deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Juju-run Agent Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/juju_run_agent_priv_esc.rb
Disclosure date: 2017-04-13
References: CVE-2017-9232, BID-98737, URL-https://bugs.launchpad.net/juju/+bug/1682411

Description:
This module attempts to gain root privileges on Juju agent systems
          running the juju-run agent utility.

          Juju agent systems running agent tools prior to version 1.25.12,
          2.0.x before 2.0.4, and 2.1.x before 2.1.3, provide a UNIX domain socket
          to manage software ("units") without setting appropriate permissions,
          allowing unprivileged local users to execute arbitrary commands as root.

          This module has been tested successfully with Juju agent tools versions
          1.18.4, 1.25.5 and 1.25.9 on Ubuntu 14.04.1 LTS x86 deployed by Juju
          1.18.1-trusty-amd64 and 1.25.6-trusty-amd64 on Ubuntu 14.04.1 LTS x86_64.

Check method (fingerprinting):
juju_run_path = cmd_exec 'which juju-run'

    if juju_run_path.start_with? '/'
      vprint_good 'juju-run is installed'
      return CheckCode::Detected('juju-run is installed')
    end

    vprint_error 'juju-run is NOT installed'

    CheckCode::Safe('juju-run is not installed')
  end
Metasploit Module: Overlayfs Privilege Escalation
Type: exploit
Path: modules/exploits/linux/local/overlayfs_priv_esc.rb
Disclosure date: 2015-06-16
References: EDB-39166, EDB-37292, CVE-2015-1328, CVE-2015-8660

Description:
This module attempts to exploit two different CVEs related to overlayfs.
          CVE-2015-1328: Ubuntu specific -> 3.13.0-24 (14.04 default) < 3.13.0-55
          3.16.0-25 (14.10 default) < 3.16.0-41
          3.19.0-18 (15.04 default) < 3.19.0-21
          CVE-2015-8660:
          Ubuntu:
          3.19.0-18 < 3.19.0-43
          4.2.0-18 < 4.2.0-23 (14.04.1, 15.10)
          Fedora:
          < 4.2.8 (vulnerable, un-tested)
          Red Hat:
          < 3.10.0-327 (rhel 6, vulnerable, un-tested)

Check method (fingerprinting):
def mounts_exist?()
      vprint_status('Checking if mount points exist')
      if target.name == 'CVE-2015-1328'
        if not directory?('/tmp/ns_sploit')
          vprint_good('/tmp/ns_sploit not created')
          return true
        else
          print_error('/tmp/ns_sploit directory exists.  Please delete.')
          return false
        end
      elsif target.name == 'CVE-2015-8660'
        if not directory?('/tmp/haxhax')
          vprint_good('/tmp/haxhax not created')
          return true
        else
          print_error('/tmp/haxhax directory exists.  Please delete.')
          return false
        end
      end
    end

    def kernel_vuln?()
      os_id = cmd_exec('grep ^ID= /etc/os-release')
      case os_id
      when 'ID=ubuntu'
        kernel = Rex::Version.new(cmd_exec('/bin/uname -r'))
        case kernel.release.to_s
        when '3.13.0'
          if kernel.between?(Rex::Version.new('3.13.0-24-generic'), Rex::Version.new('3.13.0-54-generic'))
            vprint_good("Kernel #{kernel} is vulnerable to CVE-2015-1328")
            return true
          else
            print_error("Kernel #{kernel} is NOT vulnerable")
            return false
          end
        when '3.16.0'
          if kernel.between?(Rex::Version.new('3.16.0-25-generic'), Rex::Version.new('3.16.0-40-generic'))
            vprint_good("Kernel #{kernel} is vulnerable to CVE-2015-1328")
            return true
          else
            print_error("Kernel #{kernel} is NOT vulnerab
Metasploit Module: Net-SNMPd Write Access SNMP-EXTEND-MIB arbitrary code execution
Type: exploit
Path: modules/exploits/linux/snmp/net_snmpd_rw_access.rb
Platform: linux
Disclosure date: 2004-05-10
Authors: Steve Embling at InteliSecure
References: URL-http://net-snmp.sourceforge.net/docs/mibs/NET-SNMP-EXTEND-MIB.txt, URL-https://medium.com/rangeforce/snmp-arbitrary-command-execution-19a6088c888e, URL-https://digi.ninja/blog/snmp_to_shell.php, URL-https://sourceforge.net/p/net-snmp/mailman/message/15735617/
Targets: Linux x86, Linux x64

