deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Ubiquiti airOS Arbitrary File Upload
Type: exploit
Path: modules/exploits/linux/http/ubiquiti_airos_file_upload.rb
Platform: unix
Disclosure date: 2016-02-13
References: CVE-2015-9266

Description:
This module exploits a pre-auth file upload to install a new root user
          to /etc/passwd and an SSH key to /etc/dropbear/authorized_keys.

          FYI, /etc/{passwd,dropbear/authorized_keys
Metasploit Module: D-Link Devices Unauthenticated Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/dlink_dir300_exec_telnet.rb
Platform: unix
Disclosure date: 2013-04-22
References: CVE-2013-10050, OSVDB-92698, EDB-25024, BID-59405, URL-http://www.s3cur1ty.de/m1adv2013-014

Description:
Various D-Link Routers are vulnerable to OS command injection via the web
          interface. The vulnerability exists in tools_vct.xgi, which is accessible with
          credentials. According to the vulnerability discoverer, more D-Link devices may
          be affected.
Metasploit Module: DD-WRT HTTP Daemon Arbitrary Command Execution
Type: exploit
Path: modules/exploits/linux/http/ddwrt_cgibin_exec.rb
Platform: unix
Disclosure date: 2009-07-20
References: CVE-2009-2765, OSVDB-55990, BID-35742, EDB-9209

Description:
This module abuses a metacharacter injection vulnerability in the
          HTTP management server of wireless gateways running DD-WRT. This flaw
          allows an unauthenticated attacker to execute arbitrary commands as
          the root user account.
Metasploit Module: Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)
Type: exploit
Path: modules/exploits/linux/http/traccar_rce_upload.rb
Disclosure date: 2024-08-23
References: URL-https://www.horizon3.ai/attack-research/disclosures/traccar-5-remote-code-execution-vulnerabilities/, CVE-2024-31214, CVE-2024-24809
Targets: Linux Command

Description:
Remote Code Execution in Traccar v5.1 - v5.12.
          Remote code execution can be obtained by combining two vulnerabilities: A path traversal vulnerability (CVE-2024-24809) and an unrestricted file upload vulnerability (CVE-2024-31214).
          By default, the application allows self-registration, enabling any user to register an account and exploit the issues. Moreover, the application runs by default with root privileges, potentially resulting in a complete system compromise.
          This module, which should work on any Red Hat-based Linux system, exploits these issues by adding a new cronjob file that executes the specified payload.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/server')
    })

    return CheckCode::Unknown('Could not determine the target status') unless res && res.code == 200

    data = res.get_json_document
    version = data['version']
    if version.nil?
      return CheckCode::Unknown('Could not determine the target status')
    else
      vprint_status('Version retrieved: ' + version)
    end

    unless Rex::Version.new(version).between?(Rex::Version.new('5.1'), Rex::Version.new('5.12'))
      return CheckCode::Safe("Version #{version} is not vulnerable")
    end

    return CheckCode::Appears("Version #{version} appears to be vulnerable")
  end
Metasploit Module: EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution
Type: exploit
Path: modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb
Platform: linux
Disclosure date: 2020-02-06
References: CVE-2020-8654, CVE-2020-8655, CVE-2020-8656, CVE-2020-8657, CVE-2020-9465, EDB-48025, URL-https://github.com/h4knet/eonrce
Targets: Linux (x86), Linux (x64), Linux (cmd)

Description:
This module exploits multiple vulnerabilities in EyesOfNetwork version 5.1, 5.2
          and 5.3 in order to execute arbitrary commands as root.

          This module takes advantage of a command injection vulnerability in the
          `target` parameter of the AutoDiscovery functionality within the EON web
          interface in order to write an Nmap NSE script containing the payload to
          disk. It then starts an Nmap scan to activate the payload. This results in
          privilege escalation because the`apache` user can execute Nmap as root.

