deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Local Privilege Escalation in polkits pkexec
Type: exploit
Path: modules/exploits/linux/local/cve_2021_4034_pwnkit_lpe_pkexec.rb
Disclosure date: 2022-01-25
References: CVE-2021-4034, URL-https://www.whitesourcesoftware.com/resources/blog/polkit-pkexec-vulnerability-cve-2021-4034/, URL-https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt, URL-https://github.com/arthepsy/CVE-2021-4034, URL-https://www.ramanean.com/script-to-detect-polkit-vulnerability-in-redhat-linux-systems-pwnkit/, URL-https://github.com/cyberark/PwnKit-Hunter/blob/main/CVE-2021-4034_Finder.py
Targets: x86_64, x86, aarch64

Description:
A bug exists in the polkit pkexec binary in how it processes arguments.  If
          the binary is provided with no arguments, it will continue to process environment
          variables as argument variables, but without any security checking.
          By using the execve call we can specify a null argument list and populate the
          proper environment variables.  This exploit is architecture independent.

Check method (fingerprinting):
# Is the arch supported?
    arch = kernel_hardware
    unless arch.include?('x86_64') || arch.include?('aarch64') || arch.include?('x86')
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end

    # check the binary
    pkexec_path = datastore['PKEXEC_PATH']
    pkexec_path = find_pkexec if pkexec_path.empty?
    return CheckCode::Safe('The pkexec binary was not found; try populating PkexecPath') if pkexec_path.nil?

    # we don't use the reported version, but it can help with troubleshooting
    version_output = cmd_exec("#{pkexec_path} --version")
    version_array = version_output.split(' ')
    if version_array.length > 2
      pkexec_version = Rex::Version.new(version_array[2])
      vprint_status("Found pkexec version #{pkexec_version}")
    end

    return CheckCode::Safe('The pkexec binary setuid is not set') unless setuid?(pkexec_path)

    # Grab the package version if we can to help troubleshoot
    sysinfo = get_sysinfo
    begin
      if sysinfo[:distro] =~ /[dD]ebian/
        vprint_status('Determined host os is Debian')
        package_data = cmd_exec('dpkg -s policykit-1')
        pulled_version = package_data.scan(/Version:\s(.*)/)[0][0]
        vprint_status("Polkit package version = #{pulled_version}")
      end
      if sysinfo[:distro] =~ /[uU]buntu/
        vprint_status('Determined host os is Ubuntu')
        package_data = cmd_exec('dpkg -s policykit-1')
        pulled_version = package_data.scan(/Version:\s(.*)/)[0][0]
Metasploit Module: Exim 4.87 - 4.91 Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/exim4_deliver_message_priv_esc.rb
Disclosure date: 2019-06-05
References: CVE-2019-10149, EDB-46996, URL-https://www.openwall.com/lists/oss-security/2019/06/06/1

Description:
This module exploits a flaw in Exim versions 4.87 to 4.91 (inclusive).
          Improper validation of recipient address in deliver_message()
          function in /src/deliver.c may lead to command execution with root privileges
          (CVE-2019-10149).

Check method (fingerprinting):
if session.type == 'meterpreter'
      begin
        socket_subsystem, socket = open_tcp_connection
      rescue StandardError
        return CheckCode::Safe('Could not connect to Exim service')
      end
      res = socket.gets
      socket.close
      socket_subsystem.shutdown
    else
      unless command_exists?('/bin/bash')
        return CheckCode::Safe('bash not found')
      end

      res = cmd_exec("/bin/bash -c 'exec 3</dev/tcp/localhost/#{datastore['EXIMPORT']} && "\
                     "(read -u 3 && echo $REPLY) || echo false'")
      if res == 'false'
        vprint_error("Couldn't connect to port #{datastore['EXIMPORT']}, "\
                     'are you sure exim is listening on this port? (see EXIMPORT)')
        return CheckCode::Safe('Could not connect to Exim service')
      end
    end

    if res =~ /Exim ([0-9\.]+)/i
      version = Rex::Version.new(Regexp.last_match(1))
      vprint_status("Found exim version: #{version}")
      if version >= target[:lower_version] && version <= target[:upper_version]
        return CheckCode::Appears("Exim version #{version} appears to be vulnerable")
      else
        return CheckCode::Safe("Exim version #{version} is not vulnerable")
      end
    end

