deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Install Python for Windows
Type: post
Path: modules/post/windows/manage/install_python.rb
Authors: Michael Long <bluesentinel[at]protonmail.com>
References: URL-https://docs.python.org/3/using/windows.html#windows-embeddable, URL-https://attack.mitre.org/techniques/T1064/

Description:
This module places an embeddable Python3 distribution onto the target file system,
          granting pentesters access to a lightweight Python interpreter.
          This module does not require administrative privileges or user interaction with
          installation prompts.
Metasploit Module: Windows Manage Host File Entry Removal
Type: post
Path: modules/post/windows/manage/remove_host.rb

Description:
This module allows the attacker to remove an entry from the Windows hosts file.
Metasploit Module: Windows Manage Inject in Memory Multiple Payloads
Type: post
Path: modules/post/windows/manage/multi_meterpreter_inject.rb

Description:
This module will inject into several processes a given
          payload and connect to a given list of IP addresses.
          The module works with a given lists of IP addresses and
          process IDs if no PID is given it will start the given
          process in the advanced options and inject the selected
          payload into the memory of the created module.
Metasploit Module: Windows Manage Change Password
Type: post
Path: modules/post/windows/manage/change_password.rb
Platform: win
Authors: Ben Campbell

Description:
This module will attempt to change the password of the targeted account.
          The typical usage is to change a newly created account's password on a
          remote host to avoid the error, 'System error 1907 has occurred,' which
          is caused when the account policy enforces a password change before the
          next login.
Metasploit Module: Windows Post Manage WDigest Credential Caching
Type: post
Path: modules/post/windows/manage/wdigest_caching.rb

Description:
On Windows 8/2012 or higher, the Digest Security Provider (WDIGEST) is disabled by default. This module enables/disables
          credential caching by adding/changing the value of the UseLogonCredential DWORD under the WDIGEST provider's Registry key.
          Any subsequent logins will allow mimikatz to recover the plain text passwords from the system's memory.
Metasploit Module: Windows Manage PXE Exploit Server
Type: post
Path: modules/post/windows/manage/pxeexploit.rb

Description:
This module provides a PXE server, running a DHCP and TFTP server.
        The default configuration loads a linux kernel and initrd into memory that
        reads the hard drive; placing a payload to install metsvc, disable the
        firewall, and add a new user metasploit on any Windows partition seen,
        and add a uid 0 user with username and password metasploit to any linux
        partition seen. The windows user will have the password p@SSw0rd!123456
        (in case of complexity requirements) and will be added to the administrators
        group.

        See exploit/windows/misc/pxesploit for a version to deliver a specific payload.

        Note: the displayed IP address of a target is the address this DHCP server
        handed out, not the "normal" IP address the host uses.
Metasploit Module: Windows Manage Driver Loader
Type: post
Path: modules/post/windows/manage/driver_loader.rb
Platform: win
Authors: Borja Merino <bmerinofe[at]gmail.com>

Description:
This module loads a KMD (Kernel Mode Driver) using the Windows Service API.
Metasploit Module: Install OpenSSH for Windows
Type: post
Path: modules/post/windows/manage/install_ssh.rb
Authors: Michael Long <bluesentinel[at]protonmail.com>
References: URL-https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview, URL-https://github.com/PowerShell/openssh-portable

Description:
This module installs OpenSSH server and client for Windows using PowerShell.
          SSH on Windows can provide pentesters persistent access to a secure interactive terminal, interactive filesystem access, and port forwarding over SSH.
Metasploit Module: Powershell .NET Compiler
Type: post
Path: modules/post/windows/manage/powershell/build_net_code.rb
Disclosure date: 2012-08-14
Authors: RageLtMan <rageltman[at]sempervictus>

Description:
This module will build a .NET source file using powershell. The compiler builds
          the executable or library in memory and produces a binary. After compilation the
          PowerShell session can also sign the executable if provided a path the
          a .pfx formatted certificate. Compiler options and a list of assemblies
          required can be configured in the datastore.
Metasploit Module: Windows Manage PowerShell Download and/or Execute
Type: post
Path: modules/post/windows/manage/powershell/exec_powershell.rb
Platform: win

