deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Microsoft Exchange ProxyLogon RCE
Type: exploit
Path: modules/exploits/windows/http/exchange_proxylogon_rce.rb
Platform: windows
Disclosure date: 2021-03-02
References: CVE-2021-26855, CVE-2021-27065, URL-https://proxylogon.com/, URL-http://aka.ms/exchangevulns, URL-https://www.praetorian.com/blog/reproducing-proxylogon-exploit, URL-https://testbnull.medium.com/ph%C3%A2n-t%C3%ADch-l%E1%BB%97-h%E1%BB%95ng-proxylogon-mail-exchange-rce-s%E1%BB%B1-k%E1%BA%BFt-h%E1%BB%A3p-ho%C3%A0n-h%E1%BA%A3o-cve-2021-26855-37f4b6e06265, URL-https://www.o2oxy.cn/3169.html, URL-https://github.com/praetorian-inc/proxylogon-exploit, URL-https://github.com/Zeop-CyberSec/proxylogon_writeup
Targets: Windows Powershell, Windows Dropper, Windows Command

Description:
This module exploit a vulnerability on Microsoft Exchange Server that
          allows an attacker bypassing the authentication, impersonating as the
          admin (CVE-2021-26855) and write arbitrary file (CVE-2021-27065) to get
          the RCE (Remote Code Execution).

          By taking advantage of this vulnerability, you can execute arbitrary
          commands on the remote Microsoft Exchange Server.

          This vulnerability affects (Exchange 2013 Versions < 15.00.1497.012,
          Exchange 2016 CU18 < 15.01.2106.013, Exchange 2016 CU19 < 15.01.2176.009,
          Exchange 2019 CU7 < 15.02.0721.013, Exchange 2019 CU8 < 15.02.0792.010).

          All components are vulnerable by default.
Metasploit Module: Easy File Sharing HTTP Server 7.2 POST Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/easyfilesharing_post.rb
Platform: win
Disclosure date: 2017-06-12
References: CVE-2025-34096, EDB-42186

Description:
This module exploits a POST buffer overflow in the Easy File Sharing FTP Server 7.2 software.
Metasploit Module: ZenTao Pro 8.8.2 Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/zentao_pro_rce.rb
Platform: win
Disclosure date: 2020-06-20
References: EDB-48633, CVE-2020-7361
Targets: Windows (x86), Windows (x64)

Description:
This module exploits a command injection vulnerability in ZenTao Pro
          8.8.2 and earlier versions in order to execute arbitrary commands with
          SYSTEM privileges.

          The module first attempts to authenticate to the ZenTao dashboard. It
          then tries to execute the payload by submitting fake repositories via
          the 'Repo Create' function that is accessible from the dashboard via
          CI>Repo. More precisely, the module sends HTTP POST requests to
          '/pro/repo-create.html' that inject commands in the vulnerable 'path'
          parameter which corresponds to the 'Client Path' input field.

          Valid credentials for a ZenTao admin account are required. This module
          has been successfully tested against ZenTao 8.8.1 and 8.8.2 running on
          Windows 10 (XAMPP server).

Check method (fingerprinting):
vprint_status('Running check')

    # visit login the page to get the necessary cookies
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'user-login.html')
    unless res
      return CheckCode::Unknown('Connection failed')
    end

    cookie = res.get_cookies
    if cookie.blank?
      return CheckCode::Unknown('Unable to retrieve HTTP cookie header')
    end

    # check if the language is set to English, otherwise change it to English
    unless cookie.scan(/lang=(.*?);/).flatten.first == 'en-US'
      cookie.gsub!(/lang=(.*?);/, 'lang=en;')
      res = send_request_cgi({
        'method' => 'GET',
        'uri' => normalize_uri(target_uri.path, 'score-ajax-selectLang.html'),
        'cookie' => cookie
      })

      unless res
        return CheckCode::Unknown('Connection failed')
      end

      @cookie = res.get_cookies
      if @cookie.blank?
        return CheckCode::Unknown('Unable to change the application language to English. Target may not be a ZenTao application')
      end
    end

    # visit login page to check ZenTao version
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'user-login.html'),
      'cookie' => @cookie
    })

    unless res
      return CheckCode::Unknown('Connection failed')
    end

    unless res.code == 200 && res.body.include?('Login - ZenTao')
      return CheckCode::Safe('Target is not a ZenTao application.')
    end

