Skip to content

Commit a167528

Browse files
author
jenkins-metasploit
committed
automatic module_metadata_base.json update
1 parent cd8f32a commit a167528

File tree

1 file changed

+79
-20
lines changed

1 file changed

+79
-20
lines changed

‎db/modules_metadata_base.json‎

Lines changed: 79 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -57846,7 +57846,7 @@
5784657846
"Narendra Shinde",
5784757847
"Zack Flack <[email protected]>"
5784857848
],
57849-
"description": "WARNING: Successful execution of this module results in /etc/passwd being overwritten.\n\n This module is a port of the OpenBSD X11 Xorg exploit to run on AIX.\n\n A permission check flaw exists for -modulepath and -logfile options when\n starting Xorg. This allows unprivileged users that can start the server\n the ability to elevate privileges and run arbitrary code under root\n privileges.\n\n This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1.\n Due to permission restrictions of the crontab in AIX, this module does not use cron,\n and instead overwrites /etc/passwd in order to create a new user with root privileges.\n All currently logged in users need to be included when /etc/passwd is overwritten,\n else AIX will throw 'Cannot get \"LOGNAME\" variable' when attempting to change user.\n The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX,\n and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when\n overwriting /etc/passwd.",
57849+
"description": "WARNING: Successful execution of this module results in /etc/passwd being overwritten.\n\n This module is a port of the OpenBSD X11 Xorg exploit to run on AIX.\n\n A permission check flaw exists for -modulepath and -logfile options when\n starting Xorg. This allows unprivileged users that can start the server\n the ability to elevate privileges and run arbitrary code under root\n privileges.\n\n This module has been tested with AIX 7.1 and 7.2, and should also work with 6.1.\n Due to permission restrictions of the crontab in AIX, this module does not use cron,\n and instead overwrites /etc/passwd in order to create a new user with root privileges.\n All currently logged in users need to be included when /etc/passwd is overwritten,\n else AIX will throw 'Cannot get \"LOGNAME\" variable' when attempting to change user.\n The Xorg '-fp' parameter used in the OpenBSD exploit does not work on AIX,\n and is replaced by '-config', in conjuction with ANSI-C quotes to inject newlines when\n overwriting /etc/passwd.",
5785057850
"references": [
5785157851
"CVE-2018-14665",
5785257852
"URL-https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html",
@@ -57864,7 +57864,7 @@
5786457864
"IBM AIX Version 7.1",
5786557865
"IBM AIX Version 7.2"
5786657866
],
57867-
"mod_time": "2021-02-17 12:33:59 +0000",
57867+
"mod_time": "2025-04-18 01:17:56 +0000",
5786857868
"path": "/modules/exploits/aix/local/xorg_x11_server.rb",
5786957869
"is_install_path": true,
5787057870
"ref_name": "aix/local/xorg_x11_server",
@@ -57873,7 +57873,14 @@
5787357873
"default_credential": false,
5787457874
"notes": {
5787557875
"SideEffects": [
57876-
"config-changes"
57876+
"config-changes",
57877+
"artifacts-on-disk"
57878+
],
57879+
"Reliability": [
57880+
"unreliable-session"
57881+
],
57882+
"Stability": [
57883+
"crash-service-down"
5787757884
]
5787857885
},
5787957886
"session_types": [
@@ -57893,7 +57900,7 @@
5789357900
"Rodrigo Rubira Branco (BSDaemon)",
5789457901
"jduck <[email protected]>"
5789557902
],
57896-
"description": "This module exploits a buffer overflow vulnerability in opcode 21 handled by\n rpc.cmsd on AIX. By making a request with a long string passed to the first\n argument of the \"rtable_create\" RPC, a stack based buffer overflow occurs. This\n leads to arbitrary code execution.\n\n NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where\n further attempts are not possible.",