Description:
This exploit module exploits the SNMP write access configuration ability of SNMP-EXTEND-MIB to
          configure MIB extensions and lead to remote code execution.
Metasploit Module: AwindInc SNMP Service Command Injection
Type: exploit
Path: modules/exploits/linux/snmp/awind_snmp_exec.rb
Platform: unix
Disclosure date: 2019-03-27
References: CVE-2017-16709, URL-https://github.com/QKaiser/awind-research, URL-https://qkaiser.github.io/pentesting/2019/03/27/awind-device-vrd/
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits a vulnerability found in AwindInc and OEM'ed products where untrusted inputs are fed to ftpfw.sh system command, leading to command injection.
          A valid SNMP read-write community is required to exploit this vulnerability.

          The following devices are known to be affected by this issue:

          * Crestron Airmedia AM-100 <= version 1.5.0.4
          * Crestron Airmedia AM-101 <= version 2.5.0.12
          * Awind WiPG-1600w <= version 2.0.1.8
          * Awind WiPG-2000d <= version 2.1.6.2
          * Barco wePresent 2000 <= version 2.1.5.7
          * Newline Trucast 2 <= version 2.1.0.5
          * Newline Trucast 3 <= version 2.1.3.7

Check method (fingerprinting):
begin
      connect_snmp
      sys_description = snmp.get_value('1.3.6.1.2.1.1.1.0').to_s
      print_status("Target system is #{sys_description}")
      # AM-100 and AM-101 considered EOL, no fix so no need to check version.
      model = sys_description.scan(/Crestron Electronics (AM-100|AM-101)/).flatten.first
      case model
      when 'AM-100', 'AM-101'
        return CheckCode::Vulnerable("Detected vulnerable #{model} device")
      when nil
        return CheckCode::Unknown("SNMP sysDescr did not match a known vulnerable model: #{sys_description}")
      else
        # TODO: insert description check for other vulnerable models (that I don't have)
        # In the meantime, we return 'safe'.
        return CheckCode::Safe
      end
    rescue SNMP::RequestTimeout
      print_error("#{ip} SNMP request timeout.")
    rescue Rex::ConnectionError
      print_error("#{ip} Connection refused.")
    rescue SNMP::UnsupportedVersion
      print_error("#{ip} Unsupported SNMP version specified. Select from '1' or '2c'.")
    rescue ::Interrupt
      raise $!
    rescue ::Exception => e
      print_error("Unknown error: #{e.class} #{e}")
    ensure
      disconnect_snmp
    end
    Exploit::CheckCode::Unknown
  end
Metasploit Module: APT Package Manager Persistence
Type: exploit
Path: modules/exploits/linux/persistence/apt_package_manager.rb
Platform: linux
Disclosure date: 1999-03-09
Authors: Aaron Ringo
References: URL-https://unix.stackexchange.com/questions/204414/how-to-run-a-command-before-download-with-apt-get

Description:
This module will run a payload when the APT package manager is used.
          This module creates a pre-invoke hook for APT in apt.conf.d. Write access
          to the apt.conf.d directory is required, typically requiring root access.
          The hook name is randomized if not specified.
          Verified on Ubuntu 22.04

Check method (fingerprinting):
return CheckCode::Safe('apt-get not found, likely not an apt based system') unless command_exists?('apt-get')
    return CheckCode::Safe("#{datastore['HOOKPATH']} not found") unless exists?(datastore['HOOKPATH'])
    return CheckCode::Safe("#{datastore['HOOKPATH']} not writable") unless writable?(datastore['HOOKPATH'])

    print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} not found") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} not writable") unless writable?(writable_dir)

    CheckCode::Appears("#{datastore['HOOKPATH']} and #{writable_dir} are writable, also found apt-get.")
  end
Metasploit Module: Service SystemD override.conf Persistence
Type: exploit
Path: modules/exploits/linux/persistence/init_systemd_override.rb
Platform: unix
Disclosure date: 2010-03-30
References: URL-https://www.freedesktop.org/software/systemd/man/latest/systemd.service.html, URL-https://askubuntu.com/a/659268, URL-https://wiki.archlinux.org/title/Systemd

Description:
This module will create an override.conf file for a SystemD service on the box.
          The ExecStartPost hook is used to launch the payload after the service is started.
          We need enough access (typically root) to write in the /etc/systemd/system
          directory and potentially restart services.
          Verified on Ubuntu 22.04