    CheckCode::Unknown('Could not determine Exim version')
  end
Metasploit Module: Reptile Rootkit reptile_cmd Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/reptile_rootkit_reptile_cmd_priv_esc.rb
Platform: linux
Disclosure date: 2018-10-29
References: URL-https://github.com/f0rb1dd3n/Reptile, URL-https://github.com/f0rb1dd3n/Reptile/wiki/Usage

Description:
This module uses Reptile rootkit's `reptile_cmd` backdoor executable
          to gain root privileges using the `root` command.

          This module has been tested successfully with Reptile from `master`
          branch (2019-03-04) on Ubuntu 18.04.3 (x64) and Linux Mint 19 (x64).

Check method (fingerprinting):
unless executable? reptile_cmd_path
      vprint_error "#{reptile_cmd_path} is not executable"
      return CheckCode::Safe('reptile_cmd is not executable')
    end
    vprint_good "#{reptile_cmd_path} is executable"

    res = cmd_exec("echo id|#{reptile_cmd_path} root").to_s.strip
    vprint_status "Output: #{res}"

    if res.include?('You have no power here!')
      vprint_error 'Reptile kernel module is not loaded'
      return CheckCode::Safe('Reptile kernel module is not loaded')
    end

    unless res.include?('root')
      vprint_error 'Reptile is not installed'
      return CheckCode::Safe('Reptile is not installed')
    end
    vprint_good 'Reptile is installed and loaded'

    CheckCode::Vulnerable('Target is vulnerable')
  end
Metasploit Module: F5 Big-IP Create Admin User
Type: exploit
Path: modules/exploits/linux/local/f5_create_user.rb
Disclosure date: 2022-11-16
Authors: Ron Bowes
References: URL-https://github.com/rbowes-r7/refreshing-mcp-tool, URL-https://www.rapid7.com/blog/post/2022/11/16/cve-2022-41622-and-cve-2022-41800-fixed-f5-big-ip-and-icontrol-rest-vulnerabilities-and-exposures/, URL-https://support.f5.com/csp/article/K97843387

Description:
This creates a local user with a username/password and root-level
          privileges. Note that a root-level account is not required to do this,
          which makes it a privilege escalation issue.

          Note that this is pretty noisy, since it creates a user account and
          creates log files and such. Additionally, most (if not all)
          vulnerabilities in F5 grant root access anyways.

          Adapted from https://github.com/rbowes-r7/refreshing-mcp-tool/blob/main/mcp-privesc.rb
Metasploit Module: Linux Kernel Sendpage Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/sock_sendpage.rb
Disclosure date: 2009-08-13
References: CVE-2009-2692, EDB-9545, EDB-9641, BID-36038, URL-https://www.securityfocus.com/archive/1/505751, URL-http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
Targets: Linux x86

Description:
The Linux kernel failed to properly initialize some entries in the
          proto_ops struct for several protocols, leading to NULL being
          dereferenced and used as a function pointer. By using mmap(2) to map
          page 0, an attacker can execute arbitrary code in the context of the
          kernel.

          Several public exploits exist for this vulnerability, including
          spender's wunderbar_emporium and rcvalle's ppc port, sock_sendpage.c.

          All Linux 2.4/2.6 versions since May 2001 are believed to be affected:
          2.4.4 up to and including 2.4.37.4; 2.6.0 up to and including 2.6.30.4

          This module has been tested successfully on CentOS 5.0 (i386) with
          kernel version 2.6.18-8.1.1.tl5; and Debian 3.1r8 Sarge (i686) with
          kernel version 2.4.27-3-386.

