TCP-32764 Info Disclosure

Exploits backdoor functionality that allows fetching credentials for administrator user. !/usr/bin/env python3 -- coding: utf-8 -- """TCP-32764 Info Disclosure""" import re import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

Brickcom Corp Network Camera Conf Disclosure

Module exploits Brickcom Corporation Network Camera Configuration Dislosure vulnerability. If target is vulnerable it is possible to read device configuration including administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Corp Network Camera Conf Disclosure""" import ...

SIEMENS IP-Camera CCMS2025 Password Disclosure

Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials !/usr/bin/env python3 -- coding: utf-8 -- """SIEMENS IP-Camera CCMS2025 Password Disclosure""" import re from kittysploit import from...

D-Link DIR-8XX Password Disclosure

Module exploits D-Link DIR-8XX password disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-8XX Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco DPC2420 Info Disclosure

Module exploits Cisco DPC2420 information disclosure vulnerability which allows reading sensitive information from the configuration file. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco DPC2420 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

Technicolor DWG-855 Auth Bypass

Module exploits Technicolor DWG-855 Authentication Bypass vulnerability which allows changing administrator's password. NOTE: This module will errase previous credentials, this is NOT stealthy. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor DWG-855 Auth Bypass""" import re from...

Agent Local Store (Python)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Python emitter.""" from typing import Any, Dict from kittysploit import from...

Transform Chain

Stack multiple stream transforms comma-separated module paths. !/usr/bin/env python3 -- coding: utf-8 -- """Composable transform chain — stack multiple stream transforms on one C2 channel.""" from future import annotations import importlib import re from typing import List, Optional from...

Movistar ADSL Router BHS_RTA Path Traversal

Module exploits Movistar ADSL Router BHSRTA Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Movistar ADSL Router BHSRTA Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

D-Link DWR-932 Info Disclosure

Module explois information disclosure vulnerability in D-Link DWR-932 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932 Info Disclosure""" import json import re from kittysploit import from...

Netgear N300 Auth Bypass

Module exploits authentication bypass vulnerability in Netgear N300 devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear N300 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Netgear R7000 & R6400 RCE

Module exploits remote command execution in Netgear R7000 and R6400 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear R7000 & R6400 RCE""" from kittysploit import from...

TP-Link WDR842ND configure Disclosure

Module exploits TP-Link WDR842ND configure disclosure vulnerability which allows fetching configure. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR842ND configure Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Technicolor TG784n-v3 Auth Bypass

Module exploits Technicolor TG784n-v3 authentication bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TG784n-v3 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name':...

IPFire Shellshock

Exploits shellshock vulnerability in IPFire = 2.15 Core Update 82. If the target is vulnerable it is possible to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Shellshock""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE

Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE""" import socket from kittysploit import from lib.exploit.handler...

2Wire 4011G & 5012NV Path Traversal

Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire 4011G & 5012NV Path Traversal""" import re from kittysploit import from...

Huawei HG520 Information Disclosure

Module exploits Huawei EchoLife HG520 information disclosure vulnerablity. If the target is vulnerable it is possible to retrieve sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG520 Information Disclosure""" import re from kittysploit import from...

HP JetDirect PJL Filesystem Read (port 9100)

Reads files and lists directories on network printers exposing raw JetDirect/AppSocket on TCP 9100 via PJL FSUPLOAD/FSDIRLIST. !/usr/bin/env python3 -- coding: utf-8 -- """HP JetDirect / raw printing port 9100 PJL filesystem read and listing.""" import socket from typing import Optional from...

Kyocera M2035dn Pre-Auth LFI File Read

Reads arbitrary files from Kyocera Command Center RX ECOSYS M2035dn printers via /js/ traversal with a .jpg null suffix. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera Command Center RX ECOSYS M2035dn pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient impo...

Sharp MFP Pre-Auth LFI File Read

Reads arbitrary files from Sharp multifunction printers via installedemanualdown.html. Pairs with scanner/http/sharpprinterslfidetect. !/usr/bin/env python3 -- coding: utf-8 -- """Sharp MFP pre-auth local file inclusion — arbitrary file read.""" from kittysploit import from...