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')

    root_dir = '/lib/systemd/system/'
    service_file = "#{root_dir}#{datastore['SERVICE']}.service"

    return CheckCode::Safe("Service #{datastore['SERVICE']} doesnt exist in #{root_dir}") unless exists?(service_file)

    service_root_dir = '/etc/systemd/system/'
    service_dir = "#{service_root_dir}#{datastore['SERVICE']}.service.d"
    override_conf = "#{service_dir}/override.conf"

    if directory?(service_dir)
      return CheckCode::Safe("No write access to #{override_conf}") if exists?(override_conf) && !writable?(override_conf)
      return CheckCode::Safe("No write access to #{service_dir}") if !exists?(override_conf) && !writable?(service_dir)
    else
      return CheckCode::Safe("No write access to #{service_root_dir}") unless writable?(service_root_dir)
    end

    CheckCode::Appears("#{writable_dir} is writable and system is systemd based")
  end
Metasploit Module: Docker Image Persistence
Type: exploit
Path: modules/exploits/linux/persistence/docker_image.rb
Disclosure date: 2013-03-20

Description:
This module maintains persistence on a host by creating a docker image which runs our
          payload, and has access to the host's file system (/host in the container). Whenever the
          container restarts, the payload will run, or when the payload dies the executable
          will run again after a delay. This will allow for writing back
          into the host through cron entries, ssh keys, or other method.

          Verified on Ubuntu 22.04.

Check method (fingerprinting):
# we don't need this check since the payload is in the docker image
    # print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe('docker is required') unless command_exists?('docker')

    vprint_status('Checking Docker availability and permissions...')

    output = cmd_exec('docker ps 2>&1')

    if output.include?('permission denied')
      return CheckCode::Safe('Docker is installed but this user does not have permission to access it')
    elsif output.include?('Cannot connect to the Docker daemon') || output.include?('Is the docker daemon running?')
      return CheckCode::Detected('Docker appears to be installed but the daemon is not running')
    end

    CheckCode::Detected('docker app is installed and accessible')
  end
Metasploit Module: Yum Package Manager Persistence
Type: exploit
Path: modules/exploits/linux/persistence/yum_package_manager.rb
Platform: linux
Disclosure date: 2003-12-17
Authors: Aaron Ringo
References: URL-https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/deployment_guide/sec-yum_plugins

Description:
This module will run a payload when the package manager is used.
          This module modifies a yum plugin to launch a binary of choice.
          grep -F 'enabled=1' /etc/yum/pluginconf.d/
          will show what plugins are currently enabled on the system.
          root persmissions are likely required.
          Verified on Centos 7.1

Check method (fingerprinting):
return CheckCode::Safe("#{datastore['WritableDir']} does not exist") unless exists? datastore['WritableDir']
    return CheckCode::Safe("#{datastore['WritableDir']} not writable") unless writable? datastore['WritableDir']

    # checks /usr/lib/yum-plugins/PLUGIN.py exists and is writeable
    plugin = datastore['PLUGIN']
    full_plugin_path = "#{datastore['PluginPath']}#{plugin}"
    return CheckCode::Safe("#{full_plugin_path} does not exist") unless exists? full_plugin_path
    return CheckCode::Safe("#{full_plugin_path} not writable") unless writable? full_plugin_path
    return CheckCode::Safe('yum not found on system') unless command_exists? 'yum'
    return CheckCode::Safe('sed not found on system, required for exploitation') unless command_exists? 'sed'

    # /etc/yum.conf must contain plugins=1 for plugins to run at all
    plugins_enabled = cmd_exec "grep -F 'plugins=1' /etc/yum.conf"
    return CheckCode::Safe('Plugins are not set to be enabled in /etc/yum.conf') unless plugins_enabled.include? 'plugins=1'

    vprint_good('Plugins are enabled!')

