deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Mac OS X APFS Encrypted Volume Password Disclosure
Type: post
Path: modules/post/osx/gather/apfs_encrypted_volume_passwd.rb
Platform: osx
Disclosure date: 2018-03-21
References: URL-https://thehackernews.com/2018/03/macos-apfs-password.html, URL-https://www.mac4n6.com/blog/2018/3/21/uh-oh-unified-logs-in-high-sierra-1013-show-plaintext-password-for-apfs-encrypted-external-volumes-via-disk-utilityapp

Description:
This module exploits a flaw in OSX 10.13 through 10.13.3
          that discloses the passwords of encrypted APFS volumes.

          In OSX a normal user can use the 'log' command to view the system
          logs. In OSX 10.13 to 10.13.2 when a user creates an encrypted APFS
          volume the password is visible in plaintext within these logs.

Check method (fingerprinting):
osx_version = cmd_exec('sw_vers -productVersion')
    return Exploit::CheckCode::Vulnerable('macOS 10.13.0-10.13.3 is vulnerable to APFS password disclosure') if osx_version =~ /^10\.13[.[0-3]]?$/

    Exploit::CheckCode::Safe('macOS version is not vulnerable to APFS password disclosure')
  end
Metasploit Module: OS X Gather Airport Wireless Preferences
Type: post
Path: modules/post/osx/gather/enum_airport.rb

Description:
This module will download OS X Airport Wireless preferences from the victim
          machine.  The preferences file (which is a plist) contains information such as:
          SSID, Channels, Security Type, Password ID, etc.
Metasploit Module: OS X Gather Mac OS X System Information Enumeration
Type: post
Path: modules/post/osx/gather/enum_osx.rb

Description:
This module gathers basic system information from Mac OS X Tiger (10.4), through
          Mojave (10.14).
Metasploit Module: OSX Password Prompt Spoof
Type: post
Path: modules/post/osx/gather/password_prompt_spoof.rb
References: URL-http://blog.packetheader.net/2011/10/fun-with-applescript.html

Description:
Presents a password prompt dialog to a logged-in OSX user.
Metasploit Module: OS X Gather Chicken of the VNC Profile
Type: post
Path: modules/post/osx/gather/enum_chicken_vnc_profile.rb

Description:
This module will download the "Chicken of the VNC" client application's
          profile file,	which is used to store other VNC servers' information such
          as the IP and password.
Metasploit Module: OS X Gather Keychain Enumeration
Type: post
Path: modules/post/osx/gather/enum_keychain.rb

Description:
This module presents a way to quickly go through the current user's keychains and
          collect data such as email accounts, servers, and other services.  Please note:
          when using the GETPASS and GETPASS_AUTO_ACCEPT option, the user may see an authentication
          alert flash briefly on their screen that gets dismissed by a programmatically triggered click.
Metasploit Module: OSX Gather Autologin Password as Root
Type: post
Path: modules/post/osx/gather/autologin_password.rb
References: URL-https://web.archive.org/web/[PII_REDACTED]2145/http://www.brock-family.org/gavin/perl/kcpassword.html

Description:
This module will steal the plaintext password of any user on the machine
          with autologin enabled. Root access is required.

          When a user has autologin enabled (System Preferences -> Accounts), OSX
          stores their password with an XOR encoding in /private/etc/kcpassword.
Metasploit Module: Bypass the macOS TCC Framework
Type: post
Path: modules/post/osx/escalate/tccbypass.rb
References: CVE-2020-9934, URL-https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8, URL-https://github.com/mattshockl/CVE-2020-9934

Description:
This module exploits a vulnerability in the TCC daemon on macOS Catalina
          (<= 10.15.5) in order to grant TCC entitlements. The TCC daemon can be
          manipulated (by setting the HOME environment variable) to use a new user
          controlled location as the TCC database. We can then grant ourselves
          entitlements by inserting them into this new database.

