Exclusive Addons for Elementor ≤ 2.6.9 - Stored XSS

The plugin fails to sanitize the s parameter, allowing contributors or higher roles to inject persistent JavaScript that executes when victims view affected pages. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Sourcegraph Gitserver 3.36.3 Rce

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service. The service acts as a git exec proxy, and fails to properly restrict calling git config. This allows an attacker to set the git core.sshCommand...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH acces by leveraging knowledge of the private key. from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler...

Cisco UCS Director default scpuser password

The 'scpuser' has the password of 'scpuser', and allows an attacker to login to the virtual appliance via SSH from kittysploit import from lib.protocols.ssh.sshclient import Sshclient class ModuleExploit, Sshclient: info = 'name': 'Cisco UCS Director default scpuser password', 'description': "The...

Nginx Vulnerability Scanner

Scans for Nginx-specific vulnerabilities, version information, misconfigurations, and exposed sensitive files !/usr/bin/env python3 -- coding: utf-8 -- """ Nginx Vulnerability Scanner Scans for Nginx-specific vulnerabilities, misconfigurations, and security issues """ from kittysploit import from...

PAN-OS 10.0 - Remote Code Execution (RCE) (Authenticated)

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

PHP 7.3.5 disable_functions bypass

PHP 7.3.5 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.3.5 disablefunctions bypass", "description": "PHP 7.3.5 json disablefunctions bypass", "arch": Arch.PHP, 'agent':...

PHP 7.4 > ffi disable_functions bypass

PHP 7.4 ffi disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.4 ffi disablefunctions bypass", "description": "PHP 7.4 ffi disablefunctions bypass", "arch": Arch.PHP, 'agent': 'risk...

PHP 7.0-7.4 disable_functions bypass

PHP 7.0-7.4 disablefunctions bypass 7.0 - all versions 7.1 - all versions 7.2 - all versions 7.3 7.3.15 7.4 7.4.3 from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.4 disablefunctions bypass",...

Wordpress user enumeration

Try to extract wordpress user enumeration from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Wordpress user enumeration', 'description': "Try to extract wordpress user enumeration", 'tags': 'web', 'scanner', 'wordpress',...

Webmin password_change.cgi Backdoor

An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': "Webmin passwordchange.cgi Backdoor",...

Zig Meterpreter Linux, Reverse TCP (compat)

Linux Meterpreter payload in Zig compatibility path; requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility module for the Linux Zig Meterpreter reverse TCP payload. Prefer payloads/singles/cmd/unix/zigmeterpreterlinuxreversetcp. """ from kittysploit import from...

CVE-2025-46652 - HawkTrace RCE

Remote Code Execution vulnerability in Microsoft Windows Server Update Services WSUS !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import requests import urllib3 import xml.etree.ElementTree as ET from datetime import...

Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated)

This exploit module abuses the mishandling of password reset in JSON for Strapi CMS version 3.0.0-beta.17.4 to change the password of a privileged user. from kittysploit import from lib.protocols.http.httpclient import Httpclient import json class ModuleAuxiliary, Httpclient: info = "name": "Stra...

D-Link DIR-615 CSRF

D-Link DIR-615 router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-615 CSRF", "description": "D-Link DIR-615 router - Change wireless password via CSRF POST", "author":...

JavaScript Unicode Encoder

Encodes JavaScript code into Unicode escape sequences \uXXXX from kittysploit import class ModuleEncoder: info = "name": "JavaScript Unicode Encoder", "description": "Encodes JavaScript code into Unicode escape sequences \uXXXX", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT,...

ChromeCast Discovery

Launch this module to discover chromecast within a Network from kittysploit import import pychromecast class ModuleAuxiliary: info = 'name': 'ChromeCast Discovery', 'description': 'Launch this module to discover chromecast within a Network', 'author': 'KittySploit Team', timeout = OptInteger5,...

Android properties from a Sony TV

Get internal TV files over HTTP without authentication from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Android properties from a Sony TV', 'description': 'Get internal TV files over HTTP without authentication',...