    # obtain cookie and random value necessary
Metasploit Module: SharePoint DataSet / DataTable Deserialization
Type: exploit
Path: modules/exploits/windows/http/sharepoint_data_deserialization.rb
Platform: win
Disclosure date: 2020-07-14
References: CVE-2020-1147, URL-https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html
Targets: Windows EXE Dropper, Windows Command, Windows Powershell

Description:
A remotely exploitable vulnerability exists within SharePoint that can be leveraged by a remote authenticated
          attacker to execute code within the context of the SharePoint application service. The privileges in this
          execution context are determined by the account that is specified when SharePoint is installed and configured.
          The vulnerability is related to a failure to validate the source of XML input data, leading to an unsafe
          deserialization operation that can be triggered from a page that initializes either the
          ContactLinksSuggestionsMicroView type or a derivative of it. In a default configuration, a Domain User account
          is sufficient to access SharePoint and exploit this vulnerability.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, '_layouts', '15', 'quicklinks.aspx'),
      'username' => datastore['USERNAME'],
      'password' => datastore['PASSWORD'],
      'vars_get' => {
        'Mode' => 'Suggestion'
      }
    })

    return CheckCode::Unknown('Failed to authenticate to the server.') if res&.code == 401
    return CheckCode::Safe('Failed to identify that SharePoint is running.') unless res&.code == 200 && res.headers['MicrosoftSharePointTeamServices']

    html = res.get_html_document
    return CheckCode::Safe('Quicklinks form not found in response') if html.xpath('//html/body/form[@action]').select do |node|
      node['action'] =~ /quicklinks.aspx\?Mode=Suggestion/i
    end.empty?

    CheckCode::Detected('Received the quicklinks HTML form.')
  end
Metasploit Module: TrackerCam PHP Argument Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/trackercam_phparg_overflow.rb
Platform: win
Disclosure date: 2005-02-18
References: CVE-2005-0478, OSVDB-13953, OSVDB-13955, BID-12592, URL-http://aluigi.altervista.org/adv/tcambof-adv.txt

Description:
This module exploits a simple stack buffer overflow in the
          TrackerCam web server. All current versions of this software
          are vulnerable to a large number of security issues. This
          module abuses the directory traversal flaw to gain
          information about the system and then uses the PHP overflow
          to execute arbitrary code.

Check method (fingerprinting):
res = send_request_raw({
      'uri' => '/tuner/ComGetLogFile.php3',
      'query' => 'fn=../HTTPRoot/socket.php3'
    }, 5)

    if (res and res.body =~ /fsockopen/)
      fp = fingerprint()
      vprint_status("Detected a vulnerable TrackerCam installation on #{fp}")
      return Exploit::CheckCode::Detected('Target service detected')
    end
    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: NETGEAR ProSafe Network Management System 300 Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/netgear_nms_rce.rb
Platform: win
Disclosure date: 2016-02-04
References: ZDI-23-920, ZDI-23-918, CVE-2023-38096, CVE-2023-38098, CVE-2016-1525, US-CERT-VU-777024, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/netgear_nms_rce.txt, URL-https://seclists.org/fulldisclosure/2016/Feb/30, URL-https://kb.netgear.com/000065707/Security-Advisory-for-Multiple-Vulnerabilities-on-the-ProSAFE-Network-Management-System-PSV-2023-0024-PSV-2023-0025

Description:
Netgear's ProSafe NMS300 is a network management utility that runs on Windows systems.
          The application has multiple vulnerabilities that can allow an unauthenticated remote
          attacker to execute code as SYSTEM user. Vulnerabilities include authentication bypass,
          SQL injection, arbitrary file upload, and privilege escalation across various versions.
          This module is able to spawn a meterpreter session by chaining together two specific
          vulnerabilities inside the FileUploadController and MyHandlerInterceptor classes.
          This module has been tested with versions 1.5.0.2, 1.4.0.17, 1.1.0.13, 1.7.0.12, and 1.7.0.1.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(datastore['TARGETURI'], 'userSession.do/../fileUpload.do'),
      'method' => 'POST',
      'vars_get' => { 'method' => 'loginHtml' } # This is required for auth bypass above v1.5.0.11
    })
    if res && res.code == 200 # if this endpoint returns 200 than we can exploit all targets
      Exploit::CheckCode::Detected('Target service detected')
    else
      Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Novell iManager getMultiPartParameters Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/novell_imanager_upload.rb
Disclosure date: 2010-10-01
References: OSVDB-68320, ZDI-10-190, URL-http://www.novell.com/support/viewContent.do?externalId=7006515&sliceId=2
Targets: Universal Windows Target

Description:
This module exploits a directory traversal vulnerability which
          allows remote attackers to upload and execute arbitrary code.