PaperCut NG/MF Auth Bypass RCE (CVE-2023-27350)

Exploits CVE-2023-27350 in PaperCut NG/MF before 20.1.7, 21.2.11, and 22.0.9. Unauthenticated access to SetupCompleted grants an admin session, then Rhino print scripting runs self.payload via java.lang.ProcessBuilder. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-27350 — PaperCut NG/MF...

JetDirect / PJL Service Detection (port 9100)

Detects network printers exposing raw JetDirect/AppSocket on TCP 9100 and probes the PJL command interface with INFO ID. Optionally checks whether FSUPLOAD path traversal returns /etc/passwd content. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HP JetDirect / AppSocket raw printing and PJL...

Movable Type - XML-RPC RCE Detection (CVE-2021-20837)

Detects CVE-2021-20837 by POSTing mt.handlertocoderef XML-RPC with a base64-encoded backtick payload that reads /etc/passwd via /mt/mt-xmlrpc.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Movable Type XML-RPC mt.handlertocoderef RCE CVE-2021-20837.""" import base64 import re from kittysploit...

Twonky Server - Auth Bypass Log / Credential Leak (CVE-2025-13315)

Twonky Server = 8.5.2 allows unauthenticated access to /nmc/rpc/loggetfile, leaking logs that can contain administrator username and encrypted password CVE-2025-13315. !/usr/bin/env python3 -- coding: utf-8 -- """Twonky Server auth bypass log leak exposing admin credentials CVE-2025-13315."""...

rConfig - ajaxServerSettingsChk.php RCE (CVE-2019-16662)

Exploits CVE-2019-16662 by injecting OS commands into rootUname of /install/lib/ajaxHandlers/ajaxServerSettingsChk.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig ajaxServerSettingsChk.php unauthenticated RCE CVE-2019-16662 — opens execute session."...

TCExam - Unauthenticated File Upload RCE (CVE-2010-2153)

Exploits CVE-2010-2153 by uploading a PHP shell via tcefunctionstcecodeeditor.php into /cache/. !/usr/bin/env python3 -- coding: utf-8 -- """TCExam unauthenticated upload RCE CVE-2010-2153.""" import re from random import randint from kittysploit import from lib.protocols.http.httpclient import...

DroboPix - demo API Command Injection (CVE-2018-14706)

Exploits DroboPix JSON injection in /DroboPix/api/drobopix/demo by writing command output under the DroboPix www tree. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706 — opens execute session.""" import re import...

ManageEngine SDP - FILENAME Traversal Detection (CVE-2011-2757)

Detects CVE-2011-2757 via FileDownload.jsp?module=agent&FILENAME=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-2757 via FileDownload.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Ruckus Unleashed - rpmkey Credential Disclosure Detection

Detects Ruckus Unleashed credential disclosure by reading /user/wpstoolcache/var/run/rpmkey.rev then /user/wpstoolcache/var/run/rpmkey and looking for allpowerfulloginpassword. !/usr/bin/env python3 -- coding: utf-8 -- """Ruckus Unleashed rpmkey credential disclosure CVE-2019-19837...""" import r...

up.time - firstTimeLogin Authentication Bypass Detection

Detects up.time = 5.0 auth bypass surface via index.php?userid=admin&firstTimeLogin=True matching blank-password validation response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects up.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ZTE F460/F660 - web_shell_cmd.gch RCE (CVE-2014-2321)

Exploits CVE-2014-2321 by POSTing Cmd= to /webshellcmd.gch. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460/F660 webshellcmd.gch RCE CVE-2014-2321 — opens execute session.""" from urllib.parse import quote from kittysploit import from...

Ektron CMS - ekajaxtransform XSLT RCE Detection (CVE-2012-5357)

Detects CVE-2012-5357 by POSTing msxsl:script C XSLT that runs ipconfig.exe to ekajaxtransform.aspx. !/usr/bin/env python3 -- coding: utf-8 -- """Ektron CMS XSLT C script RCE CVE-2012-5357.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient impo...