FTP Honeypot Server

Advanced FTP honeypot that simulates a real FTP server and logs intrusion attempts from kittysploit import from lib.protocols.tcp.tcpserver import Tcpserver import socket import threading import datetime import os class ModuleAuxiliary, Tcpserver: info = 'name': 'FTP Honeypot Server',...

Kodi Plugin Generator

Kodi Plugin Generator for Kodi 19 from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'Kodi Plugin Generator', 'description': 'Kodi Plugin Generator for Kodi 19', 'author': 'KittySploit Team', 'arch': Arch.X86, Arch.X64, lhost = OptIP'','Connect-back IP address',...

atx minicmts creds

LICA miniCMTS E8Ku/i/... devices allow remote attackers to obtain sensitive information via a direct POST request for the inc/user.ini file, leading to discovery of a password hash. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: inf...

Reboot a Chromecast

With this module you can reboot a specified chromecast from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Reboot a Chromecast', 'description': 'With this module you can reboot a specified chromecast', 'author':...

Linux x64 Command Shell Stage

Linux x64 shell stage - expects socket fd 3 to be connected staged !/usr/bin/env python3 -- coding: utf-8 -- """ Linux x64 Command Shell Stage Author: KittySploit Team Version: 1.0.0 This payload is a "stage" that expects a socket to already be connected. It performs: - dup2 loop to redirect...

Web Cookie Listener

Web Cookie Listener from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web Cookie Listener', 'description': 'Web Cookie Listener', 'author': 'KittySploit Team', 'arch': Arch.PHP, 'handler':...

Metasploitable Environment

Metasploitable Linux - Intentionally vulnerable Linux distribution for penetration testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'Metasploitable Environment', 'description': 'Metasploitable Linux - Intentionally vulnerable...

FTP Listener

FTP client listener - connects to FTP server and creates interactive FTP shell session from kittysploit import from ftplib import FTP class ModuleListener: info = 'name': 'FTP Listener', 'description': 'FTP client listener - connects to FTP server and creates interactive FTP shell session',...

Windows x64 Command Shell Stage

Windows x64 shell stage - expects socket handle to be connected staged !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import subprocess import struct from pathlib import Path class ModulePayload: info = 'name': 'Windows x64 Command Shell Stage', 'description': 'Window...

Collect PHP and webserver extension list

Collect PHP and webserver extension list from kittysploit import class ModulePost: info = "name": "Collect PHP and webserver extension list", "description": "Collect PHP and webserver extension list", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

PHP procfs disable_functions bypass

PHP 7.3.5 procfs disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP procfs disablefunctions bypass", "description": "PHP 7.3.5 procfs disablefunctions bypass", "arch": Arch.PHP,...

Enumerate MyImunify360 Configuration

Extract MyImunify360 configuration, credentials, whitelist, and rules from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "Enumerate MyImunify360 Configuration", "description": "Extract MyImunify360 configuration, credentials,...

PHP Port Scanner

PHP Port Scanner from kittysploit import class ModulePost: info = "name": "PHP Port Scanner", "description": "PHP Port Scanner", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired': True, 'produces':...

Meterpreter Reverse TCP

Advanced Meterpreter-like reverse TCP listener with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter reverse TCP listener with advanced post-exploitation...

Debian Package Creator

Debian Package Creator from kittysploit import import os import shutil from pathlib import Path from lib.compile.debevasionhelpers import createararchive, createcontroltar, createdatatar, class ModuleBackdoor: info = 'name': 'Debian Package Creator', 'description': 'Debian Package Creator',...

Pop-Under Tab Closing

Create a pop-under window on user's tab closing from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Pop-Under Tab Closing", "description": "Create a pop-under window on user's tab closing", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

firefox 66.0.3

Exploit spidermonkey firefox 66.0.3 from kittysploit import class ModuleBrowserExploit: info = "name": "firefox 66.0.3", "description": "Exploit spidermonkey firefox 66.0.3", "cve": "2019-11707", "platform": Platform.LINUX, "arch": Arch.X64, "payload": "default":...

TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path /hax?jsp=/app/rest/... bypasses authentication to create an administrator account via the REST users API. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity authentication bypass admin creation CVE-2024-27198."""...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

LiteSpeed cPanel Plugin CVE-2026-48172 Detection

Detects LiteSpeed Web Server cPanel plugin endpoints that may be vulnerable to CVE-2026-48172 Redis enable/disable privesc to root. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteSpeed cPanel plugin privesc surface CVE-2026-48172.""" from kittysploit import from...

SharePoint ToolShell CVE-2025-53770 Detection

Detects on-premises Microsoft SharePoint ToolShell exposure: unauthenticated access to ToolPane.aspx via Referer bypass CVE-2025-53771 and unsafe deserialization surface CVE-2025-53770. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SharePoint ToolShell auth bypass CVE-2025-53771 and ToolPan...

Cisco IOS SNMP CVE-2025-20352 Detection

Detects Cisco IOS/IOS-XE devices with SNMP exposed that may be vulnerable to CVE-2025-20352 stack-based buffer overflow in SNMP subsystem leading to unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco IOS/IOS-XE SNMP RCE surface CVE-2025-20352.""" from kittysploit impor...

Razer Sila Router LFI (CVE-2022-29014)

Exploits CVE-2022-29014 in Razer Sila 2.0.418: unauthenticated ubus JSON-RPC file.read on /ubus/ allows reading arbitrary files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila ubus file read LFI CVE-2022-29014.""" import json import re from kittysploit import from...

TVT DVR Device Info Disclosure (CVE-2024-7339)

Exploits CVE-2024-7339 in TVT/Provision-ISR/AVISION DVRs: unauthenticated POST /queryDevInfo leaks firmware, network, and device metadata. !/usr/bin/env python3 -- coding: utf-8 -- """TVT DVR queryDevInfo disclosure CVE-2024-7339.""" from kittysploit import from lib.protocols.http.httpclient impo...

Visual Tools DVR Shellshock RCE (CVE-2021-42071)

Exploits CVE-2021-42071 in Visual Tools DVR VX16: Shellshock in User-Agent on /cgi-bin/slogin/login.py yields unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR Shellshock RCE CVE-2021-42071.""" import re from kittysploit import from...

WyreStorm Apollo VX20 Config Leak (CVE-2024-25735)

Exploits CVE-2024-25735 in WyreStorm Apollo VX20 1.3.58: unauthenticated GET /device/config exposes SoftAP router credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """WyreStorm Apollo VX20 config leak CVE-2024-25735.""" from kittysploit import from lib.protocols.http.httpclient impor...

Citrix ADC/Gateway Template Injection RCE (CVE-2019-19781)

Exploits CVE-2019-19781 on Citrix ADC/Gateway: directory traversal writes a Perl-eval XML template under /netscaler/portal/templates/ then triggers it via newbm.pl for unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ADC/Gateway directory traversal template R...

Ivanti Endpoint Manager Auth Bypass (CVE-2026-1603)

Exploits CVE-2026-1603 in Ivanti Endpoint Manager 2024 SU5: unauthenticated POST to /RemoteControlAuth/api/Auth with logintype 64 leaks session identifiers and stored credential metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint Manager auth bypass CVE-2026-1603.""" import jso...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

Spring Boot Actuator H2 RCE

Exploits exposed Spring Boot Actuator /actuator/env to inject an H2 connection-test-query CREATE ALIAS EXEC and restart the application, yielding remote command execution when spring.datasource.hikari is active. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator H2...

VMware vCenter vropsplugin RCE (CVE-2021-21972)

Exploits CVE-2021-21972 in VMware vCenter Server: unauthenticated arbitrary file upload via /ui/vropspluginui/rest/services/uploadova path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter vropsplugin upload RCE CVE-2021-21972.""" import re from kittysploit import from...

OverlayFS FUSE LPE (CVE-2023-0386)

Local privilege escalation via CVE-2023-0386: FUSE + overlayfs copyup mishandles user xattrs on privileged files, allowing a low-privilege user to write SUID shell or /etc/passwd entries. Compiles and uploads the exploit to the target session requires libfuse-dev on operator host. !/usr/bin/env...