          Valid credentials for a user with administrative privileges are required.
          However, this module can bypass authentication via various methods, depending on
          the EON version. EON 5.3 is vulnerable to a hardcoded API key and two SQL
          injection exploits. EON 5.1 and 5.2 can only be exploited via SQL injection.
          This module has been successfully tested on EyesOfNetwork 5.1, 5.2 and 5.3.

Check method (fingerprinting):
vprint_status("Running check")

    res_css = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'css/eonweb.css')

    unless res_css
      return CheckCode::Unknown('Connection failed')
    end

    unless res_css.code == 200
      return CheckCode::Safe('Target is not an EyesOfNetwork application.')
    end

    @version = res_css.body.to_s.split("VERSION :")[1].split(" ")[0]

    if @version.to_s == ''
      return CheckCode::Detected('Could not determine EyesOfNetwork version.')
    end

    if @version == '5.1'
      return CheckCode::Appears("Target is EyesOfNetwork version 5.1.")
    end

    # The css file for EON 5.2 and 5.3 both mentions version 5.2, so additional checks are needed
    if @version != '5.2' # The module only works against EON 5.1, 5.2 and 5.3. Other versions are not considered vulnerable.
      return CheckCode::NotVulnerable("Target is EyesOfNetwork version #{@version} and is not vulnerable.")
    end

    res_api = send_request_cgi 'uri' => normalize_uri(target_uri.path, '/eonapi/getApiKey')

    unless res_api
      return CheckCode::Unknown('Connection failed')
    end

    unless res_api.code == 401 && res_api.body.include?('api_version')
      return CheckCode::Safe('Target is not an EyesOfNetwork application.')
    end

    api_version = res_api.get_json_document()['api_version'] rescue ''

    if api_version.to_s == ''
      return CheckCode::Detected('Could not determine EyesOfNetwork version.')
    end

    api_version = Rex::Version
Metasploit Module: InvokeAI RCE
Type: exploit
Path: modules/exploits/linux/http/invokeai_rce_cve_2024_12029.rb
Disclosure date: 2025-02-07
References: CVE-2024-12029, URL-https://huntr.com/bounties/9b790f94-1b1b-4071-bc27-78445d1a87a3
Targets: Linux Command

Description:
InvokeAI has a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization.
          The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation.
          This functionality allows attackers to embed malicious code in model files that execute upon loading.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/app/version')
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    json_version = res&.get_json_document&.fetch('version', nil)
    return Exploit::CheckCode::Unknown('Failed to parse version.') unless json_version

    version = Rex::Version.new(json_version)
    return Exploit::CheckCode::Unknown('Failed to get version.') unless version

    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version.between?(Rex::Version.new('4.0.0'), Rex::Version.new('5.4.2'))

    Exploit::CheckCode::Appears("Version #{version} detected.")
  end
Metasploit Module: Synology DiskStation Manager SLICEUPLOAD Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb
Platform: unix
Disclosure date: 2013-10-31
References: CVE-2013-6955, OSVDB-101247

Description:
This module exploits a vulnerability found in Synology DiskStation Manager (DSM)
          versions 4.x, which allows the execution of arbitrary commands under root
          privileges.
          The vulnerability is located in /webman/imageSelector.cgi, which allows to append
          arbitrary data to a given file using a so called SLICEUPLOAD functionality, which
          can be triggered by an unauthenticated user with a specially crafted HTTP request.
          This is exploited by this module to append the given commands to /redirect.cgi,
          which is a regular shell script file, and can be invoked with another HTTP request.
          Synology reported that the vulnerability has been fixed with versions 4.0-2259,
          4.2-3243, and 4.3-3810 Update 1, respectively; the 4.1 branch remains vulnerable.