Description:
This module will download and execute a PowerShell script over a meterpreter session.
          The user may also enter text substitutions to be made in memory before execution.
          Setting VERBOSE to true will output both the script prior to execution and the results.
Metasploit Module: Load Scripts Into PowerShell Session
Type: post
Path: modules/post/windows/manage/powershell/load_script.rb
Platform: win

Description:
This module will download and execute one or more PowerShell scripts
          over a present powershell session.
          Setting VERBOSE to true will show the stager results.
Metasploit Module: Windows Gather Google Chrome User Data Enumeration
Type: post
Path: modules/post/windows/gather/enum_chrome.rb
Platform: win

Description:
This module will collect user data from Google Chrome and attempt to decrypt
          sensitive information.
Metasploit Module: BloodHound Ingestor
Type: post
Path: modules/post/windows/gather/bloodhound.rb
References: URL-https://github.com/BloodHoundAD/BloodHound/

Description:
This module will execute the BloodHound C# Ingestor (aka SharpHound) to gather sessions, local admin, domain trusts and more.
          With this information BloodHound will easily identify highly complex attack paths that would otherwise be impossible to quickly
          identify within an Active Directory environment.
Metasploit Module: Windows Gather PSReadline History
Type: post
Path: modules/post/windows/gather/psreadline_history.rb
Platform: %w[win
References: URL-https://docs.microsoft.com/en-us/powershell/module/psreadline/, URL-https://github.com/KalibRx/PoshHarvestPy/blob/master/poshharvest.py, URL-https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html

Description:
Gathers Power Shell history data from the target machine.
Metasploit Module: Bitlocker Master Key (FVEK) Extraction
Type: post
Path: modules/post/windows/gather/bitlocker_fvek.rb
Platform: win
Authors: Danil Bazin <danil.bazin[at]hsc.fr>
References: URL-https://github.com/libyal/libbde/blob/master/documentation/BitLocker%20Drive%20Encryption%20%28BDE%29%20format.asciidoc, URL-https://web.archive.org/web/[PII_REDACTED]5545/http://www.hsc.fr/ressources/outils/dislocker/

Description:
This module enumerates ways to decrypt Bitlocker volume and if a recovery key is stored locally
          or can be generated, dump the Bitlocker master key (FVEK)
Metasploit Module: Windows Gather Domain Enumeration
Type: post
Path: modules/post/windows/gather/enum_domains.rb

Description:
This module enumerates currently the domains a host can see and the domain
          controllers for each domain.
Metasploit Module: Windows Gather Enumerate Computers
Type: post
Path: modules/post/windows/gather/enum_computers.rb

Description:
This module will enumerate computers included in the primary Active Directory domain.
Metasploit Module: Windows Gather Active Directory Groups
Type: post
Path: modules/post/windows/gather/enum_ad_groups.rb

Description:
This module will enumerate AD groups on the specified domain.
Metasploit Module: Windows Gather Hardware Enumeration
Type: post
Path: modules/post/windows/gather/enum_devices.rb

Description:
Enumerate PCI hardware information from the registry. Please note this script
          will run through registry subkeys such as: 'PCI', 'ACPI', 'ACPI_HAL', 'FDC', 'HID',
          'HTREE', 'IDE', 'ISAPNP', 'LEGACY'', LPTENUM', 'PCIIDE', 'SCSI', 'STORAGE', 'SW',
          and 'USB'; it will take time to finish. It is recommended to run this module as a
          background job.
Metasploit Module: Windows Gather Windows Host File Enumeration
Type: post
Path: modules/post/windows/gather/enum_hostfile.rb

Description:
This module returns a list of entries in the target system's hosts file.
Metasploit Module: Generate CSV Organizational Chart Data Using Manager Information
Type: post
Path: modules/post/windows/gather/make_csv_orgchart.rb

Description:
This module will generate a CSV file containing all users and their managers, which can be
          imported into Visio which will render it.
Metasploit Module: Windows Gather Service Info Enumeration
Type: post
Path: modules/post/windows/gather/enum_services.rb
Platform: win
Authors: Keith Faber

Description:
This module will query the system for services and display name and
          configuration info for each returned service. It allows you to
          optionally search the credentials, path, or start type for a string
          and only return the results that match. These query operations are
          cumulative and if no query strings are specified, it just returns all
          services.  NOTE: If the script hangs, windows firewall is most likely
          on and you did not migrate to a safe process (explorer.exe for
          example).
Metasploit Module: Windows Gather Enumerate Domain Admin Tokens (Token Hunter)
Type: post
Path: modules/post/windows/gather/enum_tokens.rb
Platform: win
Authors: Joshua Abraham <jabra[at]rapid7.com>

Description:
This module enumerates Domain Admin account processes and delegation tokens.

