deardaniel/secdata-raw huggingface dataset:
Metasploit Module: MS17-010 EternalRomance/EternalSynergy/EternalChampion SMB Remote Windows Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/smb/ms17_010_command.rb
Disclosure date: 2017-03-14
References: MSB-MS17-010, CVE-2017-0143, CVE-2017-0146, CVE-2017-0147, URL-https://github.com/worawit/MS17-010, URL-https://hitcon.org/2017/CMT/slide-files/d2_s2_r0.pdf, URL-https://blogs.technet.microsoft.com/srd/2017/06/29/eternal-champion-exploit-analysis/

Description:
This module will exploit SMB with vulnerabilities in MS17-010 to achieve a write-what-where
          primitive. This will then be used to overwrite the connection session information with as an
          Administrator session. From there, the normal psexec command execution is done.

          Exploits a type confusion between Transaction and WriteAndX requests and a race condition in
          Transaction requests, as seen in the EternalRomance, EternalChampion, and EternalSynergy
          exploits. This exploit chain is more reliable than the EternalBlue exploit, but requires a
          named pipe.
Metasploit Module: SMB Password Change
Type: auxiliary
Path: modules/auxiliary/admin/smb/change_password.rb
References: URL-https://github.com/fortra/impacket/blob/master/examples/changepasswd.py

Description:
Change the password of an account using SMB. This provides several different
          APIs, each of which have their respective benefits and drawbacks.
Metasploit Module: DNS Server Dynamic Update Record Injection
Type: auxiliary
Path: modules/auxiliary/admin/dns/dyn_dns_update.rb
References: URL-https://www.tenable.com/plugins/nessus/35372, URL-https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/NONE-CVE/DNSInject, URL-https://www.christophertruncer.com/dns-modification-dnsinject-nessus-plugin-35372/, URL-https://github.com/ChrisTruncer/PenTestScripts/blob/master/HostScripts/DNSInject.py

Description:
This module allows adding and/or deleting a record to
        any remote DNS server that allows unrestricted dynamic updates.
Metasploit Module: Multiple Brother devices authentication bypass via default administrator password generation
Type: auxiliary
Path: modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb
Disclosure date: 2025-06-25
References: CVE-2024-51977, CVE-2024-51978, URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000, URL-https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000, URL-https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000, URL-https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed, URL-https://github.com/sfewer-r7/BrotherVulnerabilities

Description:
By leaking a target devices serial number, a remote attacker can generate the target devices default
          administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP,
          SNMP, or PJL requests.
Metasploit Module: SerComm Device Configuration Dump
Type: auxiliary
Path: modules/auxiliary/admin/misc/sercomm_dump_config.rb
Disclosure date: 2013-12-31
References: OSVDB-101653, URL-https://github.com/elvanderb/TCP-32764

Description:
This module will dump the configuration of several SerComm devices. These devices
          typically include routers from NetGear and Linksys. This module was tested
          successfully against the NetGear DG834 series ADSL modem router.
Metasploit Module: UDP Wake-On-Lan (WOL)
Type: auxiliary
Path: modules/auxiliary/admin/misc/wol.rb

Description:
This module will turn on a remote machine with a network card that
          supports wake-on-lan (or MagicPacket).  In order to use this, you must
          know the machine's MAC address in advance.  The current default MAC
          address is just an example of how your input should look like.

          The password field is optional.  If present, it should be in this hex
          format:[PII_REDACTED]55, which is translated to "0x[PII_REDACTED]55" in binary.
          Note that this should be either 4 or 6 bytes long.
Metasploit Module: Solaris KCMS + TTDB Arbitrary File Read
Type: auxiliary
Path: modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb
Disclosure date: Jan 22 2003
References: CVE-2003-0027, OSVDB-8201, BID-6665, URL-http://marc.info/?l=bugtraq&m=[PII_REDACTED]9850&w=2

Description:
This module targets a directory traversal vulnerability in the
        kcms_server component from the Kodak Color Management System. By
        utilizing the ToolTalk Database Server\'s TT_ISBUILD procedure, an
        attacker can bypass existing directory traversal validation and
        read arbitrary files.

