deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Watch Queue Out of Bounds Write
Type: exploit
Path: modules/exploits/linux/local/cve_2022_0995_watch_queue.rb
Disclosure date: 2022-03-14
References: CVE-2022-0995, URL-https://github.com/Bonfee/CVE-2022-0995, URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb, URL-https://nvd.nist.gov/vuln/detail/CVE-2022-0995

Description:
This module exploits a vulnerability in the Linux Kernel's watch_queue event
          notification system. It relies on a heap out-of-bounds write in kernel memory.
          The exploit may fail on the first attempt so multiple attempts may be needed.
          Note that the exploit can potentially cause a denial of service if multiple
          failed attemps occur, however this is unlikely.

Check method (fingerprinting):
# Vulnerable versions are under 5.17:rc8
    # This module only has offsets for 5.13.0-37
    vulnerable_version = Rex::Version.new('5.17.0')
    version_info = pull_version
    if version_info.nil?
      return CheckCode::Unknown('Failed to obtain kernel version')
    end

    major_version = version_info[0]
    if major_version <= vulnerable_version
      return CheckCode::Appears("Kernel version #{major_version} appears to be vulnerable")
    else
      return CheckCode::Safe("The target kernel version #{major_version} is later than the last known vulnerable version aka #{vulnerable_version}")
    end
  end
Metasploit Module: Docker Privileged Container Kernel Escape
Type: exploit
Path: modules/exploits/linux/local/docker_privileged_container_kernel_escape.rb
Platform: %w[linux unix
Disclosure date: 2014-05-01

Description:
This module performs a container escape onto the host as the daemon
            user. It takes advantage of the SYS_MODULE capability. If that
            exists and the linux headers are available to compile on the target,
            then we can escape onto the host.

Check method (fingerprinting):
# Checking database if host has already been disclosed as a container
    container_name =
      if active_db? && framework.db.workspace.hosts.where(address: session.session_host)&.first&.virtual_host
        framework.db.workspace.hosts.where(address: session.session_host)&.first&.virtual_host
      else
        get_container_type
      end

    unless %w[docker podman lxc].include?(container_name.downcase)
      return Exploit::CheckCode::Safe('Host does not appear to be container of any kind')
    end

    # is root user
    unless is_root?
      return Exploit::CheckCode::Safe('Exploit requires root inside container')
    end

    # Checking if the SYS_MODULE capability is enabled
    capability_bitmask = read_file('/proc/1/status')[/^CapEff:\s+[0-9a-f]{16}$/][/[0-9a-f]{16}$/].to_i(16)
    unless capability_bitmask & 0x[PII_REDACTED]010000 > 0
      return Exploit::CheckCode::Safe('SYS_MODULE Capability does not appear to be enabled')
    end

    CheckCode::Vulnerable('Inside Docker container and target appears vulnerable.')
  end
Metasploit Module: ptrace Sudo Token Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ptrace_sudo_token_priv_esc.rb
Platform: linux
Disclosure date: 2019-03-24
References: EDB-46989, URL-https://github.com/nongiach/sudo_inject, URL-https://www.kernel.org/doc/Documentation/security/Yama.txt, URL-http://man7.org/linux/man-pages/man2/ptrace.2.html, URL-https://lwn.net/Articles/393012/, URL-https://lwn.net/Articles/492667/, URL-https://linux-audit.com/protect-ptrace-processes-kernel-yama-ptrace_scope/, URL-https://blog.gdssecurity.com/labs/2017/9/5/linux-based-inter-process-code-injection-without-ptrace2.html

Description:
This module attempts to gain root privileges by blindly injecting into
          the session user's running shell processes and executing commands by
          calling `system()`, in the hope that the process has valid cached sudo
          tokens with root privileges.

          The system must have gdb installed and permit ptrace.

          This module has been tested successfully on:

          Debian 9.8 (x64); and
          CentOS 7.4.1708 (x64).

Check method (fingerprinting):
if yama_enabled?
      vprint_error 'YAMA ptrace scope is restrictive'
      return CheckCode::Safe('YAMA ptrace scope is restrictive')
    end
    vprint_good 'YAMA ptrace scope is not restrictive'

    if command_exists? '/usr/sbin/getsebool'
      if cmd_exec("/usr/sbin/getsebool deny_ptrace 2>1 | /bin/grep -q on && echo true").to_s.include? 'true'
        vprint_error 'SELinux deny_ptrace is enabled'
        return CheckCode::Safe('SELinux deny_ptrace is enabled')
      end
      vprint_good 'SELinux deny_ptrace is disabled'
    end

    unless command_exists? 'sudo'
      vprint_error 'sudo is not installed'
      return CheckCode::Safe('sudo is not installed')
    end
    vprint_good 'sudo is installed'

    unless command_exists? 'gdb'
      vprint_error 'gdb is not installed'
      return CheckCode::Safe('gdb is not installed')
    end
    vprint_good 'gdb is installed'

