Remove false positive references

cdelafuente-r7 · cdelafuente-r7 · commit 179a5453120b · 2025-11-19T17:34:15.000+01:00
diff --git a/modules/exploits/linux/http/asuswrt_lan_rce.rb b/modules/exploits/linux/http/asuswrt_lan_rce.rb
@@ -33,8 +33,7 @@ def initialize(info = {})
           ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/asuswrt-lan-rce.txt'],
           ['URL', 'https://seclists.org/fulldisclosure/2018/Jan/78'],
           ['CVE', '2018-5999'],
-          ['CVE', '2018-6000'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['CVE', '2018-6000']
         ],
         'Targets' => [
           [
diff --git a/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb b/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb
@@ -29,8 +29,7 @@ def initialize(info = {})
           ['CVE', '2025-1094'], # The SQL injection in PostgreSQL code.
           ['URL', 'http://web.archive.org/web/20241226144006/https://www.beyondtrust.com/trust-center/security-advisories/bt24-10'], # BeyondTrust Advisory
           ['URL', 'https://www.postgresql.org/support/security/CVE-2025-1094/'], # PostgreSQL Advisory
-          ['URL', 'https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis'], # Rapid7 Analysis
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['URL', 'https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis'] # Rapid7 Analysis
         ],
         'DisclosureDate' => '2024-12-16',
         'Platform' => [ 'linux', 'unix' ],
diff --git a/modules/exploits/linux/misc/igel_command_injection.rb b/modules/exploits/linux/misc/igel_command_injection.rb
@@ -35,9 +35,7 @@ def initialize(info = {})
         'References' => [
           [ 'CVE', '2025-34082' ],
           [ 'URL', 'https://kb.igel.com/securitysafety/en/isn-2021-01-igel-os-remote-command-execution-vulnerability-41449239.html' ],
-          [ 'URL', 'https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt' ],
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ], # Telnet service
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_005_VNC ]
+          [ 'URL', 'https://www.igel.com/wp-content/uploads/2021/02/lxos_11.04.270.txt' ]
         ],
         'Platform' => ['linux'],
         'Arch' => [ARCH_X86, ARCH_X64],
diff --git a/modules/exploits/linux/ssh/ssh_erlangotp_rce.rb b/modules/exploits/linux/ssh/ssh_erlangotp_rce.rb
@@ -37,8 +37,7 @@ def initialize(info = {})
           ['CVE', '2025-32433'],
           ['URL', 'https://x.com/Horizon3Attack/status/1912945580902334793'],
           ['URL', 'https://platformsecurity.com/blog/CVE-2025-32433-poc'],
-          ['URL', 'https://github.com/ProDefense/CVE-2025-32433'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_004_SSH]
+          ['URL', 'https://github.com/ProDefense/CVE-2025-32433']
         ],
         'Platform' => ['linux', 'unix'],
         'Arch' => [ARCH_CMD],
diff --git a/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb b/modules/exploits/multi/http/atlassian_confluence_rce_cve_2024_21683.rb
@@ -34,8 +34,7 @@ def initialize(info = {})
           ['CVE', '2024-21683'],
           ['URL', 'https://jira.atlassian.com/browse/CONFSERVER-95832'],
           ['URL', 'https://realalphaman.substack.com/p/quick-note-about-cve-2024-21683-authenticated'],
-          ['URL', 'https://github.com/W01fh4cker/CVE-2024-21683-RCE'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['URL', 'https://github.com/W01fh4cker/CVE-2024-21683-RCE']
         ],
         'DisclosureDate' => '2024-05-21',
         'Privileged' => false, # `NT AUTHORITY\NETWORK SERVICE` on Windows by default, `confluence` on Linux by default.
diff --git a/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb b/modules/exploits/multi/http/connectwise_screenconnect_rce_cve_2024_1709.rb
@@ -31,8 +31,7 @@ def initialize(info = {})
           ['CVE', '2024-1709'], # Auth bypass to create admin account.