Check method (fingerprinting):
system_version = get_system_version
    unless system_version
      return Exploit::CheckCode::Unknown('Could not determine macOS version')
    end

    version = Rex::Version.new(system_version)
    if version >= Rex::Version.new('10.15.6')
      return Exploit::CheckCode::Safe("macOS #{system_version} is patched")
    elsif version < Rex::Version.new('10.15.0')
      return Exploit::CheckCode::Unknown("macOS #{system_version} is not in the affected range")
    else
      return Exploit::CheckCode::Appears("macOS #{system_version} appears vulnerable to TCC bypass")
    end
  end
Metasploit Module: OSX Screen Capture
Type: post
Path: modules/post/osx/capture/screen.rb

Description:
This module takes screenshots of target desktop and automatically downloads them.
Metasploit Module: OSX Capture Userspace Keylogger
Type: post
Path: modules/post/osx/capture/keylog_recorder.rb

Description:
Logs all keyboard events except cmd-keys and GUI password input.

          Keylogs are transferred between client/server in chunks
          every SYNCWAIT seconds for reliability.

          Works by calling the Carbon GetKeys() hook using the DL lib
          in OSX's system Ruby. The Ruby code is executed in a shell
          command using -e, so the payload never hits the disk.
Metasploit Module: BSD Dump Password Hashes
Type: post
Path: modules/post/bsd/gather/hashdump.rb
Platform: bsd
Authors: bcoles

Description:
Post module to dump the password hashes for all users on a BSD system.
Metasploit Module: iOS Image Gatherer
Type: post
Path: modules/post/apple_ios/gather/ios_image_gather.rb

Description:
This module collects images from iPhones.
          Module was tested on iOS 10.3.3 on an iPhone 5.
Metasploit Module: iOS Text Gatherer
Type: post
Path: modules/post/apple_ios/gather/ios_text_gather.rb

Description:
This module collects text messages from iPhones.
          Tested on iOS 10.3.3 on an iPhone 5.
Metasploit Module: Windows Manage Remote Packet Capture Service Starter
Type: post
Path: modules/post/windows/manage/rpcapd_start.rb
Platform: win

Description:
This module enables the Remote Packet Capture System (rpcapd service)
          included in the default installation of Winpcap. The module allows you to set up
          the service in passive or active mode (useful if the client is behind a firewall).
          If authentication is enabled you need a local user account to capture traffic.
          PORT will be used depending of the mode configured.
Metasploit Module: Architecture Migrate
Type: post
Path: modules/post/windows/manage/archmigrate.rb
Authors: Koen Riepe (koen.riepe@fox-it.com)

Description:
This module checks if the meterpreter architecture is the same as the OS architecture and if it's incompatible it spawns a
          new process with the correct architecture and migrates into that process.
Metasploit Module: Forward SSH Agent Requests To Remote Pageant
Type: post
Path: modules/post/windows/manage/forward_pageant.rb

Description:
This module forwards SSH agent requests from a local socket to a remote Pageant instance.
          If a target Windows machine is compromised and is running Pageant, this will allow the
          attacker to run normal OpenSSH commands (e.g. ssh-add -l) against the Pageant host which are
          tunneled through the meterpreter session. This could therefore be used to authenticate
          with a remote host using a private key which is loaded into a remote user's Pageant instance,
          without ever having knowledge of the private key itself.

          Note that this requires the PageantJacker meterpreter extension, but this will be automatically
          loaded into the remote meterpreter session by this module if it is not already loaded.
Metasploit Module: Windows Manage Set Port Forwarding With PortProxy
Type: post
Path: modules/post/windows/manage/portproxy.rb
Platform: win

Description:
This module uses the PortProxy interface from netsh to set up
          port forwarding persistently (even after reboot). PortProxy
          supports TCP IPv4 and IPv6 connections.
Metasploit Module: Windows Manage Proxy Setting Cloner
Type: post
Path: modules/post/windows/manage/clone_proxy_settings.rb

Description:
This module copies the proxy settings from the current user to the
        targeted user SID, supports remote hosts as well if remote registry
        is allowed.
Metasploit Module: Windows Manage Run Command As User
Type: post
Path: modules/post/windows/manage/run_as.rb
Platform: win
Authors: Kx499

Description:
This module will login with the specified username/password and execute the
          supplied command as a hidden process. Output is not returned by default, by setting
          CMDOUT to true output will be redirected to a temp file and read back in to
          display. By setting advanced option SETPASS to true, it will reset the user's
          password and then execute the command.
Metasploit Module: Windows Manage Safe Delete
Type: post
Path: modules/post/windows/manage/sdel.rb

