Windows x86 Reverse TCP Stager

Windows x86 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Windows x86 Reverse TCP Stager', 'description': 'Windows x86 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.WINDOWS, 'listener...

D-Link DCS-5300 CSRF

D-Link DCS-5300 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-5300 CSRF", "description": "D-Link DCS-5300 camera - Change root password via CSRF POST", "author":...

D-Link DIR-615 CSRF

D-Link DIR-615 router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-615 CSRF", "description": "D-Link DIR-615 router - Change wireless password via CSRF POST", "author":...

PHP 7.4 > ffi disable_functions bypass

PHP 7.4 ffi disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.4 ffi disablefunctions bypass", "description": "PHP 7.4 ffi disablefunctions bypass", "arch": Arch.PHP, 'agent': 'risk...

WordPress Plugin Backdoor

Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/ from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'WordPress Plugin Backdoor', 'description': 'Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/',...

Android properties from a Sony TV

Get internal TV files over HTTP without authentication from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Android properties from a Sony TV', 'description': 'Get internal TV files over HTTP without authentication',...

Joomla <= 3.6.4 admin takeover

An issue was discovered in components/comusers/models/registration.php in Joomla! before 3.6.5.Incorrect filtering of registration form data stored to the session on a validation error enables auser to gain access to a registered user's account and reset the user's group mappings, username,and...

D-Link DCS-900 CSRF

D-Link DCS-900 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-900 CSRF", "description": "D-Link DCS-900 camera - Change root password via CSRF POST", "author": "KittySploit...

Monsta FTP CVE-2025-34299

Monsta FTP - Arbitrary file download from malicious FTP server leading to RCE CVE-2025-34299 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpserver import Ftpserver import json import os import random import string import tempfile import threading impor...

FTP Download Directory

Downloads entire directory structure from FTP server recursively !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import time class ModulePost, FTPClientMixin: """FTP Download All Module""" info = "name": "FTP...

Abyss Web Server first-run console takeover log-as-CGI RCE

First-run console credential creation, bind access log as /bin/sh CGI, smuggle command via User-Agent, trigger via log URI fetch. """Abyss Web Server X1 2.16.22.0 - Missing Authentication for Console Credential Creation Reaching a Configuration-Write to Log-as-CGI Command Execution Chain CWE-306,...

CaptureBites MetaServer unauth RunProgram workflow RCE

Anonymous SOAP chain CreateWorkflow → UploadDefinition RunPrograms → ChangeWorkflows → CreateDocument triggers cmd.exe as SYSTEM. """CaptureBites MetaServer — Unauthenticated SYSTEM RCE Through the Workflow RunProgram Sink""" from future import annotations import base64 import http.client import...

Plastic SCM 8087 name-only ACL trigger RCE

NameWorkingMode + default ACL: cm trigger create with attacker Path → Process.Start. Requires local cm client; declares plasticuser no password. """Plastic SCM / Unity VCS name-only auth trigger RCE port 8087, cm client.""" from future import annotations import os import subprocess from kittysplo...

Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE

Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE """Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE""" from future import annotations from kittysploit import import socket, zipfile, time, sys, os, io, random, string, base64, re import struct import time...

Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE — Detect

Fingerprint / reachability check for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE""" from kittysploit import from...

Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE — Detect

Fingerprint / reachability check for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE""" from kittysploit import from...

Rainbowfish PacsOne STOW-RS SOP Instance UID traversal RCE

Authenticated STOW-RS with traversing SOP Instance UID writes PHP under web root; invoke via ?c= for command execution reverse shell via set payload. """PacsOne Server 7.3.9 - Path Traversal in the DICOMweb STOW-RS Store Path CWE-22""" from future import annotations from kittysploit import from...

Apache Struts 2 RestfulActionMapper OGNL RCE

Apache Struts 2.6.11.x with struts.mapper.class=restful and wildcard 1 result dispatch: OGNL in the action name reaches Runtime.exec via java.beans.Statement / Expression sandbox bypass. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2 RestfulActionMapper OGNL injection unauthenticate...

Xeams SMTP save-body cron root RCE

X-SMSAVEBODY4DEBUGGING writes arbitrary file; base64 body plants /etc/cron.d job running payload as root. """Xeams SMTP X-SMSAVEBODY4DEBUGGING Arbitrary File Write Cron Root RCE""" from future import annotations from kittysploit import import base64 import socket import sys import time import re...

Parasoft CTP deserialization restore path JSP RCE

Anonymous POST database/restore;welcome with malicious backup.zip deserializes gadget chain writing JSP under webapp images; GET executes. """Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT - Unfiltered Java Deserialization in the Database Restore Path Behind a Raw-URI License Gate Bypass an...

Cacti CVE-2022-46169 remote_agent RCE

CVE-2022-46169 Cacti = 1.2.22: X-Forwarded-For auth bypass on /remoteagent.php plus unsanitized pollerid passed to procopen. Uses in-band webroot file drop when readable. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2022-46169 remoteagent pollerid command injection.""" from future impor...

Nette Framework Callback RCE (CVE-2020-15227)

Exploits CVE-2020-15227 in Nette Application before 2.0.19/3.0.6: attacker-controlled callback parameters passed to calluserfunc on /nette.micro/ yield remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework callback injection RCE CVE-2020-15227.""" import re from...

MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

Exploits CVE-2023-34362 in Progress MOVEit Transfer: abuses moveitisapi.dll m2 header-smuggling to set guest session variables, then triggers UserGetUsersWithEmailAddress SQL injection via guestaccess.aspx to hijack an admin session or enable xpcmdshell for remote code execution. !/usr/bin/env...