Check method (fingerprinting):
version = Rex::Version.new kernel_release.split('-').first

    if version.to_s.eql? ''
      vprint_error 'Could not determine the kernel version'
      return CheckCode::Unknown('Could not determine kernel version')
    end

    if version.between?(Rex::Version.new('2.4.4'), Rex::Version.new('2.4.37.4')) ||
       version.between?(Rex::Version.new('2.6.0'), Rex::Version.new('2.6.30.4'))
      vprint_good "Kernel version #{version} appears to be vulnerable"
    else
      vprint_error "Kernel version #{version} is not vulnerable"
      return CheckCode::Safe("Kernel version #{version} is not vulnerable")
    end

    arch = kernel_hardware
    unless arch.include?('x86') || arch =~ /i\d86/
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    if arch.include? 'x86_64'
      vprint_error "System architecture #{arch} is not supported"
      return CheckCode::Safe("System architecture #{arch} is not supported")
    end
    vprint_good "System architecture #{arch} is supported"

    mmap_min_addr_path = '/proc/sys/vm/mmap_min_addr'
    if file_exist? mmap_min_addr_path
      mmap_min_addr = read_file mmap_min_addr_path
    else
      mmap_min_addr = ''
    end

    case mmap_min_addr
    when ''
      vprint_good 'vm.mmap_min_addr is not set'
    when '0'
      vprint_good 'vm.mmap_min_addr is zero'
    else
      vprint_error "vm.mmap_min_addr (#{mmap_min_addr}) is not zero"
Metasploit Module: Linux Nested User Namespace idmap Limit Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/nested_namespace_idmap_limit_priv_esc.rb
Platform: linux
Disclosure date: 2018-11-15
References: BID-105941, CVE-2018-18955, EDB-45886, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1712, URL-https://github.com/bcoles/kernel-exploits/tree/master/CVE-2018-18955, URL-https://lwn.net/Articles/532593/, URL-https://bugs.launchpad.net/bugs/1801924, URL-https://people.canonical.com/~ubuntu-security/cve/CVE-2018-18955, URL-https://security-tracker.debian.org/tracker/CVE-2018-18955, URL-https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d2f007dbe7e4c9583eea6eb04d60001e85c6f1bd

Description:
This module exploits a vulnerability in Linux kernels 4.15.0 to 4.18.18,
          and 4.19.0 to 4.19.1, where broken uid/gid mappings between nested user
          namespaces and kernel uid/gid mappings allow elevation to root
          (CVE-2018-18955).

          The target system must have unprivileged user namespaces enabled and
          the newuidmap and newgidmap helpers installed (from uidmap package).

          This module has been tested successfully on:

          Fedora Workstation 28 kernel 4.16.3-301.fc28.x86_64;
          Kubuntu 18.04 LTS kernel 4.15.0-20-generic (x86_64);
          Linux Mint 19 kernel 4.15.0-20-generic (x86_64);
          Ubuntu Linux 18.04.1 LTS kernel 4.15.0-20-generic (x86_64).

Check method (fingerprinting):
['/usr/bin/newuidmap', '/usr/bin/newgidmap'].each do |path|
      return CheckCode::Safe("#{path} file not found") unless file? path
      return CheckCode::Safe("#{path} is not setuid") unless setuid? path

      vprint_good "#{path} is set-uid"
    end

    # Patched in 4.18.19 and 4.19.2
    release = kernel_release
    v = Rex::Version.new release.split('-').first
    if v < Rex::Version.new('4.15') ||
       v >= Rex::Version.new('4.19.2') ||
       (v >= Rex::Version.new('4.18.19') && v < Rex::Version.new('4.19'))
      vprint_error "Kernel version #{release} is not vulnerable"
      return CheckCode::Safe("Kernel version #{release} is not vulnerable")
    end
    vprint_good "Kernel version #{release} appears to be vulnerable"

    config = kernel_config
    if config.nil?
      vprint_error 'Could not retrieve kernel config'
      return CheckCode::Unknown('Could not retrieve kernel config')
    end