57903+
"description": "This module exploits a buffer overflow vulnerability in opcode 21 handled by\n rpc.cmsd on AIX. By making a request with a long string passed to the first\n argument of the \"rtable_create\" RPC, a stack based buffer overflow occurs. This\n leads to arbitrary code execution.\n\n NOTE: Unsuccessful attempts may cause inetd/portmapper to enter a state where\n further attempts are not possible.",
5789757904
"references": [
5789857905
"CVE-2009-3699",
5789957906
"OSVDB-58726",
@@ -57909,14 +57916,24 @@
5790957916
"targets": [
5791057917
"IBM AIX Version 5.1"
5791157918
],
57912-
"mod_time": "2023-03-28 18:15:26 +0000",
57919+
"mod_time": "2025-04-18 01:17:56 +0000",
5791357920
"path": "/modules/exploits/aix/rpc_cmsd_opcode21.rb",
5791457921
"is_install_path": true,
5791557922
"ref_name": "aix/rpc_cmsd_opcode21",
5791657923
"check": false,
5791757924
"post_auth": false,
5791857925
"default_credential": false,
57919-
"notes": {},
57926+
"notes": {
57927+
"Reliability": [
57928+
"unreliable-session"
57929+
],
57930+
"Stability": [
57931+
"crash-service-restarts"
57932+
],
57933+
"SideEffects": [
57934+
"ioc-in-logs"
57935+
]
57936+
},
5792057937
"session_types": false,
5792157938
"needs_cleanup": null
5792257939
},
@@ -57931,7 +57948,7 @@
5793157948
"Ramon de C Valle <[email protected]>",
5793257949
"Adriano Lima <[email protected]>"
5793357950
],
57934-
"description": "This module exploits a buffer overflow vulnerability in _tt_internal_realpath\n function of the ToolTalk database server (rpc.ttdbserverd).",
57951+
"description": "This module exploits a buffer overflow vulnerability in _tt_internal_realpath\n function of the ToolTalk database server (rpc.ttdbserverd).",
5793557952
"references": [
5793657953
"CVE-2009-2727",
5793757954
"OSVDB-55151"
@@ -57955,14 +57972,24 @@
5795557972
"Debug IBM AIX Version 6.1",
5795657973
"Debug IBM AIX Version 5.3"
5795757974
],
57958-
"mod_time": "2020-10-02 17:38:06 +0000",
57975+
"mod_time": "2025-04-18 01:17:56 +0000",
5795957976
"path": "/modules/exploits/aix/rpc_ttdbserverd_realpath.rb",
5796057977
"is_install_path": true,
5796157978
"ref_name": "aix/rpc_ttdbserverd_realpath",
5796257979
"check": false,
5796357980
"post_auth": false,
5796457981
"default_credential": false,
57965-
"notes": {},
57982+
"notes": {
57983+
"Reliability": [
57984+
"repeatable-session"
57985+
],
57986+
"Stability": [
57987+
"crash-service-restarts"
57988+
],
57989+
"SideEffects": [
57990+
"ioc-in-logs"
57991+
]
57992+
},
5796657993
"session_types": false,
5796757994
"needs_cleanup": null
5796857995
},
@@ -58728,7 +58755,7 @@
5872858755
"skape <[email protected]>",
5872958756
"trew"
5873058757
],
58731-
"description": "This is an exploit for an undisclosed buffer overflow\n in the SoftCart.exe CGI as shipped with Mercantec's shopping\n cart software. It is possible to execute arbitrary code\n by passing a malformed CGI parameter in an HTTP GET\n request. This issue is known to affect SoftCart version\n 4.00b.",
58758+
"description": "This is an exploit for an undisclosed buffer overflow\n in the SoftCart.exe CGI as shipped with Mercantec's shopping\n cart software. It is possible to execute arbitrary code\n by passing a malformed CGI parameter in an HTTP GET\n request. This issue is known to affect SoftCart version\n 4.00b.",
5873258759
"references": [
5873358760
"CVE-2004-2221",
5873458761
"OSVDB-9011",
@@ -58755,14 +58782,24 @@
5875558782
"targets": [
5875658783
"BSDi/4.3 Bruteforce"
5875758784
],
58758-
"mod_time": "2020-10-02 17:38:06 +0000",
58785+
"mod_time": "2025-04-18 01:31:15 +0000",
5875958786
"path": "/modules/exploits/bsdi/softcart/mercantec_softcart.rb",
5876058787
"is_install_path": true,
