D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE

Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE""" import socket from kittysploit import from lib.exploit.handler...

Extract Embedded ZIP (PowerShell)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.powershell impor...

LG_NAS_3718.510.a0_RCE

Module exploits LG-NAS Storage Remote Command Execution vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """LGNAS3718.510.a0RCE""" import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handl...

Thomson TWG849 Info Disclosure

Module exploits Thomson TWG849 information disclosure vulnerability which allows reading sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Thomson TWG849 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco IOS HTTP Unauthorized Administrative Access

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS HTTP Unauthorized Administrative Access"""...

Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

3Com AP8760 Password Disclosure

Exploits 3Com AP8760 password disclosure vulnerability.If the target is vulnerable it is possible to fetch credentials for administration user. !/usr/bin/env python3 -- coding: utf-8 -- """3Com AP8760 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Router TCP/32764 Backdoor RCE

Exploits the TCP/32764 management backdoor on multiple SOHO routers Linksys, Netgear, Cisco, etc. for unauthenticated OS command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Router TCP/32764 backdoor RCE — opens execute session.""" import struct from kittysploit import from...

Netwave IP Camera Information Disclosure

This exploit will try to retrieve WPA password and ddns host name, Also it would try to read memory leak in order to find username and password !/usr/bin/env python3 -- coding: utf-8 -- """Netwave IP Camera Information Disclosure""" import re from kittysploit import from...

Grandstream GXV3611 HD - Telnet SQL Injection

SQL injection in the Grandstream GXV3611 HD telnet login resets the admin password to 'a', triggers the !/ port lol backdoor on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet SQLi — opens framework shell session.""" impo...

Billion 7700NR4 Password Disclosure

Exploits Billion 7700NR4 password disclosure vulnerability that allows to fetch credentials for admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 7700NR4 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Movistar ADSL Router BHS_RTA Path Traversal

Module exploits Movistar ADSL Router BHSRTA Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Movistar ADSL Router BHSRTA Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Asus Infosvr Backdoor RCE

Module exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Asus Infosvr Backdoor RCE""" import struct import time import socket from...

TP-Link WDR740ND/WDR740N - Debug Backdoor RCE

Exploits the hidden debug endpoint /userRpm/DebugResultRpm.htm osteam/5up backdoor credentials to run shell commands as root. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND/WDR740N debug backdoor — opens execute session.""" import re from urllib.parse import quote from kittysploit...

Belkin Play Max Persistent RCE

Module exploits Belkin SSID injection vuln, allowing to execute arbitrary command at every boot. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Play Max Persistent RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient:...

Extract Embedded ZIP (Python)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback Python emitter.""" from future import annotations from typing import Any, Dict from kittysploit import from...

D-Link DIR-815 & DIR-850L RCE

Module exploits D-Link DIR-815 and DIR-850L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-815 & DIR-850L RCE""" import socket from kittysploit import from lib.exploit.handler import Handler class...

D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure

Module explois information disclosure vulnerability in D-Link DIR-300, DIR-320, DIR-600,DIR-615 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure""" import re fro...

Technicolor TC7200 Password Disclosure

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Agent Local Store (Python)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Python emitter.""" from typing import Any, Dict from kittysploit import from...

FortiGate OS - SSH Backdoor (Fortimanager_Access)

Authenticates to FortiGate OS 4.x through 5.0.7 using the hard-coded FortimanagerAccess account and interactive SSH challenge response. !/usr/bin/env python3 -- coding: utf-8 -- """FortiGate OS 4.x–5.0.7 SSH backdoor FortimanagerAccess.""" from future import annotations import base64 import hashl...

Asmax AR1004G Password Disclosure

Exploits Asmax AR1004G Password Disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts. !/usr/bin/env python3 -- coding: utf-8 -- """Asmax AR1004G Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Huawei Router HG532 RCE

Module exploits remote command execution in Huawei Router HG532 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Router HG532 RCE""" from kittysploit import from...