           ['URL', 'https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8'], # Vendor Advisory
           ['URL', 'https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/'], #  Auth Bypass PoC
-          ['URL', 'https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass'], #  Analysis of both CVEs
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['URL', 'https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass'] #  Analysis of both CVEs
         ],
         'DisclosureDate' => '2024-02-19',
         'Platform' => %w[win linux unix],
diff --git a/modules/exploits/multi/misc/bmc_server_automation_rscd_nsh_rce.rb b/modules/exploits/multi/misc/bmc_server_automation_rscd_nsh_rce.rb
@@ -31,8 +31,7 @@ def initialize(info = {})
           ['URL', 'https://nickbloor.co.uk/2018/01/01/rce-with-bmc-server-automation/'],
           ['URL', 'https://nickbloor.co.uk/2018/01/08/improving-the-bmc-rscd-rce-exploit/'],
           ['CVE', '2016-1542'],
-          ['CVE', '2016-1543'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['CVE', '2016-1543']
         ],
         'DisclosureDate' => '2016-03-16',
         'Privileged' => false,
diff --git a/modules/exploits/osx/http/remote_for_mac_rce.rb b/modules/exploits/osx/http/remote_for_mac_rce.rb
@@ -22,8 +22,7 @@ def initialize(info = {})
         'Author' => ['Chokri Hammedi (@blue0x1)'],
         'References' => [
           ['CVE', '2025-34089'],
-          ['PACKETSTORM', '195347'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['PACKETSTORM', '195347']
         ],
         'DisclosureDate' => '2025-05-27',
         'Platform' => ['unix', 'osx'],
diff --git a/modules/exploits/solaris/telnet/fuser.rb b/modules/exploits/solaris/telnet/fuser.rb
@@ -22,8 +22,7 @@ def initialize(info = {})
         'References' => [
           [ 'CVE', '2007-0882' ],
           [ 'OSVDB', '31881'],
-          [ 'BID', '22512' ],
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ],
+          [ 'BID', '22512' ]
         ],
         'Privileged' => false,
         'Platform' => %w[solaris unix],
diff --git a/modules/exploits/solaris/telnet/ttyprompt.rb b/modules/exploits/solaris/telnet/ttyprompt.rb
@@ -22,8 +22,7 @@ def initialize(info = {})
         'References' => [
           ['CVE', '2001-0797'],
           ['OSVDB', '690'],
-          ['BID', '5531'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES],
+          ['BID', '5531']
         ],
         'Privileged' => false,
         'Platform' => %w[solaris unix],
diff --git a/modules/exploits/unix/ssh/tectia_passwd_changereq.rb b/modules/exploits/unix/ssh/tectia_passwd_changereq.rb
@@ -33,8 +33,7 @@ def initialize(info = {})
           ['CVE', '2012-5975'],
           ['EDB', '23082'],
           ['OSVDB', '88103'],
-          ['URL', 'https://seclists.org/fulldisclosure/2012/Dec/12'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_004_SSH]
+          ['URL', 'https://seclists.org/fulldisclosure/2012/Dec/12']
         ],
         'Payload' => {
           'Compat' =>
diff --git a/modules/exploits/windows/imap/mercury_login.rb b/modules/exploits/windows/imap/mercury_login.rb
@@ -29,8 +29,7 @@ def initialize(info = {})
         'License' => MSF_LICENSE,
         'References' => [
           ['CVE', '2007-1373'],
-          ['EDB', '3418'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['EDB', '3418']
         ],
         'Privileged' => true,
         'DefaultOptions' => {
diff --git a/modules/exploits/windows/misc/unified_remote_rce.rb b/modules/exploits/windows/misc/unified_remote_rce.rb
@@ -37,8 +37,7 @@ def initialize(info = {})
           [ 'EDB', '49587' ],
           [ 'URL', 'https://www.unifiedremote.com/' ],
           [ 'URL', 'https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/unified%20remote/unified-remote-rce.py' ],
-          [ 'CVE', '2022-3229' ],
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ]
+          [ 'CVE', '2022-3229' ]
         ],
         'Arch' => [ ARCH_X64, ARCH_X86 ],
         'Platform' => 'win',
