ptrace Credential Steal LPE (CVE-2026-4633)

Local privilege escalation via CVE-2026-4633: ptracemayaccess / pidfdget credential-steal primitive. Compiles and uploads exploit to the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via ptrace credential steal CVE-2026-4633.""" import os import shlex impor...

bad_epoll UAF LPE (CVE-2026-46242)

Local privilege escalation via CVE-2026-46242 epoll use-after-free. Compiles and uploads exploit to target session for root shell. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via epoll UAF CVE-2026-46242.""" import os import shlex import tempfile from kittysploit import from...

Log4Shell RCE (CVE-2021-44228)

Exploits CVE-2021-44228 Log4j JNDI lookup injection via HTTP headers and query parameters. Uses sleep-based confirmation then delivers the configured reverse CMD payload through a user-supplied LDAP callback URL. !/usr/bin/env python3 -- coding: utf-8 -- """Log4Shell JNDI injection RCE...

WordPress Core CVE-2026-87902 Page Template LFI Detect

Detects CVE-2026-87902 in WordPress Core 4.7.0 through 7.1.1: getpagetemplate decodes pagename without validatefile, enabling unauthenticated local .php inclusion when the active theme exposes a top-level page- directory e.g. page-templates/. Fixed in 7.1.2. !/usr/bin/env python3 -- coding: utf-8...

Telemetry Buffer (PowerShell)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Network Preflight (Python)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Python", "description": "Probe callback...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Check Point CVE-2026-93616 Management Detect

Detects exposure to CVE-2026-93616 on Check Point Quantum Security Management SmartConsole/SMS before R82.20 / JHF takes listed in sk1000171. Fingerprints the management web service on TCP/19009 and reachable HTTPS management panels without sending exploit upload payloads. !/usr/bin/env python3 -...

GitLab CVE-2026-85706 File Path LFI Detect

Detects CVE-2026-85706 in self-managed GitLab CE/EE before patched releases 17.11.7, 18.0.4, 18.1.2, 18.2.2, 18.3.2, 18.4.0: unauthenticated multipart uploads can supply file.path or metadata.path outside Workhorse temp dirs, leading to arbitrary file read. Sends a benign absolute-path probe only...

JFrog Artifactory CVE-2026-82329 Detect

Detects CVE-2026-82329: default Artifactory installs register a blank additional join key, allowing unauthenticated POST /access/api/v1/registry/join with an HS256 JWT signed using the publicly derivable 32-byte padded key. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JFrog Artifactory...

FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

Drupal RESTWS passthru RCE

Exploits Drupal RESTWS module RCE via taxonomyvocabulary passthru callbacks SA-CONTRIB-2016-040. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE — execute session.""" from future import annotations import re from...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

Monitorix Pipe RCE (CVE-2013-7070)

Exploits CVE-2013-7070/7071 by injecting commands into pipe-wrapped Monitorix URL paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix pipe path command injection RCE CVE-2013-7070 — execute session.""" from future import annotations import re from...

Apache Druid JavaScript RCE (CVE-2021-25646)

Exploits CVE-2021-25646 by enabling the JavaScript parser through /druid/indexer/v1/sampler and running arbitrary OS commands. Druid 0.20.1; authentication is off by default. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Druid JavaScript sampler RCE...

Honeywell IP Camera - check.cgi File Read

Reads arbitrary files via Honeywell IP camera /check.cgi?file= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP camera check.cgi file parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...

OpenCPU RCE via do.call

Exploits unauthenticated R code execution on OpenCPU via /ocpu/library/base/R/do.call/json with systempaste.... Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCPU R do.call system RCE — execute session.""" from future import annotations import json import r...

IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Bash Shellshock HTTP CGI RCE (CVE-2014-6271)

Exploits CVE-2014-6271 by injecting :;; into HTTP headers against CGI-enabled paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — execute session.""" from future import annotations import re from kittysploit import...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

D-Link DIR-850L Creds Disclosure

Module exploits D-Link DIR-850L credentials disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-850L Creds Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

firepower_management60_rce

firepowermanagement60rce !/usr/bin/env python3 -- coding: utf-8 -- """firepowermanagement60rce""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'firepowermanagement60rce', 'description': 'firepowermanagement60rce',...

Cisco Secure ACS Unauthorized Password Change

Module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

Netsys Multi RCE

Exploits Netsys multiple remote command execution vulnerabilities that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netsys Multi RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

Cisco UCS Manager RCE

Module exploits Cisco UCS Manager 2.1 1b Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCS Manager RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect

Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

Honeywell PM43 Command Injection (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 industrial printers before firmware P10.19.050004: newline injection in loadfile.lp Configure runs self.payload as the embedded Linux user. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-3710 — Honeywell PM43 printer unauthenticated command...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Beward IP Camera - servetest NTP RCE Detection (CVE-2025-34042)

Detects Beward camera command injection via /cgi-bin/operator/servetest?cmd=ntp&ServerName=pool.ntp.org|id|| !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP command injection CVE-2025-34042 / Feb 2019.""" import re from kittysploit import from...

ESVA - learn-msg.cgi RCE Detection (CVE-2012-10046)

Detects CVE-2012-10046 by requesting /cgi-bin/learn-msg.cgi?id=|id; after fingerprinting released.html. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FreeSWITCH - /api/system Command Execution (CVE-2018-19911)

Exploits CVE-2018-19911 by passing OS commands to /api/system/?. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH /api/system RCE CVE-2018-19911 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

D-Link DNS-320 - system_mgr.cgi Command Injection (CVE-2020-25506)

Exploits CVE-2020-25506 by injecting OS commands into fntpserver on /cgi-bin/systemmgr.cgi, writing stdout under /cgi-bin/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506 — opens execute...

D-Link DIR-825 - router_info.xml WPS Disclosure (CVE-2019-9126)

Detects CVE-2019-9126 by requesting /routerinfo.xml?section=wps and looking for WPS PIN / wireless credential fields. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 WPS info disclosure CVE-2019-9126.""" import re from kittysploit import from lib.protocols.http.httpclient import...

QNAP Photo Station - Path Traversal Detection (CVE-2019-7192)

Detects QNAP Photo Station NAS-201911-25 CVE-2019-7192/7193/7194/7195 by creating a slideshow album, extracting access code, then reading /etc/passwd via /p/api/video.php filename traversal. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station album API path traversal...

Pulse CMS - p Parameter LFI Detection (CVE-2010-4330)

Detects CVE-2010-4330 via index.php??p=../../../../etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4330 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pulse CMS - p...

Eir D1000 - CWMP WLAN Key Disclosure Detection (CVE-2016-10372)

Soft-detects Eir D1000 CWMP exposure by confirming /globe fingerprint then calling GetSecurityKeys and extracting NewPreSharedKey Mirai-era TR-069 RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Eir D1000 CWMP WLAN key disclosure CVE-2016-10372 soft check.""" import re from kittysploit...

Synology DSM/BSM - File Disclosure via RedirectURI (CVE-2024-50629)

Exploits improper encoding in SYNO.API.Auth.RedirectURI to inject an X-Accel-Redirect header and read limited internal files default: Synology Drive cloud-workerd.log. Works on vulnerable DSM and BeeStation. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM/BSM limited file read via...

Zyxel NAS - Auth Bypass Indicator (CVE-2023-27992 family)

Detects Zyxel NAS authentication bypass via /cmd,/ck6fup6/zylogmain/configuremailsyslog, indicating exposure to the Jun/Nov 2023 vulnerability set including pre-auth command injection CVE-2023-27992 and related issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS authentication bypass...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...