Cisco Secure ACS Unauthorized Password Change

Module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

Linksys SMART WiFi Password Disclosure

Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. If target is vulnerable administrator's MD5 passsword is retrieved. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys SMART WiFi Password Disclosure""" import re from kittysploit import from...

ZTE F460 & F660 Backdoor RCE

Exploits ZTE F460 and F660 backdoor vulnerability that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460 & F660 Backdoor RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler...

D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass

Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 revD devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass""" import re from kittysploit...

Grandstream GXV3611 HD - Telnet Backdoor

Triggers the hidden Grandstream GXV3611 HD telnet backdoor !/ port lol which starts a root shell on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session.""" import time from...

Netgear R7000 & R6400 RCE

Module exploits remote command execution in Netgear R7000 and R6400 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear R7000 & R6400 RCE""" from kittysploit import from...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

D-Link Hedwig CGI RCE

Module exploits buffer overflow vulnerablity in D-Link Hedwig CGI component, which leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Hedwig CGI RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability in the ping.cgi script. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient, Handler: inf...

Zyxel P660HN-T v1 RCE

Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T v1 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v1 RCE""" from kittysploit import from lib.protocols.http.httpclien...

Hide Process argv (Python)

Replace process argv0 with an innocuous name on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process argv Python", "description": "Replace process argv0 with an innocuous nam...

Geutebruck G-Cam/EFD-2250 RCE

This module exploits a an arbitrary command execution vulnerability. Thevulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows ananonymous user to execute arbitrary commands with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Geutebruck G-Cam/EFD-2250 RCE"...

Check VM / Sandbox (Python)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox Python", "description": "Exit early when common VM or sandbox...

P2P wificam remote code execution

A credential disclosure in several cameras which utilize the GoAhead webserver, combined with an authenticated RCE allows for unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam remote code execution""" from kittysploit import from...

Daemonize Process (Zig)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Zig", "description": "Detach from the controlling terminal on Un...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

IPFire Oinkcode RCE

Module exploits IPFire 2.19 Core Update 110 Remote Code Execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Oinkcode RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Asus B1M Projector RCE

Module exploits Asus B1M Projector Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Asus B1M Projector RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

Payment Gateway PIX for WooCommerce CVE-2026-3891 upload detect

Detects CVE-2026-3891 in Payment Gateway PIX for WooCommerce = 1.5.0: unauthenticated nonce generation via admin-ajax.php indicates exposure to certificatecrtpath arbitrary file upload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-3891 — Payment Gateway PIX for WooCommerce unauthenticate...

Payment Gateway PIX for WooCommerce <= 1.5.0 - Unauthenticated Upload RCE (CVE-2026-3891)

CVE-2026-3891 in Payment Gateway PIX for WooCommerce = 1.5.0: unauthenticated arbitrary file upload via admin-ajax.php lknpixforwoocommercec6savesettings. An attacker obtains a nonce from lknpixforwoocommercegeneratenonce, uploads a PHP webshell as certificatecrtpath, and executes code under...

D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)

CVE-2024-10914: unauthenticated OS command injection in /cgi-bin/accountmgr.cgi cmd=cgiuseradd. The name parameter is concatenated into system without sanitisation. Affects EOL models including DNS-320, DNS-320LW, DNS-325, and DNS-340L. Command output is returned in the HTTP response. Opens an...

webpack-dev-server CVE-2026-14620 open-editor CSRF check

CVE-2026-14620 GHSA-f5vj-f2hx-8m93: webpack-dev-server = 5.2.5 allows cross-site requests to GET /webpack-dev-server/open-editor?fileName=, which calls launchEditor and can spawn an editor on an attacker-chosen path. The CVE-2026-6402 guard only blocks no-cors subresources; cross-site navigations...

ipTIME EAD UDP Service Detection (56026)

Detects ipTIME routers exposing the EAD UDP service on port 56026. On affected firmware e.g. A3004T 14.19.0, this endpoint is reachable without authentication and is associated with pre-auth command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ipTIME EAD UDP service port 56026...

D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect

Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...