    unless config.include? 'CONFIG_USER_NS=y'
      vprint_error 'Kernel config does not include CONFIG_USER_NS'
      return CheckCode::Safe('Kernel config does not include CONFIG_USER_NS')
    end
    vprint_good 'Kernel config has CONFIG_USER_NS enabled'

    unless userns_enabled?
      vprint_error 'Unprivileged user namespaces are not permitted'
      return CheckCode::Safe('Unprivileged user namespaces are not permitted')
    end
    vprint_good 'Unprivileged user namespaces are permitted'

    CheckCode::Appears("Kernel version #{release} appears to be vulnerable"
Metasploit Module: IGEL OS Privilege Escalation (via systemd service)
Type: exploit
Path: modules/exploits/linux/local/igel_network_priv_esc.rb
Platform: linux
Disclosure date: 2024-07-10
Authors: Zack Didcott
Targets: Linux x86_64

Description:
Escalate privileges for IGEL OS Workspace Edition sessions, by modifying
          network-manager.service using setup_cmd (SUID) and network, then restarting
          the service.

Check method (fingerprinting):
version = Rex::Version.new(
      read_file('/etc/system-release').delete_prefix('IGEL OS').strip
    )
    unless version < Rex::Version.new('11.10.150')
      return CheckCode::Safe("IGEL OS #{version} is not vulnerable")
    end

    CheckCode::Appears("IGEL OS #{version} should be vulnerable")
  end
Metasploit Module: VMware Workspace ONE Access CVE-2022-22960
Type: exploit
Path: modules/exploits/linux/local/vmware_workspace_one_access_cve_2022_22960.rb
Platform: unix
Disclosure date: 2022-04-06
References: CVE-2022-22960, URL-https://srcincite.io/blog/2022/08/11/i-am-whoever-i-say-i-am-infiltrating-vmware-workspace-one-access-using-a-0-click-exploit.html#dbconnectioncheckcontroller-dbcheck-jdbc-injection-remote-code-execution, URL-https://github.com/sourceincite/hekate/, URL-https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Targets: Unix Command, Linux Dropper

Description:
This module exploits CVE-2022-22960 which allows the user to overwrite the permissions of the
            certproxyService.sh script so that it can be modified by the horizon user. This allows a local attacker with
            the uid 1001 to escalate their privileges to root access.

Check method (fingerprinting):
unless whoami == 'horizon'
      return Exploit::CheckCode::Safe('Not running as the horizon user.')
    end

    test = cmd_exec("sudo #{TARGET_FILE}")
    unless test.include? 'basename: missing operand'
      return Exploit::CheckCode::Safe('Target does not appear vulnerable')
    end

    Exploit::CheckCode::Appears('vulnerable')
  end
Metasploit Module: GameOver(lay) Privilege Escalation and Container Escape
Type: exploit
Path: modules/exploits/linux/local/gameoverlay_privesc.rb
Platform: linux
Disclosure date: 2023-07-26
References: URL-https://www.crowdstrike.com/blog/crowdstrike-discovers-new-container-exploit/, URL-https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629, URL-https://www.cvedetails.com/cve/CVE-2023-2640/, URL-https://www.cvedetails.com/cve/CVE-2023-32629/, URL-https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability, CVE-2023-32629, CVE-2023-2640
Targets: Linux_Binary, Linux_Command

Description:
This module exploits the use of unsafe functions in a number of Ubuntu kernels
          utilizing vulnerable versions of overlayfs. To mitigate CVE-2021-3493 the Linux
          kernel added a call to vfs_setxattr during ovl_do_setxattr. Due to independent
          changes to the kernel by the Ubuntu development team __vfs_setxattr_noperm is
          called during ovl_do_setxattr without calling the intermediate safety function
          vfs_setxattr. Ultimatly this module allows for root access to be achieved by
          writing setuid capabilities to a file which are not sanitized after being unioned
          with the upper mounted directory.