Check method (fingerprinting):
vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('webman', 'info.cgi'),
      'vars_get' => { 'host' => '' }
    })

    if res and res.code == 200 and res.body =~ DEVICE_INFO_PATTERN
      version = "#{$~[:major]}.#{$~[:minor]}"
      build = $~[:build]
      model = $~[:model].sub(/^[a-z]+/) { |s| s[0].upcase }
      model = "DS#{model}" unless model =~ /^[A-Z]/
    else
      vprint_error("Detection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Model #{model} with version #{version}-#{build} detected")

    case version
    when '4.0'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '2259'
    when '4.1'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    when '4.2'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '3243'
    when '4.3'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '3810'
      return Exploit::CheckCode::Detected("Target detected: version #{version}") if build == '3810'
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end
Metasploit Module: Fritz!Box Webcm Unauthenticated Command Injection
Type: exploit
Path: modules/exploits/linux/http/fritzbox_echo_exec.rb
Platform: linux
Disclosure date: 2014-02-11
References: CVE-2014-9727, OSVDB-103289, BID-65520, URL-http://www.kapple.de/?p=75, URL-https://www.speckmarschall.de/hoere.htm, URL-http://pastebin.com/GnMKGmZ2, URL-http://www.avm.de/en/Sicherheit/update_list.html, URL-http://breaking.systems/blog/2014/04/avm-fritzbox-root-rce-from-patch-to-metasploit-module-ii
Targets: MIPS Little Endian, MIPS Big Endian

Description:
Different Fritz!Box devices are vulnerable to an unauthenticated OS command injection.
          This module was tested on a Fritz!Box 7270 from the LAN side. The vendor reported the
          following devices vulnerable: 7570, 7490, 7390, 7360, 7340, 7330, 7272, 7270,
          7170 Annex A A/CH, 7170 Annex B English, 7170 Annex A English, 7140, 7113, 6840 LTE,
          6810 LTE, 6360 Cable, 6320 Cable, 5124, 5113, 3390, 3370, 3272, 3270

Check method (fingerprinting):
begin
      clue = Rex::Text::rand_text_alpha(rand(5) + 5)

      res = send_request_cgi({
        'uri' => '/cgi-bin/webcm',
        'method' => 'GET',
        'vars_get' => {
          "var:lang" => "&echo -e \"\\n\\n#{clue}\""
        }
      })
      if res && res.body =~ /#{clue}/
        return Exploit::CheckCode::Vulnerable('The target is vulnerable')
      end
    rescue ::Rex::ConnectionError
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Cacti 1.2.22 unauthenticated command injection
Type: exploit
Path: modules/exploits/linux/http/cacti_unauthenticated_cmd_injection.rb
Platform: unix
Disclosure date: 2022-12-05
References: CVE-2022-46169, URL-https://github.com/vulhub/vulhub/tree/master/cacti/CVE-2022-46169, URL-https://www.sonarsource.com/blog/cacti-unauthenticated-remote-code-execution
Targets: Automatic (Unix In-Memory), Automatic (Linux Dropper)

Description:
This module exploits an unauthenticated command injection
          vulnerability in Cacti through 1.2.22 (CVE-2022-46169) in
          order to achieve unauthenticated remote code execution as the
          www-data user.

          The module first attempts to obtain the Cacti version to see
          if the target is affected. If LOCAL_DATA_ID and/or HOST_ID
          are not set, the module will try to bruteforce the missing
          value(s). If a valid combination is found, the module will
          use these to attempt exploitation. If LOCAL_DATA_ID and/or
          HOST_ID are both set, the module will immediately attempt
          exploitation.

          During exploitation, the module sends a GET request to
          /remote_agent.php with the action parameter set to polldata
          and the X-Forwarded-For header set to the provided value for
          X_FORWARDED_FOR_IP (by default 127.0.0.1). In addition, the
          poller_id parameter is set to the payload and the host_id
          and local_data_id parameters are set to the bruteforced or
          provided values. If X_FORWARDED_FOR_IP is set to an address
          that is resolvable to a hostname in the poller table, and the
          local_data_id and host_id values are vulnerable, the payload
          set for poller_id will be executed by the target.