          PortalModuleInstallManager
Metasploit Module: NetDecision 4.5.1 HTTP Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/netdecision_http_bof.rb
Platform: win
Disclosure date: 2012-02-24
References: CVE-2012-1465, OSVDB-79651, URL-http://web.archive.org/web/[PII_REDACTED]4508/http://secunia.com/advisories/48168/, URL-http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt

Description:
This module exploits a vulnerability found in NetDecision's HTTP service
          (located in C:\Program Files\NetDecision\Bin\HttpSvr.exe).  By supplying a
          long string of data to the URL, an overflow may occur if the data gets handled
          by HTTP Server's active window.  In other words, in order to gain remote code
          execution, the victim is probably looking at HttpSvr's window.

Check method (fingerprinting):
res = send_request_cgi({ 'uri' => '/' })
    banner = res.headers['Server']
    if banner =~ /NetDecision\-HTTP\-Server\/1\.0/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: Git Remote Code Execution via git-lfs (CVE-2020-27955)
Type: exploit
Path: modules/exploits/windows/http/git_lfs_rce.rb
Platform: win
Disclosure date: 2020-11-04
References: CVE-2020-27955, URL-https://www.helpnetsecurity.com/2020/11/05/cve-2020-27955/

Description:
A critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for
          versioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked
          into cloning the attacker's malicious repository using a vulnerable Git version control tool
Metasploit Module: IBM TPM for OS Deployment 5.1.0.x rembo.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/ibm_tpmfosd_overflow.rb
Platform: win
Disclosure date: 2007-05-02
Authors: toto
References: CVE-2007-1868, OSVDB-34678, BID-23264, URL-http://dvlabs.tippingpoint.com/advisory/TPTI-07-05

Description:
This is a stack buffer overflow exploit for IBM Tivoli Provisioning Manager
          for OS Deployment version 5.1.0.X.
Metasploit Module: Zoho Password Manager Pro XML-RPC Java Deserialization
Type: exploit
Path: modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb
Platform: win
Disclosure date: 2022-06-24
References: CVE-2022-35405, URL-https://xz.aliyun.com/t/11578, URL-https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html, URL-https://archives2.manageengine.com/passwordmanagerpro/12101/ManageEngine_PasswordManager_Pro_12100_to_12101.ppm
Targets: Windows EXE Dropper, Windows Command, Windows Powershell

Description:
This module exploits a Java deserialization vulnerability in Zoho ManageEngine Pro
          before 12101 and PAM360 before 5510. Unauthenticated attackers can send a
          crafted XML-RPC request containing malicious serialized data to /xmlrpc to
          gain RCE as the SYSTEM user.

Check method (fingerprinting):
# Send an empty serialized object
    res = send_request_xmlrpc('')

    unless res
      return CheckCode::Unknown('Target did not respond to check.')
    end

    if res.body.include?('Failed to read result object: null')
      return CheckCode::Vulnerable('Target can deserialize arbitrary data.')
    end

    CheckCode::Safe('Target cannot deserialize arbitrary data.')
  end
Metasploit Module: EasyFTP Server list.html path Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/easyftp_list.rb
Platform: win
Disclosure date: 2010-02-18
References: CVE-2010-20113, OSVDB-66614, EDB-11500

Description:
This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
          and earlier. EasyFTP fails to check input size when parsing the 'path' parameter
          supplied to an HTTP GET request, which leads to a stack based buffer overflow.
          EasyFTP allows anonymous access by default; valid credentials are typically
          unnecessary to exploit this vulnerability.

          After version 1.7.0.12, this package was renamed "UplusFtp".

          Due to limited space, as well as difficulties using an egghunter, the use of
          staged, ORD, and/or shell payloads is recommended.