        Vulnerable systems include Solaris 2.5 - 9 SPARC and x86. Both
        kcms_server and rpc.ttdbserverd must be running on the target
        host.
Metasploit Module: Shadow Credentials
Type: auxiliary
Path: modules/auxiliary/admin/ldap/shadow_credentials.rb
References: URL-https://posts.specterops.io/shadow-credentials-abusing-key-trust-account-mapping-for-takeover-8ee1a53566ab, URL-https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/shadow-credentials

Description:
This module can read and write the necessary LDAP attributes to configure a particular account with a
          Key Credential Link. This allows weaponising write access to a user account by adding a certificate
          that can subsequently be used to authenticate. In order for this to succeed, the authenticated user
          must have write access to the target object (the object specified in TARGET_USER).

Check method (fingerprinting):
ldap_connect do |ldap|
      validate_bind_success!(ldap)

      if (@base_dn = datastore['BASE_DN'])
        print_status("User-specified base DN: #{@base_dn}")
      else
        print_status('Discovering base DN automatically')

        unless (@base_dn = ldap.base_dn)
          print_warning("Couldn't discover base DN!")
        end
      end
      @ldap = ldap

      obj = get_target_account
      if obj.nil?
        return Exploit::CheckCode::Unknown('Failed to find the specified object.')
      end

      matcher = SecurityDescriptorMatcher::MultipleAll.new([
        SecurityDescriptorMatcher::MultipleAny.new([
          SecurityDescriptorMatcher::Allow.new(:WP, object_id: '5b47d60f-6090-40b2-9f37-2a4de88f3063'),
          SecurityDescriptorMatcher::Allow.new(:WP)
        ]),
        SecurityDescriptorMatcher::MultipleAny.new([
          SecurityDescriptorMatcher::Allow.new(:RP, object_id: '5b47d60f-6090-40b2-9f37-2a4de88f3063'),
          SecurityDescriptorMatcher::Allow.new(:RP)
        ])
      ])

      begin
        unless adds_obj_grants_permissions?(@ldap, obj, matcher)
          return Exploit::CheckCode::Safe('The object can not be written to.')
        end
      rescue RuntimeError
        return Exploit::CheckCode::Unknown('Failed to check the permissions on the target object.')
      end

      Exploit::CheckCode::Vulnerable(
        'The object can be written to.',
        vuln: {
          resource: {
            ldap_dn: obj.dn
          },
          ser
Metasploit Module: AD CS Certificate Template Management
Type: auxiliary
Path: modules/auxiliary/admin/ldap/ad_cs_cert_template.rb
References: URL-https://posts.specterops.io/certified-pre-owned-d95910965cd2, URL-https://github.com/GhostPack/Certify, URL-https://github.com/ly4k/Certipy

Description:
This module can create, read, update, and delete AD CS certificate templates from a Active Directory Domain
          Controller.

          The READ, UPDATE, and DELETE actions will write a copy of the certificate template to disk that can be
          restored using the CREATE or UPDATE actions. The CREATE and UPDATE actions require a certificate template data
          file to be specified to define the attributes. Template data files are provided to create a template that is
          vulnerable to ESC1, ESC2, ESC3 and ESC15.

          This module is capable of exploiting ESC4.
Metasploit Module: VMware vCenter Server vmdir Authentication Bypass
Type: auxiliary
Path: modules/auxiliary/admin/ldap/vmware_vcenter_vmdir_auth_bypass.rb
Disclosure date: 2020-04-09
References: CVE-2020-3952, URL-https://www.guardicore.com/2020/04/pwning-vmware-vcenter-cve-2020-3952/, URL-https://www.vmware.com/security/advisories/VMSA-2020-0006.html, URL-https://github.com/HynekPetrak/HynekPetrak/blob/master/take_over_vcenter_670.md

Description:
This module bypasses LDAP authentication in VMware vCenter Server's
          vmdir service to add an arbitrary administrator user. Version 6.7
          prior to the 6.7U3f update is vulnerable, only if upgraded from a
          previous release line, such as 6.0 or 6.5.
          Note that it is also possible to provide a bind username and password
          to authenticate if the target is not vulnerable. It will add an
          arbitrary administrator user the same way.
Metasploit Module: Role Base Constrained Delegation
Type: auxiliary
Path: modules/auxiliary/admin/ldap/rbcd.rb
References: URL-https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution, URL-https://www.thehacker.recipes/ad/movement/kerberos/delegations/rbcd, URL-https://github.com/SecureAuthCorp/impacket/blob/3c6713e309cae871d685fa443d3e21b7026a2155/examples/rbcd.py

Description:
This module can read and write the necessary LDAP attributes to configure a particular object for Role Based
          Constrained Delegation (RBCD). When writing, the module will add an access control entry to allow the account
          specified in DELEGATE_FROM to the object specified in DELEGATE_TO. In order for this to succeed, the
          authenticated user must have write access to the target object (the object specified in DELEGATE_TO).