    CheckCode::Detected('Target appears to be exploitable')
  end
Metasploit Module: Micro Focus (HPE) Data Protector SUID Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/omniresolve_suid_priv_esc.rb
Disclosure date: 2019-09-13
References: CVE-2019-11660, URL-https://softwaresupport.softwaregrp.com/doc/KM03525630

Description:
This module exploits the trusted `$PATH` environment
          variable of the SUID binary `omniresolve` in
          Micro Focus (HPE) Data Protector A.10.40 and prior.

          The `omniresolve` executable calls the `oracleasm` binary using
          a relative path and the trusted environment `$PATH`, which allows
          an attacker to execute a custom binary with `root` privileges.

          This module has been successfully tested on:
          HPE Data Protector A.09.07: OMNIRESOLVE, internal build 110, built on Thu Aug 11 14:52:38 2016;
          Micro Focus Data Protector A.10.40: OMNIRESOLVE, internal build 118, built on Tue May 21 05:49:04 2019 on CentOS Linux release 7.6.1810 (Core)

          The vulnerability has been patched in:
          Micro Focus Data Protector A.10.40: OMNIRESOLVE, internal build 125, built on Mon Aug 19 19:22:20 2019

Check method (fingerprinting):
return CheckCode::Safe("#{suid_bin_path} file not found") unless file? suid_bin_path
    return CheckCode::Safe("#{suid_bin_path} is not setuid") unless setuid? suid_bin_path

    info = cmd_exec("#{suid_bin_path} -ver").to_s
    if info =~ /(?<=\w\.)(\d\d\.\d\d)(.*)(?<=build )(\d\d\d)/
      version = '%.2f' % ::Regexp.last_match(1).to_f
      build = ::Regexp.last_match(3).to_i
      vprint_status("omniresolve version #{version} build #{build}")

      unless Rex::Version.new(version) < target[:upper_version] ||
             (Rex::Version.new(version) == target[:upper_version] && build <= 118)
        return CheckCode::Safe("omniresolve version #{version} build #{build} is not vulnerable")
      end

      return CheckCode::Appears("omniresolve version #{version} build #{build} appears to be vulnerable")
    end

    vprint_error('Could not parse omniresolve -ver output')
    CheckCode::Detected('Could not parse omniresolve version output')
  end
Metasploit Module: Copy Fail AF_ALG + authencesn Page-Cache Write
Type: exploit
Path: modules/exploits/linux/local/cve_2026_31431_copy_fail.rb
Platform: linux
Disclosure date: 2026-04-29
References: CVE-2026-31431, URL-https://copy.fail/, URL-https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py, URL-https://github.com/rootsecdev/cve_2026_31431
Targets: Linux Command

Description:
CVE-2026-31431 is a logic flaw in the Linux kernel's authencesn AEAD template that, when reached via the
          AF_ALG socket interface combined with splice(), allows an unprivileged local user to perform a controlled
          4-byte write into the page cache of any readable file. Because the corrupted pages are never marked dirty, the
          on-disk file is unchanged but the in-memory version is immediately visible system-wide, enabling local
          privilege escalation by injecting shellcode into the page cache of a setuid-root binary such as /usr/bin/su.
          The vulnerability was introduced by an in-place optimization in algif_aead.c (commit 72548b093ee3, 2017) and
          affects essentially all major Linux distributions shipped since then until the fix in commit a664bf3d603d.

Check method (fingerprinting):
stub_source = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2026-31431', 'CVE-2026-31431-check.py'))
    begin
      output = run_python_stub(stub_source)
    rescue Msf::Exploit::Failed => e
      return CheckCode::Unknown("The exploit check failed: #{e}")
    end

    last_error = nil
    output.split("\n").each do |line|
      if line.start_with?('[-] ')
        print_error(last_error) if last_error
        last_error = line[4...]
      elsif line.start_with?('[+] ')
        print_good(line[4...])
      elsif line.start_with?('[*] ')
        print_status(line[4...])
      else
        print_line(line)
      end
    end

    return CheckCode::Safe(last_error) if last_error

    begin
      result = run_command('id')
    rescue Msf::Exploit::Failed => e
      return CheckCode::Unknown("The exploit check failed: #{e}")
    end

    return CheckCode::Vulnerable if result =~ /uid=0(\(\w+\))?/

    CheckCode::Safe('The target system is not exploitable.')
  end
Metasploit Module: Ubuntu needrestart Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/ubuntu_needrestart_lpe.rb
Disclosure date: 2024-11-19
References: URL-https://github.com/makuga01/CVE-2024-48990-PoC, URL-https://www.qualys.com/2024/11/19/needrestart/needrestart.txt, CVE-2024-48990

Description:
Local attackers can execute arbitrary code as root by
          tricking needrestart into running the Python interpreter with an
          attacker-controlled PYTHONPATH environment variable.

