Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

HomeMatic CCU2 - TCL RCE (CVE-2018-7297)

Exploits unauthenticated TCL system.Exec via /Text.exe on HomeMatic CCU2. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HomeMatic CCU2 TCL interpreter RCE CVE-2018-7297 — opens execute session.""" import re from kittysploit import from...

DroboPix - demo API Command Injection (CVE-2018-14706)

Exploits DroboPix JSON injection in /DroboPix/api/drobopix/demo by writing command output under the DroboPix www tree. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706 — opens execute session.""" import re import...

D-Link DIR-300/600 - command.php RCE (CVE-2013-10048)

Exploits CVE-2013-10048 via POST /command.php with Cookie uid=vttest. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import...

Zyxel NAS - setCookie Command Injection (CVE-2024-29973)

Exploits unauthenticated command injection in Zyxel NAS via multipart POST to /cmd,/simZysh/registermain/setCookie. Command output is returned; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 — opens execute...