    # /etc/yum/pluginconf.d/PLUGIN.conf must contain enabled=1
    plugin_conf = "/etc/yum/pluginconf.d/#{plugin.sub('.py', '')}.conf"
    plugin_enabled = cmd_exec "grep -F 'enabled=1' #{plugin_conf}"
    unless plugin_enabled.include? 'enabled=1'
      return CheckCode::Safe("#{plugin_conf} plugin is not configured to run")
    end

    # check that the plugin contains an import os, to backdoor
    import_os_check = cm
Metasploit Module: Autostart Desktop Item Persistence
Type: exploit
Path: modules/exploits/linux/persistence/autostart.rb
Disclosure date: 2006-02-13
References: URL-https://specifications.freedesktop.org/autostart-spec/latest/

Description:
This module will create an autostart .desktop entry to execute a payload.
          The payload will be executed when the users logs in.
          Verified on Ubuntu 22.04 desktop with Gnome, and 18.04.3.
          The following payloads were used in testing:
          - cmd/unix/reverse_netcat
          - linux/x64/meterpreter/reverse_tcp
          - cmd/linux/http/x64/meterpreter/reverse_tcp

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you may want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    # https://unix.stackexchange.com/a/237750
    return CheckCode::Safe('Xorg is not installed, likely a server install. Autostart requires a graphical environment') unless command_exists?('Xorg')

    CheckCode::Detected('Xorg is installed, possible desktop install.')
  end
Metasploit Module: Service Upstart Persistence
Type: exploit
Path: modules/exploits/linux/persistence/init_upstart.rb
Platform: unix
Disclosure date: 2006-08-24
References: URL-https://www.digitalocean.com/community/tutorials/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples, URL-http://blog.terminal.com/getting-started-with-upstart/

Description:
This module will create a service on the box, and mark it for auto-restart.
          We need enough access to write service files and potentially restart services
          Targets:
          CentOS 6
          Fedora >= 9, < 15
          Ubuntu >= 9.10, <= 14.10

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe("#{init_folder} isnt writable") unless writable?(init_folder)

    return CheckCode::Safe('Likely not an upstart based system') unless command_exists?('initctl')

    CheckCode::Appears("#{writable_dir} is writable and system is upstart based")
  end
Metasploit Module: IGEL OS Persistent Payload
Type: exploit
Path: modules/exploits/linux/persistence/igel_persistence.rb
Platform: linux
Disclosure date: 2016-11-02
Authors: Zack Didcott
Targets: Linux Command, Linux Dropper

Description:
Gain persistence for specified payload on IGEL OS Workspace Edition, by writing
          a payload to disk or base64-encoding and executing from registry.
Metasploit Module: update-motd.d Persistence
Type: exploit
Path: modules/exploits/linux/persistence/motd.rb
Disclosure date: 1999-01-01
References: URL-https://manpages.ubuntu.com/manpages/oracular/en/man5/update-motd.5.html

Description:
This module will add a script in /etc/update-motd.d/ in order to persist a payload.
          The payload will be executed with root privileges everytime a user logs in.
          Root privileges are likely required to write to /etc/update-motd.d/.
          Verified on Ubuntu 22.04

Check method (fingerprinting):
return CheckCode::Safe('/etc/update-motd.d/ does not exist') unless exists? '/etc/update-motd.d/'
    return CheckCode::Safe('/etc/update-motd.d/ is not writable') unless writable? '/etc/update-motd.d/'

    print_warning("#{datastore['BACKDOOR_NAME']} already exists") if exists? "/etc/update-motd.d/#{datastore['BACKDOOR_NAME']}"

    CheckCode::Appears('/etc/update-motd.d/ is writable')
  end
Metasploit Module: Emacs Extension Persistence
Type: exploit
Path: modules/exploits/linux/persistence/emacs_extension.rb
Disclosure date: 2026-01-28
References: URL-https://twit.tv/posts/transcripts/security-now-1061-transcript

Description:
This module adds a lisp based malicious extension to the emacs configuration file.
          When emacs is opened, the extension will be loaded and the payload will be executed.

          Tested against emacs 29.3 build 1 on Ubuntu Desktop 24.04.

Check method (fingerprinting):
return CheckCode::Safe('emacs is required') unless command_exists?('emacs')

    CheckCode::Detected('emacs is installed')
  end
Metasploit Module: udev Persistence
Type: exploit
Path: modules/exploits/linux/persistence/udev.rb
Disclosure date: 2003-11-01
References: URL-https://www.aon.com/en/insights/cyber-labs/unveiling-sedexp, URL-https://ch4ik0.github.io/en/posts/leveraging-Linux-udev-for-persistence/

Description:
This module will add a script in /lib/udev/rules.d/ in order to execute a payload written on disk.
          It'll be executed with root privileges everytime a network interface other than l0 comes up.
          Execution is triggered through at command, so it must be installed on the target.

