WinRM Gather System Information

Enumerate Windows system information through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather System Information", "description": "Enumerate Windows system information through a WinRM session", "author": "KittySploit...

WinRM Service Detection

Detects WinRM /wsman endpoints on ports 5985/5986. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WinRM /wsman endpoints and advertised auth methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.winrm.detectors import probewinrm...

WinRM Authentication Enumeration

Probe WinRM /wsman and enumerate advertised authentication methods. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate WinRM authentication methods on ports 5985/5986.""" from future import annotations import json from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

WinRM Kerberos Client

Creates a WinRM session over HTTP/HTTPS using Kerberos tickets from KRB5CCNAME. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import try: from pypsrp.client import Client PYPSRPAVAILABLE = True except Exception: Client = None PYPSRPAVAILABLE = False class ModuleListener: in...

CVE-2026-55201

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

EUVD-2026-37785

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

CVE-2026-55201 Evil-WinRM - Path Traversal in download_dir() Function

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

CVE-2026-55201

CVE-2026-55201 affects Evil-WinRM (up to version 3.9). A path traversal in download_dir() can cause the server to generate filenames with traversal sequences from Get-ChildItem output, which are passed unsanitized to File.join(), enabling writes outside the intended download directory. Attackers ...

PT-2026-50529

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download dir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

CVE-2026-55201: Improper Limitation of a Pathname to a Restricted Directory

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the downloaddir function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem...

CVE-2026-4434: Improper Certificate Validation

Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification...

Ofensive-security

This repository contains my Offensive Cyber Security / Penetrati...

CVE-2021-27022

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes inventory service nodes...

com.cloudcoreo.plugins:cloudcoreo-deploytime (>=0.1.0, <=0.2.3), com.spcow.plugins:winrm-client (1.0) +50 more potentially affected by CVE-2025-67635 via org.jenkins-ci.main:jenkins-core (1.651.3)

org.jenkins-ci.main:jenkins-core MAVEN version 1.651.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.cloudcoreo.plugins:cloudcoreo-deploytime =0.1.0, =0.10.0, =1.2, =1.4.2, =1.5.0, =1.0, =1....

Vulnerabilities fixed in Nagios XI

Nagios has fixed vulnerabilities in Nagios XI Versions before 2024R1.4.2 and 2024R2. The vulnerabilities include a remote code execution vulnerability within the Business Process Intelligence component, insufficient permissions on systemd unit files, unauthorized access to API keys, a command...

EUVD-2025-37213

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitatio...

CVE-2025-34284

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitatio...

CVE-2025-34284

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitatio...

CVE-2024-14008 Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations...

CVE-2024-14008

Nagios XI prior to 2024R1.3.2 is affected by a remote command execution vulnerability in the WinRM Configuration Wizard. The issue stems from insufficient validation of user-supplied input, allowing an authenticated administrator to inject shell metacharacters into backend command invocations, re...