deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HID discoveryd command_blink_on Unauthenticated RCE
Type: exploit
Path: modules/exploits/linux/misc/hid_discoveryd_command_blink_on_unauth_rce.rb
Platform: linux
Disclosure date: 2016-03-28
References: ZDI-16-223, URL-https://blog.trendmicro.com/let-get-door-remote-root-vulnerability-hid-door-controllers/, URL-http://nosedookie.blogspot.com/2011/07/identifying-and-querying-hid-vertx.html, URL-https://exfil.co/2016/05/09/exploring-the-hid-eh400/, URL-https://github.com/lixmk/Concierge, URL-https://github.com/coldfusion39/VertXploit

Description:
This module exploits an unauthenticated remote command execution
          vulnerability in the discoveryd service exposed by HID VertX and Edge
          door controllers.

          This module was tested successfully on a HID Edge model EH400
          with firmware version 2.3.1.603 (Build 04/23/2012).

Check method (fingerprinting):
connect_udp
    udp_sock.put 'discover;013;'
    res = udp_sock.get(5)
    disconnect_udp

    if res.to_s.eql? ''
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    hid_res = parse_discovered_response res
    unless hid_res
      vprint_error 'Unexpected response from target'
      return CheckCode::Unknown('Unexpected response from target')
    end

    if hid_res[:mac].eql? ''
      vprint_error 'Malformed response'
      return CheckCode::Unknown('Received malformed response from target')
    end

    @mac = hid_res[:mac]

    vprint_good "#{rhost}:#{rport} - HID discoveryd service detected"
    vprint_line hid_res.to_s
    report_service(
      host: rhost,
      mac: hid_res[:mac],
      port: rport,
      proto: 'udp',
      name: 'hid-discoveryd',
      info: hid_res
    )

    if hid_res[:version].to_s.eql? ''
      vprint_error "#{rhost}:#{rport} - Could not determine device version"
      return CheckCode::Detected
    end

    # Vulnerable version mappings from VertXploit
    vuln = false
    version = Rex::Version.new(hid_res[:version].to_s)
    case hid_res[:model]
    when 'E400'     # EDGEPlus
      vuln = true if version <= Rex::Version.new('3.5.1.1483')
    when 'EH400'    # EDGE EVO
      vuln = true if version <= Rex::Version.new('3.5.1.1483')
    when 'EHS400'   # EDGE EVO Solo
      vuln = true if version <= Rex::Version.new('3.5.1.1483')
    when 'ES400'    # EDGEPlus Solo
      vuln = true if version <= Rex::Version.new
Metasploit Module: Jenkins CLI RMI Java Deserialization Vulnerability
Type: exploit
Path: modules/exploits/linux/misc/jenkins_java_deserialize.rb
Platform: java
Disclosure date: 2015-11-18
References: CVE-2015-8103, URL-https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/jenkins.py, URL-https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java, URL-http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability, URL-https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11

Description:
This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on
          the Jenkins master, which allows remote arbitrary code execution. Authentication is not
          required to exploit this vulnerability.

Check method (fingerprinting):
result = Exploit::CheckCode::Safe

    begin
      if vulnerable?
        result = Exploit::CheckCode::Vulnerable
      end
    rescue Msf::Exploit::Failed => e
      vprint_error(e.message)
      return Exploit::CheckCode::Unknown
    end

    result
  end
Metasploit Module: Rocket Software Unidata udadmin_server Authentication Bypass
Type: exploit
Path: modules/exploits/linux/misc/unidata_udadmin_auth_bypass.rb
Platform: unix
Disclosure date: 2023-03-30
References: URL-https://www.rapid7.com/blog/post/2023/03/29/multiple-vulnerabilities-in-rocket-software-unirpc-server-fixed, CVE-2023-28503
Targets: Unix Command, Linux Dropper

Description:
This module exploits an authentication bypass vulnerability in the
          Linux version of udadmin_server, which is an RPC service that comes
          with the Rocket Software UniData server. This affects versions of
          UniData prior to 8.2.4 build 3003.

          This service typically runs as root. It accepts a username of
          ":local:" and a password in the form of "<username>:<uid>:<gid>",
          where username and uid must be a valid account, but gid can be
          anything except 0.

          This exploit takes advantage of this login account to authenticate
          as a chosen user and run an arbitrary command (using the built-in
          OsCommand message).

