a new cron job. The job will
          need to be manually removed.

          This module has been tested successfully on Ubuntu 16.04 (x64)
          kernel 4.4.0-21-generic (default kernel).

Check method (fingerprinting):
release = kernel_release
    version = kernel_version

    if Rex::Version.new(release.split('-').first) < Rex::Version.new('4.4') ||
       Rex::Version.new(release.split('-').first) > Rex::Version.new('4.5.5')
      vprint_error "Kernel version #{release} #{version} is not vulnerable"
      return CheckCode::Safe("Kernel version #{release} is not vulnerable")
    end

    if version.downcase.include?('ubuntu') && release =~ /^4\.4\.0-(\d+)-/ && (::Regexp.last_match(1).to_i > 21)
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe("Kernel version #{release} is not vulnerable")
    end
    vprint_good "Kernel version #{release} #{version} appears to be vulnerable"

    lib = cmd_exec('dpkg --get-selections | grep ^fuse').to_s
    unless lib.include?('install')
      print_error('fuse package is not installed.  Exploitation will fail.')
      return CheckCode::Safe('fuse package is not installed')
    end
    vprint_good('fuse package is installed')

    fuse_mount = "#{base_dir}/fuse_mount"
    if directory? fuse_mount
      vprint_error("#{fuse_mount} should be unmounted and deleted.  Exploitation will fail.")
      return CheckCode::Safe('fuse mount directory exists and should be cleaned up')
    end
    vprint_good("#{fuse_mount} doesn't exist")

    config = kernel_config

    if config.nil?
      vprint_error 'Could not retrieve kernel config'
      return CheckCode::Unknown('Could not retrieve kernel config')
    end

    unless