Description:
The goal of the module is to hinder the recovery of deleted files by overwriting
          its contents.  This could be useful when you need to download some file on the victim
          machine and then delete it without leaving clues about its contents. Note that the script
          does not wipe the free disk space so temporary/sparse/encrypted/compressed files could
          not be overwritten. Note too that MTF entries are not overwritten so very small files
          could stay resident within the stream descriptor.
Metasploit Module: Windows Manage Volume Shadow Copies
Type: post
Path: modules/post/windows/manage/vss.rb
Platform: win
Authors: theLightCosine
References: URL-https://web.archive.org/web/[PII_REDACTED]2952/https://securityweekly.com/2011/11/02/safely-dumping-hashes-from-liv/

Description:
This module will perform management actions for Volume Shadow Copies on the system. This is based on the VSSOwn
          Script originally posted by Tim Tomes and Mark Baggett.

          Works on win2k3 and later.
Metasploit Module: Make Token Command
Type: post
Path: modules/post/windows/manage/make_token.rb
Platform: win

Description:
In its default configuration, this module creates a new network security context with the specified
          logon data (username, domain and password). Under the hood, Meterpreter's access token is cloned, and
          a new logon session is created and linked to that token. The token is then impersonated to acquire
          the new network security context. This module has no effect on local actions - only on remote ones
          (where the specified credential material will be used). This module does not validate the credentials
          specified.
Metasploit Module: Windows Manage Local NBD Server for Remote Disks
Type: post
Path: modules/post/windows/manage/nbd_server.rb
Platform: win
Authors: Wesley McGrew <wesley[at]mcgrewsecurity.com>

Description:
Maps remote disks and logical volumes to a local Network Block
          Device server. Allows for forensic tools to be executed on the remote disk directly.
Metasploit Module: Windows Manage RID Hijacking
Type: post
Path: modules/post/windows/manage/rid_hijack.rb
Platform: win
Authors: Sebastian Castro <sebastian.castro[at]cslcolombia.com>
References: URL-https://web.archive.org/web/[PII_REDACTED]3742/https://csl.com.co/rid-hijacking/

Description:
This module will create an entry on the target by modifying some properties
        of an existing account. It will change the account attributes by setting a
        Relative Identifier (RID), which should be owned by one existing
        account on the destination machine.

        Taking advantage of some Windows Local Users Management integrity issues,
        this module will allow to authenticate with one known account
        credentials (like GUEST account), and access with the privileges of another
        existing account (like ADMINISTRATOR account), even if the spoofed account is
        disabled.
Metasploit Module: Disable Windows Defender Signatures
Type: post
Path: modules/post/windows/manage/rollback_defender_signatures.rb

Description:
This module with appropriate rights uses the Windows Defender command-line utility to run an automation
          tool (mpcmdrun.exe) in order to disable all the signatures available installed for the compromised machine.
          The tool is prominently used for scheduling scans and updating the signature or definition files,
          but there is a switch created to restore the installed signature definitions to a previous backup copy or
          to the original default set of signatures which is none, disabling all the signatures and allowing malware
          to execute even with the Windows Defender solution enabled.
Metasploit Module: Windows Manage Proxy PAC File
Type: post
Path: modules/post/windows/manage/ie_proxypac.rb
Platform: win
References: URL-https://www.youtube.com/watch?v=YGjIlbBVDqE&hd=1, URL-http://blog.scriptmonkey.eu/bypassing-group-policy-using-the-windows-registry

Description:
This module configures Internet Explorer to use a PAC proxy file. By using the LOCAL_PAC
          option, a PAC file will be created on the victim host. It's also possible to provide a
          remote PAC file (REMOTE_PAC option) by providing the full URL.
Metasploit Module: Windows Manage Trojanize Support Account
Type: post
Path: modules/post/windows/manage/enable_support_account.rb
Authors: salcho <salchoman[at]gmail.com>

Description:
This module enables alternative access to servers and workstations
          by modifying the support account's properties. It will enable
          the account for remote access as the administrator user while
          taking advantage of some weird behavior in lusrmgr.msc. It will
          check if sufficient privileges are available for registry operations,
          otherwise it exits.
Metasploit Module: Windows Manage Process Migration
Type: post
Path: modules/post/windows/manage/migrate.rb

Description:
This module will migrate a Meterpreter session from one process
          to another. A given process PID to migrate to or the module can spawn one and
          migrate to that newly spawned process.
Metasploit Module: Peinjector
Type: post
Path: modules/post/windows/manage/peinjector.rb