Check method (fingerprinting):
return CheckCode::Safe('Target is not linux.') unless session.platform == 'linux'

    # Must be Ubuntu
    return CheckCode::Safe('Target is not Ubuntu.') unless kernel_version =~ /[uU]buntu/

    os = cmd_exec 'cat /etc/os-release'

    # grab codename i.e. Focal Fossa
    codename = os.scan(/\(\w* \w*\)/)[0]

    # Remove '(' and ')'
    codename.delete_prefix!('(').delete_suffix!(')')

    print_status "Detected Ubuntu version: #{codename}"

    # uname -r
    # yields something like 5.4.0-1018-blah
    kernel = kernel_release
    print_status "Detected kernel version: #{kernel}"

    # Make sure release is running vulnerable kernel
    # will this return in correct context??
    # could scan kernel to prevent looping if return below doesn't work
    vuln[codename].each do |version|
      if kernel.include? version
        return CheckCode::Vulnerable("#{codename} with #{kernel} kernel is vulnerable")
      end
    end

    return CheckCode::Safe('Target does not appear to be running a vulnerable Ubuntu Distro or Kernel')
  end
Metasploit Module: VMware Workstation ALSA Config File Local Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/vmware_alsa_config.rb
Platform: linux
Disclosure date: 2017-05-22
References: CVE-2017-4915, EDB-42045, BID-98566, URL-https://www.securitytracker.com/id/1038525, URL-https://gist.github.com/bcoles/cd26a831473088afafefc93641e184a9, URL-https://www.vmware.com/security/advisories/VMSA-2017-0009.html, URL-https://bugs.chromium.org/p/project-zero/issues/detail?id=1142
Targets: Linux x86, Linux x64

Description:
This module exploits a vulnerability in VMware Workstation Pro and
          Player on Linux which allows users to escalate their privileges by
          using an ALSA configuration file to load and execute a shared object
          as root when launching a virtual machine with an attached sound card.

          This module has been tested successfully on VMware Player version
          12.5.0 on Debian Linux 8 Jessie.

Check method (fingerprinting):
unless command_exists? '/usr/bin/vmplayer'
      print_error 'vmplayer is not installed. Exploitation will fail.'
      return CheckCode::Safe('vmplayer is not installed')
    end
    vprint_good 'vmplayer is installed'

    unless has_gcc?
      print_error 'gcc is not installed. Compiling will fail.'
      return CheckCode::Safe('gcc is not installed')
    end
    vprint_good 'gcc is installed'

    config = read_file('/etc/vmware/config') rescue ''
    if config =~ /player\.product\.version\s*=\s*"([\d\.]+)"/
      version = Rex::Version.new $1.gsub(/\.$/, '')
      vprint_status "VMware is version #{version}"
    else
      vprint_error 'Could not determine VMware version.'
      return CheckCode::Detected('Could not determine VMware version')
    end

    if version >= Rex::Version.new('12.5.6')
      vprint_error 'Target version is not vulnerable'
      return CheckCode::Safe("VMware version #{version} is not vulnerable")
    end

    CheckCode::Appears("VMware version #{version} appears to be vulnerable")
  end
Metasploit Module: Kemp LoadMaster Local sudo privilege escalation
Type: exploit
Path: modules/exploits/linux/local/progress_kemp_loadmaster_sudo_privesc_2024.rb
Platform: unix
Disclosure date: 2024-03-19
References: CVE-2024-1212, URL-https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/, URL-https://kemptechnologies.com/kemp-load-balancers
Targets: Dropper, Command

Description:
This module abuses a feature of the sudo command on Progress Kemp
          LoadMaster.  Certain binary files are allowed to automatically elevate
          with the sudo command.  This is based off of the file name.  Some files
          have this permission are not write-protected from the default 'bal' user.
          As such, if the file is overwritten with an arbitrary file, it will still
          auto-elevate.  This module overwrites the /bin/loadkeys file with another
          executable.