          This module has been successfully tested against Cacti
          version 1.2.22 running on Ubuntu 21.10 (vulhub docker image)

Check method (fingerprinting):
# sanity check to see if the target is likely Cacti
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200 && res.body.include?('<title>Login to Cacti')
      return CheckCode::Safe('Target is not a Cacti application.')
    end

    # get the version
    version = res.body.scan(/Version (.*?) \| \(c\)/)&.flatten&.first
    if version.blank?
      return CheckCode::Detected('Could not determine the Cacti version: the HTTP response body did not match the expected format.')
    end

    begin
      if Rex::Version.new(version) <= Rex::Version.new('1.2.22')
        return CheckCode::Appears("The target is Cacti version #{version}")
      else
        return CheckCode::Safe("The target is Cacti version #{version}")
      end
    rescue StandardError => e
      return CheckCode::Unknown("Failed to obtain a valid Cacti version: #{e}")
    end
  end
Metasploit Module: D-Tale RCE
Type: exploit
Path: modules/exploits/linux/http/dtale_rce_cve_2025_0655.rb
Disclosure date: 2025-02-05
References: CVE-2024-3408, CVE-2025-0655, URL-https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91, URL-https://huntr.com/bounties/f63af7bd-5438-4b36-a39b-4c90466cff13
Targets: Linux Command

Description:
This exploit effectively serves as a bypass for CVE-2024-3408.
          An attacker can override global state to enable custom filters, which then facilitates remote code execution.
          Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the enable_custom_filters feature, typically restricted to trusted environments.
          Once enabled, the /test-filter endpoint of the Custom Filters functionality can be exploited to execute arbitrary system commands.

Check method (fingerprinting):
generate_dtale_jwt

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'dtale/popup/upload'),
      'headers' => {
        'Cookie' => "session=#{@session}" # Set the JWT token as a cookie
      }
    })
    return Exploit::CheckCode::Unknown('Could not determine the target status') unless res&.code == 200

    html_document = res.get_html_document
    return Exploit::CheckCode::Unknown('Failed to get html document.') if html_document.blank?

    version_element = html_document.xpath('//*[@id="version"]/@value')
    return Exploit::CheckCode::Unknown('Failed to get version element.') if version_element.blank?

    version = Rex::Version.new(version_element&.text)
    return Exploit::CheckCode::Safe("Version #{version} detected, which is not vulnerable.") unless version <= Rex::Version.new('3.15.1')

    Exploit::CheckCode::Appears("Version #{version} detected.")
  end
Metasploit Module: Nginx HTTP Server 1.3.9-1.4.0 Chunked Encoding Stack Buffer Overflow
Type: exploit
Path: modules/exploits/linux/http/nginx_chunked_size.rb
Platform: unix
Disclosure date: 2013-05-07
References: CVE-2013-2028, OSVDB-93037, URL-http://nginx.org/en/security_advisories.html

Description:
This module exploits a stack buffer overflow in versions 1.3.9 to 1.4.0 of nginx.
          The exploit first triggers an integer overflow in the ngx_http_parse_chunked() by
          supplying an overly long hex value as chunked block size. This value is later used
          when determining the number of bytes to read into a stack buffer, thus the overflow
          becomes possible.

Check method (fingerprinting):
begin
      res = send_request_fixed(nil)

      if res =~ /^Server: nginx\/(1\.3\.(9|10|11|12|13|14|15|16)|1\.4\.0)/m
        return Exploit::CheckCode::Appears('The target appears to be vulnerable')
      elsif res =~ /^Server: nginx/m
        return Exploit::CheckCode::Detected('The target service was detected')
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      vprint_error("Connection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end

  #
  # Generate a random chunk size that will always result
  # in a negative 64bit number when being parsed
  #
Metasploit Module: Pandora FMS Events Remote Command Execution
Type: exploit
Path: modules/exploits/linux/http/pandora_fms_events_exec.rb
Platform: linux
Disclosure date: 2020-06-04
References: CVE-2020-13851, URL-https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities
Targets: Linux (x86), Linux (x64), Linux (cmd)

Description:
This module exploits a vulnerability (CVE-2020-13851) in Pandora
          FMS versions 7.0 NG 742, 7.0 NG 743, and 7.0 NG 744 (and perhaps
          older versions) in order to execute arbitrary commands.