Description:
This module will inject a specified windows payload into a target executable.
Metasploit Module: Windows Manage Memory Shellcode Injection Module
Type: post
Path: modules/post/windows/manage/shellcode_inject.rb

Description:
This module will inject into the memory of a process a specified shellcode.
Metasploit Module: Windows Manage Privilege Based Process Migration
Type: post
Path: modules/post/windows/manage/priv_migrate.rb
Platform: win

Description:
This module will migrate a Meterpreter session based on session privileges.
          It will do everything it can to migrate, including spawning a new User level process.
          For sessions with Admin rights: It will try to migrate into a System level process in the following
          order: ANAME (if specified), services.exe, wininit.exe, svchost.exe, lsm.exe, lsass.exe, and winlogon.exe.
          If all these fail and NOFAIL is set to true, it will fall back to User level migration. For sessions with User level rights:
          It will try to migrate to a user level process, if that fails it will attempt to spawn the process
          then migrate to it. It will attempt the User level processes in the following order:
          NAME (if specified), explorer.exe, then notepad.exe.
Metasploit Module: Dell DBUtilDrv2.sys Memory Protection Modifier
Type: post
Path: modules/post/windows/manage/dell_memory_protect.rb
Platform: win
References: URL-https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/, URL-https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection, URL-https://itm4n.github.io/lsass-runasppl/, URL-https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/, URL-https://attackerkb.com/assessments/12d7b263-3684-4442-812e-dc30b93def93, URL-https://github.com/RedCursorSecurityConsulting/PPLKiller, URL-https://github.com/jbaines-r7/dellicious

Description:
The Dell DBUtilDrv2.sys drivers version 2.5 and 2.7 have a write-what-where condition
          that allows an attacker to read and write arbitrary kernel-mode memory. This module
          installs the provided driver, enables or disables LSA protection on the provided
          PID, and then removes the driver. This would allow, for example, dumping LSASS memory
          even when secureboot is enabled or preventing antivirus from accessing the memory of
          a chosen PID.

          The affected drivers are not distributed with Metasploit. You will truly need to
          Bring Your Own (Dell) Driver.
Metasploit Module: Windows Post Kill Antivirus and Hips
Type: post
Path: modules/post/windows/manage/killav.rb
Platform: win

Description:
This module attempts to locate and terminate any processes that are identified
          as being Antivirus or Host-based IPS related.
Metasploit Module: Windows Manage Hosts File Injection
Type: post
Path: modules/post/windows/manage/inject_host.rb

Description:
This module allows the attacker to insert a new entry into the target
          system's hosts file.
Metasploit Module: Windows Manage Add User to the Domain and/or to a Domain Group
Type: post
Path: modules/post/windows/manage/add_user.rb
Authors: Joshua Abraham <jabra[at]rapid7.com>

Description:
This module adds a user to the Domain and/or to a Domain group. It will
          check if sufficient privileges are present for certain actions and run
          getprivs for system.  If you elevated privs to system, the
          SeAssignPrimaryTokenPrivilege will not be assigned. You need to migrate to
          a process that is running as system. If you don't have privs, this script
          exits.
Metasploit Module: Windows Manage Certificate Authority Removal
Type: post
Path: modules/post/windows/manage/remove_ca.rb

Description:
This module removes the specified CA certificate from the
          system Trusted Root store.
Metasploit Module: Windows Manage Reflective DLL Injection Module
Type: post
Path: modules/post/windows/manage/reflective_dll_inject.rb
Platform: win
Authors: Ben Campbell
References: URL-https://github.com/stephenfewer/ReflectiveDLLInjection

Description:
This module will inject a specified reflective DLL into the memory of a
          process, new or existing. If arguments are specified, they are passed to
          the DllMain entry point as the lpvReserved (3rd) parameter. To read
          output from the injected process, set PID to zero and WAIT to non-zero.
          Make sure the architecture of the DLL matches the target process.
Metasploit Module: Windows Manage Local User Account Deletion
Type: post
Path: modules/post/windows/manage/delete_user.rb

Description:
This module deletes a local user account from the specified server,
          or the local machine if no server is given.
Metasploit Module: Windows Manage Certificate Authority Injection
Type: post
Path: modules/post/windows/manage/inject_ca.rb