diff --git a/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb b/modules/exploits/windows/rdp/cve_2019_0708_bluekeep_rce.rb
@@ -95,8 +95,7 @@ def initialize(info = {})
           ['URL', 'https://github.com/zerosum0x0/CVE-2019-0708'],
           ['URL', 'https://zerosum0x0.blogspot.com/2019/11/fixing-remote-windows-kernel-payloads-meltdown.html'],
           ['ATT&CK', Mitre::Attack::Technique::T1059_COMMAND_AND_SCRIPTING_INTERPRETER],
-          ['ATT&CK', Mitre::Attack::Technique::T1068_EXPLOITATION_FOR_PRIVILEGE_ESCALATION],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_001_REMOTE_DESKTOP_PROTOCOL]
+          ['ATT&CK', Mitre::Attack::Technique::T1068_EXPLOITATION_FOR_PRIVILEGE_ESCALATION]
         ],
         'DefaultOptions' => {
           'RDP_CLIENT_NAME' => 'ethdev',
diff --git a/modules/exploits/windows/smb/cve_2020_0796_smbghost.rb b/modules/exploits/windows/smb/cve_2020_0796_smbghost.rb
@@ -44,8 +44,7 @@ def initialize(info = {})
           [ 'URL', 'https://www.youtube.com/watch?v=RSV3f6aEJFY&t=1865s' ],
           [ 'URL', 'https://www.coresecurity.com/core-labs/articles/getting-physical-extreme-abuse-of-intel-based-paging-systems' ],
           [ 'URL', 'https://www.coresecurity.com/core-labs/articles/getting-physical-extreme-abuse-of-intel-based-paging-systems-part-2-windows' ],
-          [ 'URL', 'https://labs.bluefrostsecurity.de/blog/2017/05/11/windows-10-hals-heap-extinction-of-the-halpinterruptcontroller-table-exploitation-technique/' ],
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES ]
+          [ 'URL', 'https://labs.bluefrostsecurity.de/blog/2017/05/11/windows-10-hals-heap-extinction-of-the-halpinterruptcontroller-table-exploitation-technique/' ]
         ],
         'DefaultOptions' => {
           'EXITFUNC' => 'thread',
diff --git a/modules/exploits/windows/smb/smb_doublepulsar_rce.rb b/modules/exploits/windows/smb/smb_doublepulsar_rce.rb
@@ -47,8 +47,7 @@ def initialize(info = {})
           ['URL', 'https://www.countercept.com/blog/doublepulsar-usermode-analysis-generic-reflective-dll-loader/'],
           ['URL', 'https://github.com/countercept/doublepulsar-detection-script'],
           ['URL', 'https://github.com/countercept/doublepulsar-c2-traffic-decryptor'],
-          ['URL', 'https://gist.github.com/msuiche/50a36710ee59709d8c76fa50fc987be1'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES]
+          ['URL', 'https://gist.github.com/msuiche/50a36710ee59709d8c76fa50fc987be1']
         ],
         'DisclosureDate' => '2017-04-14', # Shadow Brokers leak
         'License' => MSF_LICENSE,
diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb
@@ -83,8 +83,7 @@ module is not able to clean up after itself. The service and payload
           ['MSB', 'MS08-068'],
           ['URL', 'http://blogs.technet.com/swi/archive/2008/11/11/smb-credential-reflection.aspx'],
           ['URL', 'https://en.wikipedia.org/wiki/SMBRelay'],
-          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_002_SMB_WINDOWS_ADMIN_SHARES]
+          ['URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx']
         ],
         'Arch' => [ARCH_X86, ARCH_X64],
         'Platform' => 'win',
diff --git a/modules/exploits/windows/ssh/freesshd_authbypass.rb b/modules/exploits/windows/ssh/freesshd_authbypass.rb
@@ -32,8 +32,7 @@ def initialize(info = {})
           ['OSVDB', '88006'],
           ['BID', '56785'],
           ['URL', 'http://archives.neohapsis.com/archives/fulldisclosure/2012-12/0012.html'],
-          ['URL', 'https://seclists.org/fulldisclosure/2010/Aug/132'],
-          ['ATT&CK', Mitre::Attack::Technique::T1021_004_SSH]
+          ['URL', 'https://seclists.org/fulldisclosure/2010/Aug/132']
         ],
         'Platform' => 'win',
         'Privileged' => true,
diff --git a/modules/post/linux/manage/sshkey_persistence.rb b/modules/post/linux/manage/sshkey_persistence.rb
@@ -37,10 +37,7 @@ def initialize(info = {})
               stdapi_fs_separator
             ]
           }
-        },
-        'References' => [
-          [ 'ATT&CK', Mitre::Attack::Technique::T1021_REMOTE_SERVICES ]
-        ]
+        }
       )
     )
 