NETGEAR DGND3700v2 - Password Recovery Detection (PSV-2021-0343)

NETGEAR DGND3700v2 exposes admin credentials via /setup.cgi?nextfile=passwordrecovered.htm without authentication PSV-2021-0343. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGND3700v2 unauthenticated admin password recovery PSV-2021-0343.""" import re from kittysploit import from...

ASUSTOR ADM - aggrecate_js.cgi RCE Detection (CVE-2018-11510)

Detects CVE-2018-11510 by injecting ls into /portal/apis/aggrecatejs.cgi?script=launcher"&CMD&" and matching directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi unauthenticated RCE CVE-2018-11510.""" import re from kittysploit import from...

D-Link DIR-300/600 - command.php RCE Detection (CVE-2013-10048)

Detects CVE-2013-10048/10069 by POSTing cmd=ls -l /; to /command.php with Cookie uid=vttest. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 / CVE-2013-10069.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ownCloud - graphapi phpinfo Leak (CVE-2023-49103)

Fetches GetPhpInfo.php exposed by ownCloud graphapi and extracts phpinfo / OWNCLOUD environment variables CVE-2023-49103 / CVE-2023-49282. !/usr/bin/env python3 -- coding: utf-8 -- """ownCloud graphapi GetPhpInfo.php credential/config leak CVE-2023-49103.""" import re from kittysploit import from...

Drupal Coder - coder_upgrade.run.php Exposure Detection

Soft-detects exposed Drupal Coder upgrade script at /sites/all/modules/coder/coderupgrade/scripts/coderupgrade.run.php. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Coder module coderupgrade.run.php exposure SA-CONTRIB-2016-039.""" from kittysploit import from lib.protocols.http.httpclient...

Spring Cloud Function - routing-expression RCE (CVE-2022-22963)

Exploits CVE-2022-22963 by injecting SpEL into the spring.cloud.function.routing-expression header to run a reverse CMD payload. Waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Function routing-expression RCE CVE-2022-22963 — reverse session.""" import base64...

MongoDB REST - SSJS RCE Detection

Detects MongoDB REST interface SSJS execution via /admin/$cmd/?filtereval=function.... !/usr/bin/env python3 -- coding: utf-8 -- """MongoDB REST interface SSJS code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OmniPCX - masterCGI RCE Detection (CVE-2007-3010)

Detects CVE-2007-3010 by requesting /cgi-bin/masterCGI?ping=nomip&user=;id;. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Hastymail2 - rs=passthru RCE Detection (CVE-2011-4542)

Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DNS-320/325 - system_mgr.cgi RCE Detection

Detects D-Link ShareCenter RCE via /cgi-bin/systemmgr.cgi?cmd=cgismstest&command1=id. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

FreeNAS - exec_raw.php RCE Detection (CVE-2010-20059)

Detects CVE-2010-20059 by requesting /execraw.php?cmd=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreeNAS execraw.php RCE CVE-2010-20059.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

hybris Commerce - medias context LFI Detection (CVE-2014-8871)

Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...

AirLive - cgi_test.cgi RCE Detection (CVE-2015-2279)

Detects AirLive OS command injection via /cgitest.cgi?writetan&;id&id MD/BU models or manufacture Basic-auth wirelessmft WL/POE models. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive Boa cgitest.cgi OS command injection CVE-2015-2279.""" import base64 import re from kittysploit import from...

ManageEngine SDP - FileDownload.jsp Path Traversal Detection

Detects ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal to /etc/passwd via null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient...

Symantec Web Gateway - pbcontrol.php RCE (CVE-2012-2953)

Exploits CVE-2012-2953 command injection in pbcontrol.php filename. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953 — opens execute session.""" import re from urllib.parse import quote from kittysploit import...

TerraMaster TOS - exportUser.php Command Injection (CVE-2020-15568)

Exploits CVE-2020-15568 by injecting OS commands via /include/exportUser.php func=exec and reading redirected stdout from /include/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS exportUser.php exec RCE CVE-2020-15568 — opens execute...