          This module will first check if the session has sufficient privileges
          to replace process level tokens and adjust process quotas.

          The SeAssignPrimaryTokenPrivilege privilege will not be assigned if
          the session has been elevated to SYSTEM. In that case try first
          migrating to another process that is running as SYSTEM.
Metasploit Module: Windows Gather Active Directory Service Principal Names
Type: post
Path: modules/post/windows/gather/enum_ad_service_principal_names.rb
References: URL-https://www.netspi.com/blog/entryid/214/faster-domain-escalation-using-ldap

Description:
This module will enumerate servicePrincipalName in the default AD directory
          where the user is a member of the Domain Admins group.
Metasploit Module: Windows Gather USB Drive History
Type: post
Path: modules/post/windows/gather/usb_history.rb

Description:
This module will enumerate USB Drive history on a target host.
Metasploit Module: Windows Gather Installed Application Within Chocolatey Enumeration
Type: post
Path: modules/post/windows/gather/enum_chocolatey_applications.rb
Platform: win
Authors: Nick Cottrell <ncottrellweb[at]gmail.com>

Description:
This module will enumerate all installed applications on a Windows system with chocolatey installed
Metasploit Module: Windows Gather Screen Spy
Type: post
Path: modules/post/windows/gather/screen_spy.rb
Platform: win

Description:
This module will incrementally take desktop screenshots from the host. This
          allows for screen spying which can be useful to determine if there is an active
          user on a machine, or to record the screen for later data extraction.
Metasploit Module: Windows Gather Apache Tomcat Enumeration
Type: post
Path: modules/post/windows/gather/enum_tomcat.rb

Description:
This module will collect information from a Windows-based Apache Tomcat. You will get
          information such as: The installation path, Tomcat version, port, web applications,
          users, passwords, roles, etc.
Metasploit Module: Windows Gather Privileges Enumeration
Type: post
Path: modules/post/windows/gather/win_privs.rb

Description:
This module will print if UAC is enabled, and if the current account is
          ADMIN enabled. It will also print UID, foreground SESSION ID, is SYSTEM status
          and current process PRIVILEGES.
Metasploit Module: Windows Process Memory Dump
Type: post
Path: modules/post/windows/gather/memory_dump.rb
Platform: win
Authors: smashery

Description:
This module creates a memory dump of a process (to disk) and downloads the file
          for offline analysis.

          Options for DUMP_TYPE affect the completeness of the dump:

          "full" retrieves the entire process address space (all allocated pages);
          "standard" excludes image files (e.g. DLLs and EXEs in the address space) as
          well as memory mapped files. As a result, this option can be significantly
          smaller in size.
Metasploit Module: Windows Installed AntiVirus Enumeration
Type: post
Path: modules/post/windows/gather/enum_av.rb
Platform: %w[win

Description:
This module will enumerate the AV products detected by WMIC
Metasploit Module: Windows Gather SMB Share Enumeration via Registry
Type: post
Path: modules/post/windows/gather/enum_shares.rb

Description:
This module will enumerate configured and recently used file shares.
Metasploit Module: PuTTY Saved Sessions Enumeration Module
Type: post
Path: modules/post/windows/gather/enum_putty_saved_sessions.rb
Platform: win
Authors: Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>