Check method (fingerprinting):
version = unirpc_get_version
    vprint_status("Detected UniRPC version #{version} is running")

    Exploit::CheckCode::Detected
  rescue UniRPCCommunicationError => e
    return CheckCode::Safe("Could not communicate with the UniRPC server: #{e}")
  rescue UniRPCUnexpectedResponseError => e
    return CheckCode::Safe("UniRPC server returned something unexpected: #{e}")
  end
Metasploit Module: Nagios Remote Plugin Executor Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/misc/nagios_nrpe_arguments.rb
Platform: unix
Disclosure date: 2013-02-21
References: CVE-2013-1362, OSVDB-90582, BID-58142, URL-http://www.occamsec.com/vulnerabilities.html#nagios_metacharacter_vulnerability

Description:
The Nagios Remote Plugin Executor (NRPE) is installed to allow a central
          Nagios server to actively poll information from the hosts it monitors. NRPE
          has a configuration option dont_blame_nrpe which enables command-line arguments
          to be provided remote plugins. When this option is enabled, even when NRPE makes
          an effort to sanitize arguments to prevent command execution, it is possible to
          execute arbitrary commands.

Check method (fingerprinting):
vprint_status("Checking if remote NRPE supports command line arguments")

    begin
      # send query asking to run "fake_check" command with command substitution in arguments
      connect
      res = send_message("__fake_check!$()")
      # if nrpe is configured to support arguments and is not patched to add $() to
      # NASTY_META_CHARS then the service will return:
      #  NRPE: Command '__fake_check' not defined
      if res =~ /not defined/
        return Exploit::CheckCode::Vulnerable
      end
    # Otherwise the service will close the connection if it is configured to disable arguments
    rescue EOFError => eof
      return Exploit::CheckCode::Safe
    rescue Errno::ECONNRESET => reset
      unless datastore['NRPESSL'] or @force_ssl
        vprint_status("Retrying with ADH SSL")
        @force_ssl = true
        retry
      end
      return Exploit::CheckCode::Safe
    rescue => e
      return Exploit::CheckCode::Unknown
    end
    # TODO: patched version appears to go here
    return Exploit::CheckCode::Unknown
  end

  # NRPE uses unauthenticated Anonymous-Diffie-Hellman

  # setting the global SSL => true will break as we would be overlaying
  # an SSLSocket on another SSLSocket which hasnt completed its handshake
Metasploit Module: OpenNMS Java Object Unserialization Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/opennms_java_serialize.rb
Platform: linux
Disclosure date: 2015-11-06
References: CVE-2015-8103, URL-http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
Targets: OpenNMS / Linux x86, OpenNMS / Linux x86_64

Description:
This module exploits a vulnerability in the OpenNMS Java object which allows
          an unauthenticated attacker to run arbitrary code against the system.
Metasploit Module: QNAP Transcode Server Command Execution
Type: exploit
Path: modules/exploits/linux/misc/qnap_transcode_server.rb
Platform: linux
Disclosure date: 2017-08-06
References: CVE-2017-13067, URL-https://www.exploitee.rs/index.php/QNAP_TS-131, URL-http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm

Description:
This module exploits an unauthenticated remote command injection
          vulnerability in QNAP NAS devices. The transcoding server listens
          on port 9251 by default and is vulnerable to command injection
          using the 'rmfile' command.

          This module was tested successfully on a QNAP TS-431 with
          firmware version 4.3.3.0262 (20170727).

Check method (fingerprinting):
vprint_status 'Connecting to transcode server...'

    connect
    sock.put "\x01\x00\x00\x00"
    res = sock.get_once

    if res.blank?
      vprint_status 'No reply from server'
      return CheckCode::Unknown('No reply received from the transcode server')
    end

    vprint_status "Received response: #{res}"

    return CheckCode::Detected if res.to_s =~ /client's request is accepted/

    CheckCode::Safe
  rescue ::Rex::ConnectionError
    vprint_error 'Connection failed'
    return CheckCode::Unknown
  ensure
    disconnect
  end
Metasploit Module: Aerospike Database UDF Lua Code Execution
Type: exploit
Path: modules/exploits/linux/misc/aerospike_database_udf_cmd_exec.rb
Platform: unix
Disclosure date: 2020-07-31
References: EDB-49067, CVE-2020-13151, URL-https://www.aerospike.com/enterprise/download/server/notes.html#5.1.0.3, URL-https://github.com/b4ny4n/CVE-2020-13151, URL-https://b4ny4n.github.io/network-pentest/2020/08/01/cve-2020-13151-poc-aerospike.html, URL-https://www.aerospike.com/docs/operations/manage/udfs/
Targets: Unix Command, Linux (Dropper)

Description:
Aerospike Database versions before 5.1.0.3 permitted
          user-defined functions (UDF) to call the `os.execute`
          Lua function.