          This module takes advantage of a command injection vulnerability in the
          `Events` feature of Pandora FMS. This flaw allows users to execute
          arbitrary commands via the `target` parameter in HTTP POST requests to
          the `Events` function. After authenticating to the target, the module
          attempts to exploit this flaw by issuing such an HTTP POST request,
          with the `target` parameter set to contain the payload. If a shell is
          obtained, the module will try to obtain the local MySQL database
          password via a simple `grep` command on the plaintext
          `/var/www/html/pandora_console/include/config.php` file.

          Valid credentials for a Pandora FMS account are required. The account
          does not need to have admin privileges.
          This module has been successfully tested on Pandora 7.0 NG 744 running
          on CentOS 7 (the official virtual appliance ISO for this version).

Check method (fingerprinting):
vprint_status('Running check')
    res = send_request_cgi 'uri' => normalize_uri(target_uri.path, 'index.php')

    unless res
      return CheckCode::Unknown('Connection failed.')
    end

    unless res.code == 200 && res.body.include?('<title>Pandora FMS - the Flexible Monitoring System</title>')
      return CheckCode::Safe('Target is not a Pandora FMS application.')
    end

    @cookie = res.get_cookies
    html = res.get_html_document
    full_version = html.at('div[@id="ver_num"]')

    if full_version.blank?
      return CheckCode::Detected('Could not determine the Pandora FMS version.')
    end

    full_version = full_version.text

    version = full_version[1..].sub('NG', '')

    if version.blank?
      return CheckCode::Detected('Could not determine the Pandora FMS version.')
    end

    version = Rex::Version.new version

    unless version <= Rex::Version.new('7.0.744')
      return CheckCode::Safe("Target is Pandora FMS version #{full_version}.")
    end

    CheckCode::Appears("Target is Pandora FMS version #{full_version}.")
  end
Metasploit Module: GroundWork monarch_scan.cgi OS Command Injection
Type: exploit
Path: modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb
Platform: %w{linux unix}
Disclosure date: 2013-03-08
References: CVE-2013-3502, OSVDB-91051, US-CERT-VU-345260, URL-https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt

Description:
This module exploits a vulnerability found in GroundWork 6.7.0. This software
          is used for network, application and cloud monitoring. The vulnerability exists in
          the monarch_scan.cgi where user controlled input is used in the perl qx function.
          This allows any remote authenticated attacker, regardless of privileges, to
          inject system commands and gain arbitrary code execution. The module has been tested
          successfully on GroundWork 6.7.0-br287-gw1571 as distributed within the Ubuntu 10.04
          based VM appliance.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri("josso", "signon", "login.do")
    })

    if res and res.body =~ /GroundWork.*6\.7\.0/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    elsif res and res.body =~ /GroundWork/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end
Metasploit Module: Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection
Type: exploit
Path: modules/exploits/linux/http/symantec_web_gateway_exec.rb
Platform: unix
Disclosure date: 2012-05-17
References: CVE-2012-0297, OSVDB-82925, BID-53444, ZDI-12-090, URL-http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00

Description:
This module exploits a command injection vulnerability found in Symantec Web
          Gateway's HTTP service due to the insecure usage of the exec() function. This module
          abuses the spywall/ipchange.php file to execute arbitrary OS commands without
          authentication.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/spywall/login.php'
    })

    if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
      return Exploit::CheckCode::Detected('The target service was detected')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end