Description:
This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session
          information from the registry. PuTTY is very configurable; some users may have configured
          saved sessions which could include a username, private key file to use when authenticating,
          host name etc.  If a private key is configured, an attempt will be made to download and store
          it in loot. It will also record the SSH host keys which have been stored. These will be connections that
          the user has previously after accepting the host SSH fingerprint and therefore are of particular
          interest if they are within scope of a penetration test.
Metasploit Module: Windows Gather Unattended Answer File Enumeration
Type: post
Path: modules/post/windows/gather/enum_unattend.rb
References: URL-http://technet.microsoft.com/en-us/library/ff715801, URL-http://technet.microsoft.com/en-us/library/cc749415(v=ws.10).aspx, URL-http://technet.microsoft.com/en-us/library/c026170e-40ef-4191-98dd-0b9835bfa580, URL-https://aws.amazon.com/security/security-bulletins/AWS-2024-006/, URL-https://www.immersivelabs.com/blog/the-return-of-unattend-xml-revenge-of-the-cleartext-credentials/

Description:
This module will check the file system for a copy of unattend.xml and/or
          autounattend.xml found in Windows Vista, or newer Windows systems.  And then
          extract sensitive information such as usernames and decoded passwords.  Also
          checks for '.vmimport' files that could have been created by the AWS EC2 VMIE service.
Metasploit Module: Windows Hyper-V VM Enumeration
Type: post
Path: modules/post/windows/gather/enum_hyperv_vms.rb
Platform: win

Description:
This module will check if the target machine is a Hyper-V host and, if it is, will return a list of all
          of the VMs running on the host, as well as stats such as their state, version, CPU Usage, uptime, and status.
Metasploit Module: Windows Gather PowerShell Environment Setting Enumeration
Type: post
Path: modules/post/windows/gather/enum_powershell_env.rb
References: URL-https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies, URL-https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles

Description:
This module will enumerate Microsoft PowerShell settings.
Metasploit Module: Windows NetLM Downgrade Attack
Type: post
Path: modules/post/windows/gather/netlm_downgrade.rb
Platform: win
References: URL-https://web.archive.org/web/[PII_REDACTED]1729/https://www.optiv.com/explore-optiv-insights/blog/post-exploitation-using-netntlm-downgrade-attacks, URL-https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level, URL-https://support.microsoft.com/en-us/topic/security-guidance-for-ntlmv1-and-lm-network-authentication-da2168b6-4a31-0088-fb03-f081acde6e73

Description:
This module changes the system LmCompatibilityLevel registry value
          to enable sending LM challenge hashes and initiates a SMB connection
          to the host specified in the SMBHOST module option. If an SMB server
          is listening, it will receive the NetLM hashes for the session user.
Metasploit Module: Windows Gather Active Directory Users
Type: post
Path: modules/post/windows/gather/enum_ad_users.rb

Description:
This module will enumerate user accounts in the default Active Domain (AD) directory and stores
          them in the database. If GROUP_MEMBER is set to the DN of a group, this will list the members of
          that group by performing a recursive/nested search (i.e. it will list users who are members of
          groups that are members of groups that are members of groups (etc) which eventually include the
          target group DN.
Metasploit Module: Windows Gather Internet Explorer User Data Enumeration
Type: post
Path: modules/post/windows/gather/enum_ie.rb
Platform: win
Authors: Kx499

Description:
This module will collect history, cookies, and credentials (from either HTTP
          auth passwords, or saved form passwords found in auto-complete) in
          Internet Explorer. The ability to gather credentials is only supported
          for versions of IE >=7, while history and cookies can be extracted for all
          versions.
Metasploit Module: Windows Gather Local Admin Search
Type: post
Path: modules/post/windows/gather/local_admin_search_enum.rb
Platform: win

Description:
This module will identify systems in a given range that the
          supplied domain user (should migrate into a user pid) has administrative
          access to by using the Windows API OpenSCManagerA to establishing a handle
          to the remote host. Additionally it can enumerate logged in users and group
          membership via Windows API NetWkstaUserEnum and NetUserGetGroups.
Metasploit Module: Windows Gather Outlook Email Messages
Type: post
Path: modules/post/windows/gather/outlook.rb
References: URL-https://forsec.nl/2014/11/reading-outlook-using-metasploit

Description:
This module allows reading and searching email messages from the local
          Outlook installation using PowerShell. Please note that this module is
          manipulating the victims keyboard/mouse.  If a victim is active on the target
          system, he may notice the activities of this module. Tested on Windows 8.1
          x64 with Office 2013.
Metasploit Module: Windows Gather Local User Account Password Hashes (Registry)
Type: post
Path: modules/post/windows/gather/hashdump.rb