          This module creates a UDF utilising this function to
          execute arbitrary operating system commands with the
          privileges of the user running the Aerospike service.

          This module does not support authentication; however
          Aerospike Database Community Edition does not enable
          authentication by default.

          This module has been tested successfully on Ubuntu
          with Aerospike Database Community Edition versions
          4.9.0.5, 4.9.0.11 and 5.0.0.10.

Check method (fingerprinting):
connect

    res = build

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    version = res.to_s.scan(/build\s*([\d.]+)/).flatten.first

    unless version
      return CheckCode::Safe('Target is not Aerospike Database')
    end

    vprint_status("Aerospike Database version #{version}")

    if Rex::Version.new(version) >= Rex::Version.new('5.1.0.3')
      return CheckCode::Safe('Version is not vulnerable')
    end

    unless features.to_s.include?('udf')
      return CheckCode::Safe('User defined functions are not supported')
    end

    CheckCode::Appears
  end
Metasploit Module: Microsoft OMI Management Interface Authentication Bypass
Type: exploit
Path: modules/exploits/linux/misc/cve_2021_38647_omigod.rb
Platform: unix
Disclosure date: 2021-09-14
References: CVE-2021-38647, URL-https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647, URL-https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure, URL-https://censys.io/blog/understanding-the-impact-of-omigod-cve-2021-38647/, URL-https://attackerkb.com/topics/08O94gYdF1/cve-2021-38647
Targets: Unix Command, Linux Dropper

Description:
By removing the authentication header, an attacker can issue an HTTP request to the OMI management endpoint
          that will cause it to execute an operating system command as the root user. This vulnerability was patched in
          OMI version 1.6.8-1 (released September 8th 2021).

Check method (fingerprinting):
http_res = send_command('id')
    return CheckCode::Unknown if http_res.nil?
    return CheckCode::Safe unless http_res.code == 200

    cmd_res = parse_response(http_res)
    return CheckCode::Unknown if cmd_res.nil? || cmd_res[:stdout] !~ /uid=(\d+)\(\S+\) /

    return CheckCode::Vulnerable("Command executed as uid #{Regexp.last_match(1)}.")
  end
Metasploit Module: TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
Type: exploit
Path: modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb
Platform: linux
Disclosure date: 2020-03-25
References: URL-https://www.thezdi.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo, URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md, URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md, URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md, URL-https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md, CVE-2020-10882, CVE-2020-10883, CVE-2020-10884, CVE-2020-28347, ZDI-20-334

Description:
This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on
          the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.
          The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does
          not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command
          as root, including downloading and executing a binary from another host.
          This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro +
          Radek Domanski).
          This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued. The new
          injection technique works on older firmware too. All firmware versions up to (but excluding) releases 201029 and
          201030 are exploitable.

Check method (fingerprinting):
vuln_versions = [
      # older versions not listed here are also vulnerable
      'app[PII_REDACTED]615.manifest',   # A7 191203
      'app[PII_REDACTED]115.manifest',   # A7 200220
      'app[PII_REDACTED]454.manifest',   # A7 200721
      'app[PII_REDACTED]977.manifest',   # C7 190726
      'app[PII_REDACTED]117.manifest',   # C7 201030
    ]

    fixed_versions = [
      'app[PII_REDACTED]713.manifest',   # A7 201029
      'app[PII_REDACTED]315.manifest'    # C7 201030
    ]

    begin
      for version in vuln_versions
        res = send_request_cgi({
          'uri' => "/webpages/#{version}",
          'method' => 'GET',
          'rport' => 80
        })
        if res && res.code == 200
          return Exploit::CheckCode::Vulnerable
        end
      end

      for version in fixed_versions
        res = send_request_cgi({
          'uri' => "/webpages/#{version}",
          'method' => 'GET',
          'rport' => 80
        })
        if res && res.code == 200
          return Exploit::CheckCode::Safe
        end
      end
    rescue ::Rex::ConnectionError
      pass
    end
    return Exploit::CheckCode::Unknown
  end
Metasploit Module: D-Link DIR-859 Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/upnp/dlink_dir859_subscribe_exec.rb
Platform: linux
Disclosure date: 2019-12-24
References: CVE-2019-17621, URL-https://medium.com/@s1kr10s/d94b47a15104