Check method (fingerprinting):
ldap_connect do |ldap|
      validate_bind_success!(ldap)

      if (@base_dn = datastore['BASE_DN'])
        print_status("User-specified base DN: #{@base_dn}")
      else
        print_status('Discovering base DN automatically')

        unless (@base_dn = ldap.base_dn)
          print_warning("Couldn't discover base DN!")
        end
      end
      @ldap = ldap

      obj = get_delegate_to_obj
      if obj.nil?
        return Exploit::CheckCode::Unknown('Failed to find the specified object.')
      end

      unless adds_obj_grants_permissions?(@ldap, obj, SecurityDescriptorMatcher::Allow.all(%i[RP WP]))
        return Exploit::CheckCode::Safe('The object can not be written to.')
      end

      Exploit::CheckCode::Vulnerable(
        'The object can be written to.',
        vuln: {
          resource: {
            ldap_dn: obj.dn
          },
          service: report_ldap_service
        }
      )
    end
  end
Metasploit Module: BadSuccessor: dMSA abuse to Escalate Privileges in Windows Active Directory
Type: auxiliary
Path: modules/auxiliary/admin/ldap/bad_successor.rb
Disclosure date: 2025-05-21
References: URL-https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory?&vid=badsuccessor-demo-video, URL-https://specterops.io/blog/2025/05/27/understanding-mitigating-badsuccessor/, URL-https://jorgequestforknowledge.wordpress.com/2025/09/02/from-badsuccessor-to-patchedsuccessor/

Description:
This module exploits 'Bad Successor', which allows operators to elevate privileges on domain controllers
          running at the Windows 2025 forest functional level. Microsoft decided to introduce Delegated Managed Service
          Accounts in this forest level and they came ripe for exploitation.

          Normal users can't create dMSA accounts where dMSA accounts are supposed to be created, the Managed Service
          Accounts OU, but if a normal user has write access to any other OU they can then create a dMSA account in
          said OU. After creating the account the user can edit LDAP attributes of the account to indicate that this
          account should inherit privileges from the Administrator user. Once this is complete we can request kerberos
          tickets on behalf of the dMSA account and voila, you're admin.

          The module has two actions, one for creating the dMSA account and setting it up to impersonate a high
          privilege user, and another action for requesting the kerberos tickets needed to use the dMSA account for privilege
          escalation.

Check method (fingerprinting):
ldap_connect do |ldap|
      validate_bind_success!(ldap)

      if (@base_dn = datastore['BASE_DN'])
        print_status("User-specified base DN: #{@base_dn}")
      else
        print_status('Discovering base DN automatically')

        unless (@base_dn = ldap.base_dn)
          print_warning("Couldn't discover base DN!")
        end
      end
      @ldap = ldap

      return Exploit::CheckCode::Safe('Target Windows version is not vulnerable to BadSuccessor') unless windows_version_vulnerable?

      ous = get_ous_we_can_write_to
      if ous.blank?
        return Exploit::CheckCode::Safe("Failed to find any Organizational Units #{datastore['LDAPUsername']} can write to.")
      end

      print_good("Found #{ous.length} OUs we can write to, listing below:")
      ous.each do |ou|
        print_good(" - #{ou}")
      end

      Exploit::CheckCode::Appears('Writable Organizational Units found, target appears vulnerable to BadSuccessor')
    end
  rescue Errno::ECONNRESET
    fail_with(Failure::Disconnected, 'The connection was reset.')
  rescue Rex::ConnectionError => e
    fail_with(Failure::Unreachable, e.message)
  rescue Rex::Proto::Kerberos::Model::Error::KerberosError => e
    fail_with(Failure::NoAccess, e.message)
  rescue Net::LDAP::Error => e
    fail_with(Failure::Unknown, "#{e.class}: #{e.message}")
  end
Metasploit Module: LDAP Update Object
Type: auxiliary
Path: modules/auxiliary/admin/ldap/ldap_object_attribute.rb
Authors: jheysel

Description:
This module allows creating, reading, updating and deleting attributes of LDAP objects.
          Users can specify the object and must specify a corresponding attribute.
Metasploit Module: Change Password
Type: auxiliary
Path: modules/auxiliary/admin/ldap/change_password.rb
References: URL-https://github.com/fortra/impacket/blob/master/examples/changepasswd.py, URL-https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6e803168-f140-4d23-b2d3-c3a8ab5917d2