Description:
This module will dump the local user accounts from the SAM database using the registry
Metasploit Module: Windows Gather Active Directory User Comments
Type: post
Path: modules/post/windows/gather/enum_ad_user_comments.rb
References: URL-http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx

Description:
This module will enumerate user accounts in the default Active Domain (AD) directory which
          contain 'pass' in their description or comment (case-insensitive) by default. In some cases,
          such users have their passwords specified in these fields.
Metasploit Module: Windows Gather Database Instance Enumeration
Type: post
Path: modules/post/windows/gather/enum_db.rb

Description:
This module will enumerate a Windows system for installed database instances.
Metasploit Module: Windows Gather Installed Application Enumeration
Type: post
Path: modules/post/windows/gather/enum_applications.rb

Description:
This module will enumerate all installed applications on a Windows system
Metasploit Module: Windows Gather Active Directory Managed Groups
Type: post
Path: modules/post/windows/gather/enum_ad_managedby_groups.rb

Description:
This module will enumerate AD groups on the specified domain which are specifically managed.
          It cannot at the moment identify whether the 'Manager can update membership list' option
          option set; if so, it would allow that member to update the contents of that group. This
          could either be used as a persistence mechanism (for example, set your user as the 'Domain
          Admins' group manager) or could be used to detect privilege escalation opportunities
          without having domain admin privileges.
Metasploit Module: Windows Gather EMET Protected Paths
Type: post
Path: modules/post/windows/gather/enum_emet.rb

Description:
This module will enumerate the EMET protected paths on the target host.
Metasploit Module: Windows Gather Generic File Collection
Type: post
Path: modules/post/windows/gather/enum_files.rb

Description:
This module downloads files recursively based on the FILE_GLOBS option.
Metasploit Module: Windows Gather Credential Cache Dump
Type: post
Path: modules/post/windows/gather/cachedump.rb
Platform: win
References: URL-https://web.archive.org/web/[PII_REDACTED]3137/https://lab.mediaservice.net/code/cachedump.rb

Description:
This module uses the registry to extract the stored domain hashes that have been
          cached as a result of a GPO setting. The default setting on Windows is to store
          the last ten successful logins.
Metasploit Module: Windows Gather Product Key
Type: post
Path: modules/post/windows/gather/enum_ms_product_keys.rb

Description:
This module will enumerate Microsoft product license keys.
Metasploit Module: Windows Antivirus Exclusions Enumeration
Type: post
Path: modules/post/windows/gather/enum_av_excluded.rb

Description:
This module will enumerate the file, directory, process and
          extension-based exclusions from supported AV products, which
          currently includes Microsoft Defender, Microsoft Security
          Essentials/Antimalware, and Symantec Endpoint Protection.
Metasploit Module: Windows Gather Proxy Setting
Type: post
Path: modules/post/windows/gather/enum_proxy.rb

Description:
This module pulls a user's proxy settings. If neither RHOST or SID
        are set it pulls the current user, else it will pull the user's settings
        for the specified SID and target host.
Metasploit Module: Windows Gather Microsoft Office Word UNC Path Injector
Type: post
Path: modules/post/windows/gather/word_unc_injector.rb
Platform: win
References: URL-https://web.archive.org/web/[PII_REDACTED]2608/http://jedicorp.com/?p=534

Description:
This module modifies a remote .docx file that will, upon opening, submit
          stored netNTLM credentials to a remote host. Verified to work with Microsoft
          Word 2003, 2007, 2010, and 2013. In order to get the hashes the
          auxiliary/server/capture/smb module can be used.
Metasploit Module: Windows Gather Enum User MUICache
Type: post
Path: modules/post/windows/gather/enum_muicache.rb
Platform: win
Authors: TJ Glad <tjglad[at]cmail.nu>

Description:
This module gathers information about the files and file paths that logged on users have
          executed on the system. It also will check if the file still exists on the system. This
          information is gathered by using information stored under the MUICache registry key. If
          the user is logged in when the module is executed it will collect the MUICache entries
          by accessing the registry directly. If the user is not logged in the module will download
          users registry hive NTUSER.DAT/UsrClass.dat from the system and the MUICache contents are
          parsed from the downloaded hive.