Description:
D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP
          interface. The vulnerability exists in /gena.cgi (function genacgi_main() in
          /htdocs/cgibin), which is accessible without credentials.
Metasploit Module: Belkin Wemo UPnP Remote Code Execution
Type: exploit
Path: modules/exploits/linux/upnp/belkin_wemo_upnp_exec.rb
Platform: unix
Disclosure date: 2014-04-04
References: CVE-2019-12780, URL-https://web.archive.org/web/[PII_REDACTED]4849/http://disconnected.io/2014/04/04/universal-plug-and-fuzz/, URL-https://github.com/phikshun/ufuzz, URL-https://gist.github.com/phikshun/10900566, URL-https://gist.github.com/phikshun/9984624, URL-http://web.archive.org/web/[PII_REDACTED]1809/https://www.crock-pot.com/wemo-landing-page.html, URL-https://www.belkin.com/us/support-article?articleNum=101177, URL-http://www.wemo.com/
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits a command injection in the Belkin Wemo UPnP API via
          the SmartDevURL argument to the SetSmartDevInfo action.

          This module has been tested on a Wemo-enabled Crock-Pot, but other Wemo
          devices are known to be affected, albeit on a different RPORT (49153).

Check method (fingerprinting):
checkcode = CheckCode::Unknown

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/setup.xml'
    )

    unless res && res.code == 200 && res.body.include?('urn:Belkin:device:')
      vprint_error('Wemo-enabled device not detected')
      return checkcode
    end

    vprint_good('Wemo-enabled device detected')
    checkcode = CheckCode::Detected

    version = (v = res.get_xml_document.at('firmwareVersion')&.text) &&
              v =~ /WeMo_WW_(\d+(?:\.\d+)+)/ && ::Regexp.last_match(1) && Rex::Version.new(::Regexp.last_match(1))

    unless version
      vprint_error('Could not determine firmware version')
      return checkcode
    end

    vprint_status("Found firmware version: #{version}")

    # https://www.tripwire.com/state-of-security/featured/my-sector-story-root-shell-on-the-belkin-wemo-switch/
    if version < Rex::Version.new('2.00.8643')
      vprint_good("Firmware version #{version} < 2.00.8643")
      checkcode = CheckCode::Appears
    else
      vprint_error("Firmware version #{version} >= 2.00.8643")
      checkcode = CheckCode::Safe
    end

    checkcode
  end
Metasploit Module: D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi
Type: exploit
Path: modules/exploits/linux/upnp/dlink_dir859_exec_ssdpcgi.rb
Platform: linux
Disclosure date: 2019-12-24
References: CVE-2019-20215, URL-https://medium.com/@s1kr10s/2e799acb8a73

Description:
D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi.
Metasploit Module: MiniUPnPd 1.0 Stack Buffer Overflow Remote Code Execution
Type: exploit
Path: modules/exploits/linux/upnp/miniupnpd_soap_bof.rb
Platform: linux
Disclosure date: 2013-03-27
References: CVE-2013-0230, OSVDB-89624, BID-57608, URL-https://www.rapid7.com/blog/post/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
Targets: Debian GNU/Linux 6.0 / MiniUPnPd 1.0, Airties RT-212 v1.2.0.23 / MiniUPnPd 1.0

Description:
This module exploits the MiniUPnP 1.0 SOAP stack buffer overflow vulnerability
          present in the SOAPAction HTTP header handling.

Check method (fingerprinting):
begin
      res = send_request_cgi({
        'method' => 'POST',
        'uri' => '/'
      })
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Connection failed')
    end

    fingerprints = targets.collect { |t| t['Fingerprint'] }
    fingerprints.delete(nil)

    if res && fingerprints.include?(res.headers['Server'])
      vprint_status("Fingerprint: #{res.headers['Server']}")
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Unknown
  end
Metasploit Module: Adobe Flash Player ActionScript Launch Command Execution Vulnerability
Type: exploit
Path: modules/exploits/linux/browser/adobe_flashplayer_aslaunch.rb
Platform: unix
Disclosure date: 2008-12-17
References: CVE-2008-5499, OSVDB-50796, BID-32896, URL-http://www.adobe.com/support/security/bulletins/apsb08-24.html

Description:
This module exploits a vulnerability in Adobe Flash Player for Linux,
          version 10.0.12.36 and 9.0.151.0 and prior.
          An input validation vulnerability allows command execution when the browser
          loads a SWF file which contains shell metacharacters in the arguments to
          the ActionScript launch method.