          Verified against Ubuntu 22.04 with needrestart 3.5-5ubuntu2.1
          Attempted exploitation against Debian 12, expliotation failed

Check method (fingerprinting):
# fedora https://bodhi.fedoraproject.org/updates/FEDORA-2024-a9cf3dad4f
    # debian https://security-tracker.debian.org/tracker/CVE-2024-48990
    fixed_versions = {
      '24.10' => Rex::Version.new('3.6-8ubuntu4.2'),
      '24.04' => Rex::Version.new('3.6-7ubuntu4.3'),
      '22.04' => Rex::Version.new('3.5-5ubuntu2.2'),
      '20.04' => Rex::Version.new('3.4-6ubuntu0.1.esm1'),
      '18.04' => Rex::Version.new('3.1-1ubuntu0.1.esm1'),
      '16.04' => Rex::Version.new('2.6-1ubuntu0.1.esm1'),
      '12' => Rex::Version.new('3.6-4.deb12u2'), # debian bookworm
      '11' => Rex::Version.new('3.5-4.deb11u4'), # debian bullseye
      # may be more versions, but this felt good enough
      '38' => Rex::Version.new('3.8-1'),
      '39' => Rex::Version.new('3.8-1'),
      '40' => Rex::Version.new('3.8-1'),
      '41' => Rex::Version.new('3.8-1')
    }
    info = get_sysinfo
    return CheckCode::Safe('Only Ubuntu/Debian/Fedora have check functionality') unless ['debian', 'ubuntu', 'fedora'].include? info[:distro]

    if info[:distro] == 'ubuntu'
      version = info[:version].split(' ')[1].slice(0, 5) # take off any extra version info
      return CheckCode::Safe("Ubuntu version #{version} is not vulnerable or untested") unless fixed_versions.key? version
    elsif info[:distro] == 'debian'
      return CheckCode::Safe('Debian may be vulnerable however the exploit does not work against it')
    elsif info[:distro] == 'fedora'
      return CheckCode::Safe('Fedora may be vulnerable
Metasploit Module: Rootkit Privilege Escalation Signal Hunter
Type: exploit
Path: modules/exploits/linux/local/rootkit_privesc_signal_hunter.rb
Platform: linux
Disclosure date: 2013-11-07
Authors: bcoles
References: URL-https://github.com/bcoles/rootkit-signal-hunter, URL-https://xcellerator.github.io/posts/linux_rootkits_03/, URL-https://github.com/m0nad/Diamorphine, URL-https://github.com/h3xduck/Umbra, URL-https://github.com/diego-tella/Codeine, URL-https://github.com/MatheuZSecurity/Singularity, URL-https://github.com/Asekon/RootKit

Description:
This module searches for rootkits which use signals to elevate
          process privileges to UID 0 (root).

          Some rootkits install signal handlers which listen for specific
          signals to elevate process privileges. This module identifies these
          rootkits by sending signals and observing UID switching to root.

          This module has been tested successfully with:

          Singularity 5b6c4b6 (2025-10-19) on Ubuntu 24.04
          kernel 6.14.0-33-generic (x64);
          Diamorphine 2337293 (2023-09-20) on Ubuntu 22.04
          kernel 5.19.0-38-generic (x64);
          Codeine 9644336 (2025-09-02) on Ubuntu 22.04
          kernel 5.19.0-38-generic (x64).

Check method (fingerprinting):
return CheckCode::Unknown('Session already has root privileges') if is_root?