Description:
This module allows the attacker to insert an arbitrary CA certificate
          into the victim's Trusted Root store.
Metasploit Module: Windows Manage Remote Point-to-Point Tunneling Protocol
Type: post
Path: modules/post/windows/manage/pptp_tunnel.rb
Platform: win
Authors: Borja Merino <bmerinofe[at]gmail.com>
References: URL-https://www.youtube.com/watch?v=vdppEZjMPCM&hd=1

Description:
This module initiates a PPTP connection to a remote machine (VPN server). Once
          the tunnel is created we can use it to force the victim traffic to go through the
          server getting a man in the middle attack. Be sure to allow forwarding and
          masquerading on the VPN server (mitm).
Metasploit Module: Windows PowerShell Execution Post Module
Type: post
Path: modules/post/windows/manage/exec_powershell.rb
Platform: windows

Description:
This module will execute a PowerShell script in a meterpreter session.
          The user may also enter text substitutions to be made in memory before execution.
          Setting VERBOSE to true will output both the script prior to execution and the results.
Metasploit Module: Windows Manage Webcam
Type: post
Path: modules/post/windows/manage/webcam.rb

Description:
This module will allow the user to detect installed webcams (with
          the LIST action) or take a snapshot (with the SNAPSHOT) action.
Metasploit Module: Windows Manage Local Microsoft SQL Server Authorization Bypass
Type: post
Path: modules/post/windows/manage/mssql_local_auth_bypass.rb

Description:
When this module is executed, it can be used to add a sysadmin to local
          SQL Server instances.  It first attempts to gain LocalSystem privileges
          using the "getsystem" escalation methods. If those privileges are not
          sufficient to add a sysadmin, then it will migrate to the SQL Server
          service process associated with the target instance.  The sysadmin
          login is added to the local SQL Server using native SQL clients and
          stored procedures.  If no instance is specified then the first identified
          instance will be used.

          Why is this possible? By default in SQL Server 2k-2k8, LocalSystem
          is assigned syadmin privileges.  Microsoft changed the default in
          SQL Server 2012 so that LocalSystem no longer has sysadmin privileges.
          However, this can be overcome by migrating to the SQL Server process.
Metasploit Module: Execute .NET Assembly
Type: post
Path: modules/post/windows/manage/execute_dotnet_assembly.rb
Platform: win
Authors: b4rtik
References: URL-https://b4rtik.github.io/posts/execute-assembly-via-meterpreter-session/
Targets: Windows x64, Windows x86

Description:
This module executes a .NET assembly in memory. It
          reflectively loads a dll that will host CLR, then it copies
          the assembly to be executed into memory. Credits for AMSI
          bypass to Rastamouse (@_RastaMouse)
Metasploit Module: Windows Manage Download and/or Execute
Type: post
Path: modules/post/windows/manage/download_exec.rb
Platform: win
Authors: RageLtMan <rageltman[at]sempervictus>

Description:
This module will download a file by importing urlmon via railgun.
          The user may also choose to execute the file with arguments via exec_string.
Metasploit Module: Windows Manage Enable Remote Desktop
Type: post
Path: modules/post/windows/manage/enable_rdp.rb

Description:
This module enables the Remote Desktop Service (RDP). It provides the options to create
          an account and configure it to be a member of the Local Administrators and
          Remote Desktop Users group. It can also forward the target's port 3389/tcp.
Metasploit Module: Windows 'Run As' Using PowerShell
Type: post
Path: modules/post/windows/manage/run_as_psh.rb
Platform: win
Authors: p3nt4

Description:
This module will start a process as another user using PowerShell.
Metasploit Module: Windows Local User Account Hash Carver
Type: post
Path: modules/post/windows/manage/hashcarve.rb

Description:
This module will change a local user's password directly in the registry.
Metasploit Module: Windows Manage VMDK Mount Drive
Type: post
Path: modules/post/windows/manage/vmdk_mount.rb
Platform: win
Authors: Borja Merino <bmerinofe[at]gmail.com>
References: URL-http://www.shelliscoming.com/2017/05/post-exploitation-mounting-vmdk-files.html

Description:
This module mounts a vmdk file (Virtual Machine Disk) on a drive provided by the user by taking advantage
          of the vstor2 device driver (VMware). First, it executes the binary vixDiskMountServer.exe to access the
          device and then it sends certain control code via DeviceIoControl to mount it. Use the write mode with
          extreme care. You should only open a disk file in writable mode if you know for sure that no snapshots
          or clones are linked from the file.