Check method (fingerprinting):
score = 0
    score += 1 if file?('/usr/wui/index.js') && read_file('/usr/wui/index.js').include?('KEMP')
    score += 1 if file?('/etc/motd') && read_file('/etc/motd').include?('Kemp LoadMaster')
    score += 1 if file?('/usr/wui/eula.kemp.html')
    return CheckCode::Detected("Found #{score} indicators this is a KEMP product") if score > 0

    CheckCode::Safe("Found #{score} indicators this is a KEMP product")
  end
Metasploit Module: Zimbra sudo + postfix privilege escalation
Type: exploit
Path: modules/exploits/linux/local/zimbra_postfix_priv_esc.rb
Disclosure date: 2022-10-13
References: CVE-2022-3569, URL-https://twitter.com/ldsopreload/status/[PII_REDACTED]79547392

Description:
This module exploits a vulnerable sudo configuration that permits the
          zimbra user to execute postfix as root. In turn, postfix can execute
          arbitrary shellscripts, which means it can execute a root shell.

Check method (fingerprinting):
# Sanity check
    if is_root?
      fail_with(Failure::None, 'Session already has root privileges')
    end

    unless file_exist?("#{datastore['ZIMBRA_BASE']}/common/sbin/postfix")
      print_error("postfix executable not detected: #{datastore['ZIMBRA_BASE']}/common/sbin/postfix (set ZIMBRA_BASE if Zimbra is installed in an unusual location)")
      return CheckCode::Safe('Postfix executable not detected')
    end

    unless command_exists?(datastore['SUDO_PATH'])
      print_error("Could not find sudo: #{datastore['SUDO_PATH']} (set SUDO_PATH if sudo isn't in $PATH)")
      return CheckCode::Safe('sudo not found')
    end

    # Run `sudo -n -l` to make sure we have access to the target command
    cmd = "#{datastore['SUDO_PATH']} -n -l"
    print_status "Executing: #{cmd}"
    output = cmd_exec(cmd).to_s

    if !output || output.start_with?('usage:') || output.include?('illegal option') || output.include?('a password is required')
      print_error('Current user could not execute sudo -l')
      return CheckCode::Safe('Current user could not execute sudo')
    end

    if !output.include?("(root) NOPASSWD: #{datastore['ZIMBRA_BASE']}/common/sbin/postfix")
      print_error('Current user does not have access to run postfix')
      return CheckCode::Safe('Current user does not have access to run postfix')
    end

    CheckCode::Appears('Target appears to be vulnerable')
  end
Metasploit Module: HP Performance Monitoring xglance Priv Esc
Type: exploit
Path: modules/exploits/linux/local/hp_xglance_priv_esc.rb
Disclosure date: 2014-11-19
References: EDB-48000, URL-https://seclists.org/fulldisclosure/2014/Nov/55, URL-https://www.redtimmy.com/linux-hacking/perf-exploiter/, URL-https://github.com/redtimmy/perf-exploiter, URL-https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2630/, CVE-2014-2630
Targets: Linux x86, Linux x64

Description:
This exploit takes advantage of xglance-bin, part of
          HP's Glance (or Performance Monitoring) version 11 'and subsequent'
          , which was compiled with an insecure RPATH option.  The RPATH includes
          a relative path to -L/lib64/ which can be controlled by a user.
          Creating libraries in this location will result in an
          escalation of privileges to root.

Check method (fingerprinting):
return CheckCode::Safe("#{glance_path} file not found") unless file? glance_path
    return CheckCode::Safe("#{glance_path} is not setuid") unless setuid? glance_path

    lib = find_libs
    if lib.nil?
      vprint_error 'Patched xglance-bin, not linked to -L/lib64/'
      return CheckCode::Safe('xglance-bin is patched')
    end
    vprint_good "xglance-bin found, and linked to vulnerable relative path -L/lib64/ through #{lib}"
    CheckCode::Appears("xglance-bin appears to be vulnerable, linked via #{lib}")
  end