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe("#{datastore['UDEV_PATH']} doesnt exist") unless exists?(datastore['UDEV_PATH'])
    return CheckCode::Safe("#{datastore['UDEV_PATH']} isnt writable") unless writable?(datastore['UDEV_PATH'])

    return CheckCode::Safe('at commmand not found') if get_at_command('').nil?

    CheckCode::Appears('likely exploitable')
  end
Metasploit Module: VIM Plugin Persistence
Type: exploit
Path: modules/exploits/linux/persistence/vim_plugin.rb
Disclosure date: 1991-11-03
References: URL-https://vimways.org/2019/writing-vim-plugin/, URL-https://www.linode.com/docs/guides/writing-a-vim-plugin/

Description:
This module creates a VIM Plugin which executes a payload on VIM startup.

Check method (fingerprinting):
return CheckCode::Safe('VIM is required') unless command_exists?('vim')

    CheckCode::Detected('VIM is installed')
  end
Metasploit Module: rc.local Persistence
Type: exploit
Path: modules/exploits/linux/persistence/rc_local.rb
Disclosure date: 1980-10-01

Description:
This module will edit /etc/rc.local in order to persist a payload.
          The payload will be executed on the next reboot.
          Verified on Ubuntu 18.04.3

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    # a few notes for those who like to read source code. On Ubuntu 18.04.3, when no
    # /etc/rc.local file exists, systemctl status rc.local shows inactive (dead).
    # When /etc/rc.local exists, systemctl status rc.local shows active (exited).
    # so checking the service status isn't necessarily helpful.
    if exists?('/etc/rc.local')
      return CheckCode::Safe('/etc/rc.local isnt writable') unless writable?('/etc/rc.local')
    else
      return CheckCode::Safe('/etc/ isnt writable') unless writable?('/etc/')
    end

    CheckCode::Appears('/etc/rc.local is writable')
  end
Metasploit Module: Init OpenRC Persistence
Type: exploit
Path: modules/exploits/linux/persistence/init_openrc.rb
Platform: unix
Disclosure date: 2007-04-05
References: URL-https://www.digitalocean.com/community/tutorials/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples, URL-https://wiki.alpinelinux.org/wiki/Writing_Init_Scripts, URL-https://wiki.alpinelinux.org/wiki/OpenRC, URL-https://github.com/OpenRC/openrc/blob/master/service-script-guide.md

Description:
This module will create a service on the box via OpenRC, and mark it for auto-restart.
          We need enough access to write service files and potentially restart services.
          Verified against alpine 3.21.2

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe('/etc/init.d/ doesnt exist') unless exists?('/etc/init.d/')
    return CheckCode::Safe('/etc/init.d/ isnt writable') unless writable?('/etc/init.d/')

    return CheckCode::Safe('Likely not an openrc based system') unless command_exists?('openrc')

    CheckCode::Appears("#{writable_dir} is writable and system is openrc based")
  end
Metasploit Module: Service SystemD Persistence
Type: exploit
Path: modules/exploits/linux/persistence/init_systemd.rb
Platform: unix
Disclosure date: 2010-03-30
Authors: Cale Black
References: URL-https://www.digitalocean.com/community/tutorials/how-to-configure-a-linux-service-to-start-automatically-after-a-crash-or-reboot-part-1-practical-examples, URL-https://coreos.com/docs/launching-containers/launching/getting-started-with-systemd/

Description:
This module will create a service on the box, and mark it for auto-restart.
          We need enough access to write service files and potentially restart services
          Targets:
          CentOS 7
          Debian >= 7, <=8
          Fedora >= 15
          Ubuntu >= 15.04
          Verified on Ubuntu 18.04.3

Check method (fingerprinting):
print_warning('Payloads in /tmp will only last until reboot, you want to choose elsewhere.') if writable_dir.start_with?('/tmp')
    print_warning('User doesnt have root permissions, yet target set to systemd, likely need to change target to systemd user.') if target.name == 'systemd' && !is_root?
    return CheckCode::Safe("#{writable_dir} doesnt exist") unless exists?(writable_dir)
    return CheckCode::Safe("#{writable_dir} isnt writable") unless writable?(writable_dir)
    return CheckCode::Safe('Likely not a systemd based system') unless command_exists?('systemctl')

    CheckCode::Appears("#{writable_dir} is writable and system is systemd based")
  end