Check method (fingerprinting):
info = http_fingerprint # check method
    if info and (info =~ /Easy\-Web Server\//)
      return Exploit::CheckCode::Detected('Target service detected')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: BEA Weblogic Transfer-Encoding Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/bea_weblogic_transfer_encoding.rb
Platform: win
Disclosure date: 2008-09-09
Authors: pusscat
References: CVE-2008-4008, OSVDB-49283

Description:
This module exploits a stack based buffer overflow in the BEA
          Weblogic Apache plugin.  This vulnerability exists in the
          error reporting for unknown Transfer-Encoding headers.
          You may have to run this twice due to timing issues with handlers.
Metasploit Module: NaviCOPA 2.0.1 URL Handling Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/navicopa_get_overflow.rb
Platform: win
Disclosure date: 2006-09-28
Authors: MC
References: CVE-2006-5112, OSVDB-29257, BID-20250

Description:
This module exploits a stack buffer overflow in NaviCOPA 2.0.1.
          The vulnerability is caused due to a boundary error within the
          handling of URL parameters.

Check method (fingerprinting):
connect

    sock.put("GET / HTTP/1.0\r\n\r\n")
    resp = sock.get_once
    disconnect

    if (resp =~ /2\.01 11th September/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Kaseya VSA uploader.aspx Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/kaseya_uploader.rb
Platform: win
Disclosure date: 2015-09-23
References: CVE-2015-6922, ZDI-15-449, URL-https://raw.githubusercontent.com/pedrib/PoC/master/advisories/Kaseya/kaseya-vsa-vuln-2.txt, URL-https://seclists.org/bugtraq/2015/Sep/132

Description:
This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions
          between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary
          directory leading to arbitrary code execution with IUSR privileges. This module has been
          tested with Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('ConfigTab', 'uploader.aspx')
    })

    if res && res.code == 302 && res.body && res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/
      return Exploit::CheckCode::Detected('Target service detected')
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end
  end
Metasploit Module: Alt-N WebAdmin USER Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/altn_webadmin.rb
Platform: win
Disclosure date: 2003-06-24
References: CVE-2003-0471, OSVDB-2207, BID-8024, URL-http://www.nessus.org/plugins/index.php?view=single&id=11771

Description:
Alt-N WebAdmin is prone to a buffer overflow condition. This
          is due to insufficient bounds checking on the USER
          parameter. Successful exploitation could result in code
          execution with SYSTEM level privileges.
Metasploit Module: Generic Web Application DLL Injection
Type: exploit
Path: modules/exploits/windows/http/generic_http_dll_injection.rb
Platform: win
Disclosure date: 2015-03-04
Targets: Windows x86, Windows x64

Description:
This is a general-purpose module for exploiting conditions where a HTTP request
          triggers a DLL load from an specified SMB share. This module serves payloads as
          DLLs over an SMB service and allows an arbitrary HTTP URL to be called that would
          trigger the load of the DLL.
Metasploit Module: Private Wire Gateway Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/privatewire_gateway.rb
Platform: win
Disclosure date: 2006-06-26
Authors: Michael Thumann <mthumann[at]ernw.de>
References: CVE-2006-3252, OSVDB-26861, BID-18647

Description:
This exploits a buffer overflow in the ADMCREG.EXE used
          in the PrivateWire Online Registration Facility.
Metasploit Module: HP NNM CGI webappmon.exe OvJavaLocale Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_webappmon_ovjavalocale.rb
Platform: win
Disclosure date: 2010-08-03
References: CVE-2010-2709, OSVDB-66932, BID-42154, URL-http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02446520, URL-http://www.coresecurity.com/content/hp-nnm-ovjavalocale-buffer-overflow

Description:
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.53.
          By sending a request containing a cookie longer than 5120 bytes, an attacker can overflow
          a stack buffer and execute arbitrary code.

          The vulnerable code is within the OvWwwDebug function. The static-sized stack buffer is
          declared within this function. When the vulnerability is triggered, the stack trace looks
          like the following:

          #0 ...
          #1 sprintf_new(local_stack_buf, fmt, cookie);
          #2 OvWwwDebug("   HTTP_COOKIE=%s\n", cookie);
          #3 ?OvWwwInit@@YAXAAHQAPADPBD@Z(x, x, x);
          #4 sub_405ee0("nnm", "webappmon");

          No validation is done on the cookie argument. There are no stack cookies, so exploitation
          is easily achieved by overwriting the saved return address or SEH frame.