Description:
This module allows Active Directory users to change their own passwords, or reset passwords for
          accounts they have privileges over.
Metasploit Module: Microsoft Host Integration Server 2006 Command Execution Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/ms/ms08_059_his2006.rb
Disclosure date: 2008-10-14
References: MSB-MS08-059, CVE-2008-3466, OSVDB-49068, URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=745

Description:
This module exploits a command-injection vulnerability in Microsoft Host Integration Server 2006.
Metasploit Module: UPnP IGD SOAP Port Mapping Utility
Type: auxiliary
Path: modules/auxiliary/admin/upnp/soap_portmapping.rb
References: URL-http://www.upnp-hacks.org/igd.html

Description:
Manage port mappings on UPnP IGD-capable device using the AddPortMapping and
        DeletePortMapping SOAP requests
Metasploit Module: Get NAA Credentials
Type: auxiliary
Path: modules/auxiliary/admin/sccm/get_naa_credentials.rb
References: URL-https://blog.xpnsec.com/unobfuscating-network-access-accounts/, URL-https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-2/cred-2_description.md, URL-https://github.com/Mayyhem/SharpSCCM, URL-https://github.com/garrettfoster13/sccmhunter

Description:
This module attempts to retrieve the Network Access Account(s), if configured, from the SCCM server.
          This requires a computer account, which can be added using the samr_account module.
Metasploit Module: EMC AlphaStor Device Manager Arbitrary Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/emc/alphastor_devicemanager_exec.rb
Disclosure date: 2008-05-27
References: URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=703, OSVDB-45715, CVE-2008-2157, BID-29398

Description:
EMC AlphaStor Device Manager is prone to a remote command-injection vulnerability
          because the application fails to properly sanitize user-supplied input.
Metasploit Module: EMC AlphaStor Library Manager Arbitrary Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/emc/alphastor_librarymanager_exec.rb
Disclosure date: 2008-05-27
References: URL-http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=703, CVE-2008-2157, OSVDB-45715, BID-29398

Description:
EMC AlphaStor Library Manager is prone to a remote command-injection vulnerability
          because the application fails to properly sanitize user-supplied input.
Metasploit Module: HP Data Protector 6.1 EXEC_CMD Command Execution
Type: auxiliary
Path: modules/auxiliary/admin/hp/hp_data_protector_cmd.rb
Disclosure date: 2011-02-07
References: CVE-2011-0923, OSVDB-72526, ZDI-11-055, URL-https://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux/

Description:
This module exploits HP Data Protector's omniinet process, specifically
          against a Windows setup.

          When an EXEC_CMD packet is sent, omniinet.exe will attempt to look
          for that user-supplied filename with kernel32!FindFirstFileW().  If the file
          is found, the process will then go ahead execute it with CreateProcess()
          under a new thread.  If the filename isn't found, FindFirstFileW() will throw
          an error (0x03), and then bails early without triggering CreateProcess().

          Because of these behaviors, if you try to supply an argument, FindFirstFileW()
          will look at that as part of the filename, and then bail.

          Please note that when you specify the 'CMD' option, the base path begins
          under C:\.
Metasploit Module: HP Intelligent Management SOM Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/hp/hp_imc_som_create_account.rb
Disclosure date: 2013-10-08
References: CVE-2013-4824, OSVDB-98249, BID-62902, ZDI-13-240, URL-https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-c03943547

Description:
This module exploits a lack of authentication and access control in HP Intelligent
          Management, specifically in the AccountService RpcServiceServlet from the SOM component,
          in order to create a SOM account with Account Management permissions. This module has
          been tested successfully on HP Intelligent Management Center 5.2 E0401 and 5.1 E202 with
          SOM 5.2 E0401 and SOM 5.1 E0201 over Windows 2003 SP2.
Metasploit Module: HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation
Type: auxiliary
Path: modules/auxiliary/admin/hp/hp_ilo_create_admin_account.rb
Disclosure date: 2017-08-24
References: CVE-2017-12542, BID-100467, URL-https://support.hpe.com/hpesc/public/docDisplay?docId=emr_na-hpesbhf03769en_us, URL-https://www.synacktiv.com/en/publications/hp-ilo-talk-at-recon-brx-2018.html