5876158788
"ref_name": "bsdi/softcart/mercantec_softcart",
5876258789
"check": false,
5876358790
"post_auth": false,
5876458791
"default_credential": false,
58765-
"notes": {},
58792+
"notes": {
58793+
"Stability": [
58794+
"crash-service-restarts"
58795+
],
58796+
"Reliability": [
58797+
"repeatable-session"
58798+
],
58799+
"SideEffects": [
58800+
"ioc-in-logs"
58801+
]
58802+
},
5876658803
"session_types": false,
5876758804
"needs_cleanup": null
5876858805
},
@@ -58776,14 +58813,15 @@
5877658813
"author": [
5877758814
"I)ruid <[email protected]>"
5877858815
],
58779-
"description": "This exploit connects to a system's modem over dialup and exploits\n a buffer overflow vulnerability in it's System V derived /bin/login.\n The vulnerability is triggered by providing a large number of arguments.",
58816+
"description": "This exploit connects to a system's modem over dialup and exploits\n a buffer overflow vulnerability in it's System V derived /bin/login.\n The vulnerability is triggered by providing a large number of arguments.",
5878058817
"references": [
5878158818
"CVE-2001-0797",
5878258819
"OSVDB-690",
5878358820
"OSVDB-691",
5878458821
"BID-3681",
58785-
"URL-http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html",
58786-
"URL-http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html"
58822+
"URL-https://web.archive.org/web/20120114122443/http://archives.neohapsis.com/archives/bugtraq/2002-10/0014.html",
58823+
"URL-https://web.archive.org/web/20120114113100/http://archives.neohapsis.com/archives/bugtraq/2004-12/0404.html",
58824+
"URL-https://github.com/0xdea/exploits/blob/master/solaris/raptor_rlogin.c"
5878758825
],
5878858826
"platform": "Unix",
5878958827
"arch": "tty",
@@ -58793,14 +58831,24 @@
5879358831
"targets": [
5879458832
"Solaris 2.6 - 8 (SPARC)"
5879558833
],
58796-
"mod_time": "2020-10-02 17:38:06 +0000",
58834+
"mod_time": "2025-04-18 10:49:46 +0000",
5879758835
"path": "/modules/exploits/dialup/multi/login/manyargs.rb",
5879858836
"is_install_path": true,
5879958837
"ref_name": "dialup/multi/login/manyargs",
5880058838
"check": false,
5880158839
"post_auth": false,
5880258840
"default_credential": false,
58803-
"notes": {},
58841+
"notes": {
58842+
"Stability": [
58843+
"crash-service-restarts"
58844+
],
58845+
"SideEffects": [
58846+
"ioc-in-logs"
58847+
],
58848+
"Reliability": [
58849+
"repeatable-session"
58850+
]
58851+
},
5880458852
"session_types": false,
5880558853
"needs_cleanup": null
5880658854
},
@@ -86935,7 +86983,7 @@
8693586983
"mainframed a.k.a. soldier of fortran",
8693686984
"S&Oxballs a.k.a. chiefascot"
8693786985
],
86938-
"description": "(Submit JCL to z/OS via FTP and SITE FILE=JES.\n This exploit requires valid credentials on the target system)",
86986+
"description": "Submit JCL to z/OS via FTP and SITE FILE=JES.\n This exploit requires valid credentials on the target system.",
8693986987
"references": [],
8694086988
"platform": "Mainframe",
8694186989
"arch": "cmd",
@@ -86950,14 +86998,25 @@
8695086998
"targets": [
8695186999
"Automatic"
8695287000
],
86953-
"mod_time": "2020-09-22 02:56:51 +0000",
87001+
"mod_time": "2025-04-18 01:46:06 +0000",
8695487002
"path": "/modules/exploits/mainframe/ftp/ftp_jcl_creds.rb",
8695587003
"is_install_path": true,
8695687004
"ref_name": "mainframe/ftp/ftp_jcl_creds",
8695787005
"check": true,
8695887006
"post_auth": true,
8695987007
"default_credential": false,
86960-
"notes": {},
87008+
"notes": {
87009+
"Stability": [
87010+
"crash-safe"
87011+
],
87012+
"SideEffects": [
87013+
"artifacts-on-disk",
87014+
"ioc-in-logs"
87015+
],
87016+
"Reliability": [
87017+
"repeatable-session"
87018+
]
87019+
},
8696187020
"session_types": false,
8696287021
"needs_cleanup": null
8696387022
},

0 commit comments

Comments
 (0)