    # NOTE: this will fail on non-POSIX shells (ie, fish)
    # due to using "$$" which is not supported
    pid = datastore['PID'].downcase.blank? ? '\$$' : datastore['PID']

    # Iterate from MIN to MAX sending each signal to PID.
    #
    # SIGCONT if the process hangs.
    # Note: cleanup of hung processes will fail on non-POSIX shells (ie, fish)
    # due to using "$!" which is not supported
    cmd = [
      "i=#{datastore['MIN_SIGNAL']}",
      %(while [ "$i" -le #{datastore['MAX_SIGNAL']} ]),
      %(do sh -c "kill -$i #{pid}; id" 2>/dev/null & pid=$!),
      'sleep 0.1; kill -CONT "$pid" 2>/dev/null',
      'wait "$pid"',
      'i=$((i + 1))',
      'done 2>/dev/null'
    ].join('; ')

    res = cmd_exec(
      cmd,
      nil,
      60
    )
    vprint_line(res) unless res.blank?

    return CheckCode::Safe('No rootkits detected') unless res.to_s.include?('uid=0')

    CheckCode::Vulnerable('Rootkit(s) are installed and configured to elevate privileges for signals.')
  end

  # @return Array of signals which can be used to elevate privileges to root
Metasploit Module: Docker Privileged Container Escape
Type: exploit
Path: modules/exploits/linux/local/docker_privileged_container_escape.rb
Platform: linux
Disclosure date: 2019-07-17
Authors: stealthcopter
References: EDB-47147, URL-https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/, URL-https://github.com/stealthcopter/deepce

Description:
This module escapes from a privileged Docker container and obtains root on the host machine by abusing the Linux cgroup notification on release
            feature. This exploit should work against any container started with the following flags: `--cap-add=SYS_ADMIN`, `--privileged`.

Check method (fingerprinting):
# are in a docker container
    unless file?('/.dockerenv')
      return CheckCode::Safe('Not inside a Docker container')
    end

    # is root user
    unless is_root?
      return Exploit::CheckCode::Safe('Exploit requires root inside container')
    end

    # are rdma files present in /sys/
    path = cmd_exec('ls -x /s*/fs/c*/*/r* | head -n1')
    unless path.start_with? '/'
      return Exploit::CheckCode::Safe('Required /sys/ files for exploitation not found, possibly old version of docker or not a privileged container.')
    end

    CheckCode::Appears('Inside Docker container and target appears vulnerable')
  end
Metasploit Module: Zyxel Firewall SUID Binary Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/zyxel_suid_cp_lpe.rb
Platform: unix
Disclosure date: 2022-06-14
References: CVE-2022-30526, URL-https://www.zyxel.com/support/Zyxel-security-advisory-authenticated-directory-traversal-vulnerabilities-of-firewalls.shtml
Targets: Unix Command, Linux Dropper

Description:
This module exploits CVE-2022-30526, a local privilege escalation vulnerability that
          allows a low privileged user (e.g. nobody) escalate to root. The issue stems from
          a suid binary that allows all users to copy files as root. This module overwrites
          the firewall's crontab to execute an attacker provided script, resulting in code
          execution as root.

          In order to use this module, the attacker must first establish shell access. For
          example, by exploiting CVE-2022-30525.

          Known affected Zyxel models are: USG FLEX (50, 50W, 100W, 200, 500, 700),
          ATP (100, 200, 500, 700, 800), VPN (50, 100, 300, 1000), USG20-VPN and USG20W-VPN.

Check method (fingerprinting):
fwversion_data = read_file('/zyinit/fwversion')
    if fwversion_data.nil? || fwversion_data.empty?
      return CheckCode::Safe('Could not read /zyinit/fwversion. The target is not a Zyxel firewall.')
    end

    model_id = fwversion_data[/MODEL_ID=(?<model_id>[^\n]+)/, :model_id]
    return CheckCode::Unknown('Failed to identify the firewall model.') if model_id.nil? || model_id.empty?

    firmware_ver = fwversion_data[/FIRMWARE_VER=(?<firmware_ver>[^\n]+)/, :firmware_ver]
    return CheckCode::Unknown('Failed to identify the firmware version.') if firmware_ver.nil? || firmware_ver.empty?

    test_file = "/var/zyxel/#{rand_text_alphanumeric(12..16)}"
    unless cmd_exec("/bin/cp /etc/passwd #{test_file}") == "/bin/cp: cannot create regular file '#{test_file}': Permission denied"
      return CheckCode::Unknown("Failed to generate a permission issue. System version: #{model_id}, #{firmware_ver}")
    end

    suid_copy_result = cmd_exec("zysudo.suid /bin/cp /etc/passwd #{test_file}")
    unless suid_copy_result.empty?
      return CheckCode::Safe("zysudo.suid copy failed. System version: #{model_id}, #{firmware_ver}")
    end

    # clean up the created file
    cmd_exec("zysudo.suid /bin/rm #{test_file}")

    return CheckCode::Vulnerable("System version: #{model_id}, #{firmware_ver}")
  end

  # no matter what happens, try to reset the crontab to the original state and
  # delete the backup file.
Metasploit Module: Ansible Agent Payload Deployer
Type: exploit
Path: modules/exploits/linux/local/ansible_node_deployer.rb
Disclosure date: 2017-06-12
References: URL-https://github.com/n0tty/Random-Hacking-Scripts/blob/master/pwnsible.sh, URL-https://web.archive.org/web/[PII_REDACTED]1610/http://n0tty.github.io/2017/06/11/Enterprise-Offense-IT-Operations-Part-1

Description:
This exploit module creates an ansible module for deployment to nodes in the network.
          It creates a new yaml playbook which copies our payload, chmods it, then runs it on all
          targets which have been selected (default all).