Description:
This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer
          overflow in the Connection HTTP header handling by the web server.
          Exploiting this vulnerability gives full access to the REST API, allowing arbitrary
          accounts creation.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => '/rest/v1/AccountService/Accounts',
        'headers' => {
          'Connection' => Rex::Text.rand_text_alphanumeric(29)
        }
      })
    rescue StandardError
      return Exploit::CheckCode::Unknown('Failed to connect to the target')
    end

    if (res.code == 200) && res.body.include?('"Description":"iLO User Accounts"')
      return Exploit::CheckCode::Vulnerable('Authentication bypass returned iLO User Accounts')
    end

    return Exploit::CheckCode::Safe('Authentication bypass did not return account data')
  end
Metasploit Module: UoW pop2d Remote File Retrieval Vulnerability
Type: auxiliary
Path: modules/auxiliary/admin/pop2/uw_fileretrieval.rb
Disclosure date: 2000-07-14
References: CVE-1999-0920, OSVDB-368, BID-1484

Description:
This module exploits a vulnerability in the FOLD command of the
          University of Washington ipop2d service. By specifying an arbitrary
          folder name it is possible to retrieve any file which is world or group
          readable by the user ID of the POP account. This vulnerability can only
          be exploited with a valid username and password. The From address is
          the file owner.
Metasploit Module: VxWorks WDB Agent Remote Reboot
Type: auxiliary
Path: modules/auxiliary/admin/vxworks/wdbrpc_reboot.rb
References: OSVDB-66842, URL-http://web.archive.org/web/[PII_REDACTED]2942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/, US-CERT-VU-362332

Description:
This module provides the ability to reboot a VxWorks target through WDBRPC.
Metasploit Module: VxWorks WDB Agent Remote Memory Dump
Type: auxiliary
Path: modules/auxiliary/admin/vxworks/wdbrpc_memory_dump.rb
References: OSVDB-66842, URL-http://web.archive.org/web/[PII_REDACTED]2942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/, US-CERT-VU-362332

Description:
This module provides the ability to dump the system memory of a VxWorks target through WDBRPC
Metasploit Module: Apple Airport Extreme Password Extraction (WDBRPC)
Type: auxiliary
Path: modules/auxiliary/admin/vxworks/apple_airport_extreme_password.rb
References: OSVDB-66842, URL-http://web.archive.org/web/[PII_REDACTED]2942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/, US-CERT-VU-362332

Description:
This module can be used to read the stored password of a vulnerable
          Apple Airport Extreme access point. Only a small number of firmware versions
          have the WDBRPC service running, however the factory configuration was
          vulnerable. It appears that firmware versions 5.0.x as well as 5.1.x are
          susceptible to this issue. Once the password is obtained, the access point
          can be managed using the Apple AirPort utility.
Metasploit Module: D-Link i2eye Video Conference AutoAnswer (WDBRPC)
Type: auxiliary
Path: modules/auxiliary/admin/vxworks/dlink_i2eye_autoanswer.rb
References: OSVDB-66842, URL-http://web.archive.org/web/[PII_REDACTED]2942/https://www.rapid7.com/blog/post/2010/08/02/new-vxworks-vulnerabilities/, US-CERT-VU-362332

Description:
This module can be used to enable auto-answer mode for the D-Link
          i2eye video conferencing system. Once this setting has been flipped,
          the device will accept incoming video calls without acknowledgement.
          The NetMeeting software included in Windows XP can be used to connect
          to this device. The i2eye product is no longer supported by the vendor
          and all models have reached their end of life (EOL).
Metasploit Module: Belkin Wemo-Enabled Crock-Pot Remote Control
Type: auxiliary
Path: modules/auxiliary/admin/wemo/crockpot.rb
Authors: wvu
References: URL-http://web.archive.org/web/[PII_REDACTED]1809/https://www.crock-pot.com/wemo-landing-page.html, URL-https://www.belkin.com/us/support-article?articleNum=101177, URL-http://www.wemo.com/

Description:
This module acts as a simple remote control for Belkin Wemo-enabled
          Crock-Pots by implementing a subset of the functionality provided by the
          Wemo App.

          No vulnerabilities are exploited by this Metasploit module in any way.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/setup.xml'
    )

    if res && res.code == 200 && res.body.include?('urn:Belkin:device:')
      if res.body.include?('urn:Belkin:device:crockpot:1')
        return Exploit::CheckCode::Appears('Wemo-enabled Crock-Pot detected')
      end

      return Exploit::CheckCode::Detected('Wemo device detected, but it is not a Crock-Pot')
    end

    Exploit::CheckCode::Safe('Target does not appear to be a Wemo device')
  end