Xiaomi Mi WiFi R3G LFI (CVE-2019-18371)

Exploits CVE-2019-18371 in Xiaomi Mi WiFi R3G 2.28.23: NGINX alias misconfiguration allows reading /etc/config/account and other files via api-third-party/download. !/usr/bin/env python3 -- coding: utf-8 -- """Xiaomi Mi WiFi R3G NGINX alias LFI CVE-2019-18371.""" import re from kittysploit import...

Confluence Widget Connector SSTI (CVE-2019-3396)

Exploits CVE-2019-3396 in Confluence Server: Widget Connector macro template path traversal reads local files and enables Velocity SSTI RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Confluence Widget Connector SSTI / path traversal CVE-2019-3396.""" import json import re from kittysploit impo...

Kibana Timelion RCE (CVE-2019-7609)

Exploits CVE-2019-7609 in Kibana 5.6.15 / 6.6.1: Timelion sheet prototype pollution yields Node.js childprocess execution. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Timelion prototype pollution RCE CVE-2019-7609.""" import json import re from kittysploit import from...

SharePoint ToolShell CVE-2025-53770 Detection

Detects on-premises Microsoft SharePoint ToolShell exposure: unauthenticated access to ToolPane.aspx via Referer bypass CVE-2025-53771 and unsafe deserialization surface CVE-2025-53770. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SharePoint ToolShell auth bypass CVE-2025-53771 and ToolPan...

Certifried AD CS Machine Certificate Spoofing (CVE-2022-26923)

Exploits CVE-2022-26923: creates a machine account, clears its SPN, sets dNSHostName to match a domain controller, then enrolls an AD CS Machine template certificate via NTLM web enrollment. The resulting certificate may authenticate as the spoofed DC via PKINIT. !/usr/bin/env python3 -- coding:...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

Check Point Management Path Traversal RCE (CVE-2026-93616)

Exploits CVE-2026-93616 on Check Point Quantum Security Management: pre-authentication path traversal on TCP/19009 allows writing attacker-controlled content to reachable paths, enabling remote code execution on the SMS/Gaia host. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point Quantum...

Cisco Secure FMC Authentication Bypass (CVE-2026-20079)

Exploits CVE-2026-20079 in Cisco Secure Firewall Management Center: crafted CGISESSID=csmprocesses cookie bypasses authentication on CGI endpoints, exposing FMC system information and privileged management surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Firewall FMC boot-time...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

Network Preflight (Zig)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Zig", "description": "Probe callback reachabilit...

Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE

Exploits CVE-2026-101072 via POST /x.ico/apip.cgi on Netcore NR289-GE AC controllers. The ip form field breaks out of a wget --post-data shell command. Requires a bound AP MAC; payload length is limited to 19 bytes. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101072...

Citrix NetScaler CVE-2026-19490 Detect

Detects Citrix NetScaler ADC/Gateway deployments likely exposed to CVE-2026-19490 SAML alternate-path authentication bypass. Requires Gateway/AAA virtual server usage; flags affected 13.1/14.1 builds before 13.1-63.21 / 14.1-73.32 and reachable SAML endpoints. !/usr/bin/env python3 -- coding: utf...

D-Link DIR-895L L2TP Host Name AVP OOB Write (CVE-2026-100740)

Out-of-bounds one-byte NUL write in the L2TP control parser on D-Link DIR-895L firmware A1102b07 when the Host Name AVP length is 127 peerhostname128. Requires L2TP WAN role / exposed UDP 1701. Set confirm=true to send the crafted SCCRQ trigger on authorized lab targets only. !/usr/bin/env python...

Netcore NR289-GE CVE-2026-101076 Detect

Detects CVE-2026-101076 in Netcore NR289-GE: unauthenticated OS command injection via POST /x.ico/setntpserverip.cgi. The ntpip parameter is passed to system inside a wget command template. Uses a short echo probe when activeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect...

Apache Struts2 S2-057 OGNL RCE (CVE-2018-11776)

Exploits CVE-2018-11776 S2-057 OGNL injection via crafted namespace paths when alwaysSelectFullNamespace is enabled. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-057 OGNL RCE CVE-2018-11776 — execute session.""" from future import annotation...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

ESVA - learn-msg.cgi RCE (CVE-2012-10046)

Exploits CVE-2012-10046 by injecting OS commands into the id parameter of /cgi-bin/learn-msg.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046 — execute session.""" from future import annotations import re...

Apache Commons Text RCE (CVE-2022-42889 / Text4Shell)

Exploits CVE-2022-42889 in Apache Commons Text 1.5–1.9 when the StringSubstitutor default interpolator evaluates $script:javascript:... lookups. Requires a vulnerable request parameter on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text StringSubstitutor RCE...

ZTE ZXHN H108N Wifi Password Disclosure

Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability that allows to retrieve password for wifi connection. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXHN H108N Wifi Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Asus B1M Projector RCE

Module exploits Asus B1M Projector Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Asus B1M Projector RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

3Com AP8760 Password Disclosure

Exploits 3Com AP8760 password disclosure vulnerability.If the target is vulnerable it is possible to fetch credentials for administration user. !/usr/bin/env python3 -- coding: utf-8 -- """3Com AP8760 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

BHU uRouter RCE

Module exploits BHU uRouter unauthenticated remote code execution vulnerability, which allows executing commands on the router with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """BHU uRouter RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Netcore/Netis UDP/53413 Backdoor RCE

Exploits the Netcore/Netis UDP backdoor on port 53413 for unauthenticated remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP/53413 backdoor RCE — opens execute session.""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

Netgear JNR1010 Path Traversal

Module exploits Netgear JNR1010 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear JNR1010 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

D-Link DIR-645 Password Disclosure

Module exploits D-Link DIR-645 password disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link...