Check method (fingerprinting):
return CheckCode::Safe('Ansible does not seem to be installed, unable to find ansible executable') if ansible_playbook_exe.nil?

    CheckCode::Appears('ansible playbook executable found')
  end
Metasploit Module: Saltstack Minion Payload Deployer
Type: exploit
Path: modules/exploits/linux/local/saltstack_salt_minion_deployer.rb
Disclosure date: 2011-03-19

Description:
This exploit module uses saltstack salt to deploy a payload and run it
          on all targets which have been selected (default all).
          Currently only works against nix targets.

Check method (fingerprinting):
return CheckCode::Safe('salt-master does not seem to be installed, unable to find salt-master executable') if salt_master.nil?

    CheckCode::Vulnerable('salt-master executable found')
  end
Metasploit Module: Docker Daemon Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/docker_daemon_privilege_escalation.rb
Platform: linux
Disclosure date: 2016-06-28
Authors: forzoni

Description:
This module obtains root privileges from any host account with access to the
            Docker daemon. Usually this includes accounts in the `docker` group.

Check method (fingerprinting):
if cmd_exec('docker ps && echo true') =~ /true$/
      print_good("Docker daemon is accessible.")
      Exploit::CheckCode::Vulnerable('Docker daemon is accessible')
    else
      print_error("Failed to access Docker daemon.")
      Exploit::CheckCode::Safe('Failed to access Docker daemon')
    end
  end
Metasploit Module: Cisco Prime Infrastructure Runrshell Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/cpi_runrshell_priv_esc.rb
Platform: linux
Disclosure date: 2018-12-08
References: CVE-2018-15439, URL-https://github.com/pedrib/PoC/blob/master/advisories/cisco-prime-infrastructure.txt#L56

Description:
This modules exploits a vulnerability in Cisco Prime Infrastructure's runrshell binary. The
          runrshell binary is meant to execute a shell script as root, but can be abused to inject
          extra commands in the argument, allowing you to execute anything as root.
Metasploit Module: blueman set_dhcp_handler D-Bus Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/blueman_set_dhcp_handler_dbus_priv_esc.rb
Platform: linux
Disclosure date: 2015-12-18
References: BID-79688, CVE-2015-8612, URL-https://twitter.com/thegrugq/status/[PII_REDACTED]82813440, URL-https://github.com/blueman-project/blueman/issues/416, URL-https://www.openwall.com/lists/oss-security/2015/12/18/6, URL-https://www.debian.org/security/2015/dsa-3427, URL-https://bugs.mageia.org/show_bug.cgi?id=17361, URL-http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.421085

Description:
This module attempts to gain root privileges by exploiting a Python
          code injection vulnerability in blueman versions prior to 2.0.3.

          The `org.blueman.Mechanism.EnableNetwork` D-Bus interface exposes the
          `set_dhcp_handler` function which uses user input in a call to `eval`,
          without sanitization, resulting in arbitrary code execution as root.

          This module has been tested successfully with blueman version 1.23
          on Debian 8 Jessie (x64).

Check method (fingerprinting):
unless command_exists? 'dbus-send'
      vprint_error 'dbus-send is not installed. Exploitation will fail.'
      return CheckCode::Safe('dbus-send is not installed')
    end
    vprint_good 'dbus-send is installed'

    res = dbus_send(
      dest: 'org.blueman.Mechanism',
      type: 'method_call',
      path: '/',
      interface: 'org.freedesktop.DBus.Introspectable.Introspect',
      contents: ''
    )

    unless res.include? 'EnableNetwork'
      vprint_error 'org.blueman.Mechanism.EnableNetwork D-Bus interface is not available'
      return CheckCode::Safe('org.blueman.Mechanism.EnableNetwork D-Bus interface is not available')
    end
    vprint_good 'org.blueman.Mechanism.EnableNetwork D-Bus interface is available'

    res = execute_python('')
    unless res.include? 'eval("nc.set_dhcp_handler(%s)" % dhcp_handler)'
      vprint_error 'Target is not vulnerable'
      return CheckCode::Safe('Target is not vulnerable')
    end

    CheckCode::Vulnerable('Target is vulnerable')
  end