          The victim must have Adobe AIR installed for the exploit to work. This module
          was tested against version 10.0.12.36 (10r12_36).
Metasploit Module: Unreal Tournament 2004 "secure" Overflow (Linux)
Type: exploit
Path: modules/exploits/linux/games/ut2004_secure.rb
Platform: linux
Disclosure date: 2004-06-18
References: CVE-2004-0608, OSVDB-7217, BID-10570

Description:
This is an exploit for the GameSpy secure query in
          the Unreal Engine.

          This exploit only requires one UDP packet, which can
          be both spoofed and sent to a broadcast address.
          Usually, the GameSpy query server listens on port 7787,
          but you can manually specify the port as well.

          The RunServer.sh script will automatically restart the
          server upon a crash, giving us the ability to
          bruteforce the service and exploit it multiple
          times.

Check method (fingerprinting):
vers = ut_version

    if !vers
      return CheckCode::Unknown('Could not detect Unreal Tournament Server')
    end

    print_status("Detected Unreal Tournament Server Version: #{vers}")

    if (vers =~ /^(3120|3186|3204)$/)
      return CheckCode::Appears('This system appears to be exploitable')
    end

    if (vers =~ /^(2...)$/)
      return CheckCode::Detected('This system appears to be running UT2003')
    end

    return CheckCode::Safe('This system appears to be patched')
  end
Metasploit Module: Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow
Type: exploit
Path: modules/exploits/linux/telnet/telnet_encrypt_keyid.rb
Platform: linux
Disclosure date: 2011-12-23
References: CVE-2011-4862, OSVDB-78020, BID-51182, EDB-18280

Description:
This module exploits a buffer overflow in the encryption option handler of the
          Linux BSD-derived telnet service (inetutils or krb5-telnet). Most Linux distributions
          use NetKit-derived telnet daemons, so this flaw only applies to a small subset of
          Linux systems running telnetd.
Metasploit Module: GNU Inetutils Telnet Authentication Bypass Exploit CVE-2026-24061
Type: exploit
Path: modules/exploits/linux/telnet/gnu_inetutils_auth_bypass.rb
Platform: %w[unix linux
Disclosure date: 2026-01-26
References: CVE-2026-24061, URL-https://github.com/DeadlyHollows/CVE-2026-24061-setup, URL-https://www.safebreach.com/blog/safebreach-labs-root-cause-analysis-and-poc-exploit-for-cve-2026-24061/

Description:
The telnetd service from GNU InetUtils is vulnerable to authentication-bypass, tracked as CVE-2026-24061, in
          versions up to version 2.7. During Telnet authentication the SB byte can be sent to indicate sub-negotiation which
          allows for the exchange of sub-option parameters after both parties have agreed to enable a specific functional option.
          Environment variables can be sent as sub-options and it's the USER environment variable which introduces the
          authentication bypass in this scenario. When the USER environment variable gets sent to the GNU inetutils telnetd
          service during authentication, the variable gets appended without proper sanitization to an execv call to the
          /usr/bin/login binary. The login binary has a -f flag which skips authentication for a specific user. So the exploit
          sets the `USER` environment variable to -f root and the telnetd service responds with a root shell.
Metasploit Module: NETGEAR TelnetEnable
Type: exploit
Path: modules/exploits/linux/telnet/netgear_telnetenable.rb
Platform: unix
Disclosure date: 2009-10-30
References: URL-https://wiki.openwrt.org/toh/netgear/telnet.console, URL-https://github.com/cyanitol/netgear-telenetenable, URL-https://github.com/insanid/netgear-telenetenable

Description:
This module sends a magic packet to a NETGEAR device to enable telnetd.
          Upon successful connect, a root shell should be presented to the user.

Check method (fingerprinting):
# Run through protocol detection
    detect_proto

    # This is a gamble, but it's the closest we can get
    if @proto == :tcp
      CheckCode::Detected
    else
      CheckCode::Unknown
    end
  end