          The original advisory detailed an attack vector using the "OvJavaLocale" cookie being
          passed in a request to "webappmon.exe". Further research shows that several different
          cookie values, as well as several different CGI applications, can be used.
          '
Metasploit Module: Exchange Control Panel ViewState Deserialization
Type: exploit
Path: modules/exploits/windows/http/exchange_ecp_viewstate.rb
Platform: win
Disclosure date: 2020-02-11
Authors: Spencer McIntyre
References: CVE-2020-0688, URL-https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys
Targets: Windows (x86), Windows (x64), Windows (cmd)

Description:
This module exploits a .NET serialization vulnerability in the
          Exchange Control Panel (ECP) web page. The vulnerability is due to
          Microsoft Exchange Server not randomizing the keys on a
          per-installation basis resulting in them using the same validationKey
          and decryptionKey values. With knowledge of these values, an attacker
          can craft a special ViewState to cause an OS command to be executed
          by NT_AUTHORITY\SYSTEM using .NET deserialization.

Check method (fingerprinting):
state = get_request_setup
    viewstate = state[:viewstate]
    return CheckCode::Unknown('Could not retrieve ViewState') if viewstate.nil?

    viewstate = Rex::Text.decode_base64(viewstate)
    body = viewstate[0...-20]
    signature = viewstate[-20..-1]

    unless generate_viewstate_signature(state[:viewstate_generator], state[:session_id], body) == signature
      return CheckCode::Safe('Target is not vulnerable')
    end

    # we've validated the signature matches based on the data we have and thus
    # proven that we are capable of signing a viewstate ourselves
    CheckCode::Vulnerable('Target is vulnerable')
  end
Metasploit Module: Sitecore XP CVE-2025-34511 Post-Authentication File Upload
Type: exploit
Path: modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb
Platform: win
Disclosure date: 2025-06-17
References: CVE-2025-34511, URL-https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform, URL-https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667
Targets: Windows

Description:
This module exploits CVE-2025-34511, a file upload vulnerability in PowerShell extensions. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold.

Check method (fingerprinting):
return Exploit::CheckCode::Unknown('Could not log in, application might not be Sitecore') unless login_identitysrv('ServicesAPI', 'b')

    @is_logged = true

    return Exploit::CheckCode::Safe('Could not get elevated cookies') unless get_identity_cookies

    @is_elevated = true

    sitecore_version = get_version

    res = send_request_cgi({
      'uri' => normalize_uri('sitecore%20modules', 'Shell', 'PowerShell', 'UploadFile', 'PowerShellUploadFile2.aspx'),
      'method' => 'GET',
      'vars_get' => { 'hdl' => '[PII_REDACTED]' }
    })

    return Exploit::CheckCode::Safe('PowerShell extension not detected, might not be installed in target Sitecore instance') unless res&.code == 200

    return Exploit::CheckCode::Vulnerable("Sitecore version detected #{sitecore_version}, which is vulnerable") if sitecore_version.between?(Rex::Version.new('10.0.0'), Rex::Version.new('10.4'))

    Exploit::CheckCode::Safe("Detected Sitecore version #{sitecore_version}, which is not vulnerable")
  end
Metasploit Module: SQL Server Reporting Services (SSRS) ViewState Deserialization
Type: exploit
Path: modules/exploits/windows/http/ssrs_navcorrector_viewstate.rb
Platform: win
Disclosure date: 2020-02-11
References: CVE-2020-0618, URL-https://www.mdsec.co.uk/2020/02/cve-2020-0618-rce-in-sql-server-reporting-services-ssrs/
Targets: Windows (x86), Windows (x64), Windows (cmd)

Description:
A vulnerability exists within Microsoft's SQL Server Reporting Services
          which can allow an attacker to craft an HTTP POST request with a
          serialized object to achieve remote code execution. The vulnerability is
          due to the fact that the serialized blob is not signed by the server.

Check method (fingerprinting):
json_response = send_api_request('ReportServerInfo', 'Model.SiteName')
    return CheckCode::Unknown('SQL Server Reporting Services not detected') unless json_response && json_response['value'] == 'SQL Server Reporting Services'

    CheckCode::Detected('Target service detected')
  end