Email Inbox Search

Search the operator mailbox attached to an email reverse session via IMAP !/usr/bin/env python3 -- coding: utf-8 -- from email import policy from email.header import decodeheader from email.parser import BytesParser from typing import Any, Dict, List, Optional from kittysploit import try: import...

Import BloodHound Graph

Merge BloodHound nodes/edges JSON into the agent attack graph for lightweight path planning without Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """ Import BloodHound JSON export into the agent attack graph. Set exportpath to nodes.json, edges.json, or a directory containing both. The merged...

QUIC Upload File

Upload a local file to the remote host via an active QUIC C2 session !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin class ModulePost,...

QUIC Execute Shellcode

Send hex-encoded shellcode to the implant for in-process execution !/usr/bin/env python3 -- coding: utf-8 -- import os import re from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.protocols.quic.quicsessionmixin import QuicSessionMixin HEXRE =...

AWS Public Endpoint Detection

Detects AWS Lambda Function URLs and API Gateway execute-api endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly exposed AWS Lambda Function URLs and API Gateway endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Adminer Detection

Detects Adminer single-file DB admin panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Adminer database administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanne...

SMTP Mimic Transform

Simulates SMTP handshake 220/EHLO/250 then wraps C2 in SMTP-like base64 lines. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import struct from typing import Optional from kittysploit import SMTP handshake: server greeting + EHLO response SMTPSERVERGREETING = b"220 localhost ESMTP...

HTTPS Mimic Transform

Sends fake TLS 1.2 Client/Server Hello at start, then TLS Application Data. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import TLS record: type 1 + version 2 + length 2 + fragment TLSHEADERLEN = 5 TLSHANDSHAKE = 0x16 TLSAPPLICATIONDATA = 0x17 TLSVERSION1...

XOR Stream Transform

XORs the C2 stream with a repeating key. Symmetric encode/decode. Evades simple signature detection. !/usr/bin/env python3 -- coding: utf-8 -- from typing import Optional from kittysploit import class ModuleTransform: """XOR stream transform - obfuscates C2 traffic with a repeating XOR key."""...

SMB share enumeration

Connects over SMB null session, guest, or supplied credentials and lists available shares with optional top-level directory listing. Intended for reconnaissance during an engagement, not as a one-shot vulnerability check. !/usr/bin/env python3 -- coding: utf-8 -- """Énumération des partages SMB...

Redis Delete Keys

Delete one or more Redis keys by name or SCAN pattern from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Delete Keys", "description": "Delete one or more Redis keys by name or SCAN pattern", "author": "KittySploit...

Redis Set Expiration

Set EXPIRE on a key or remove expiration with PERSIST from kittysploit import from lib.protocols.redis.redisclient import RedisClient class ModulePost, RedisClient: info = "name": "Redis Set Expiration", "description": "Set EXPIRE on a key or remove expiration with PERSIST", "author": "KittySploi...

Azure VM Run Command Listener

Creates a command session backed by Azure VM Run Command. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import try: from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient AZUREAVAILABLE = True except Exception: DefaultAzureCredential ...

PHP Command Shell, Bind TCP

Listen on the target and expose a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Bind TCP', 'description': 'Listen on the target and expose a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP,...

GCP Overprivileged Bindings

Find overprivileged IAM bindings: primitive roles, public principals, and broad group grants !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Overprivileged Bindings", "description": "Find...

Filesystem Dropbox-like Polling C2

Uses a shared directory as a dead-drop C2: agents read commands and write results. !/usr/bin/env python3 -- coding: utf-8 -- import time import uuid from pathlib import Path from kittysploit import class ModuleListener: info = "name": "Filesystem Dropbox-like Polling C2", "description": "Uses a...

Reverse MQTT Shell Listener

Command/result C2 over MQTT topics, separate from the generic MQTT pub/sub listener. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import time from kittysploit import class ModuleListener: info = "name": "Reverse MQTT Shell Listener", "description": "Command/result C2 over...

Meterpreter Reverse TCP (compat alias)

Compatibility alias for listeners/multi/meterpreterreversetcp. Prefer meterpreterreversetcp for new configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Compatibility alias for the Meterpreter reverse TCP listener.""" from kittysploit import Listener from...

Windows Gather Password Vault Credentials

Extract credentials stored in the Windows Credential Manager Password Vault on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re class...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...