WinRM Persistence Scheduled Task

Create a scheduled task persistence entry through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Scheduled Task",...

Copy Fail Docker Escape via Modprobe (CVE-2026-31431)

Exploits CVE-2026-31431 Copy Fail / authencesn AEAD page-cache write from inside a Linux container to overwrite /proc/sys/kernel/modprobe, plant a host payload, and trigger requestmodule for host code execution. Requires a writable host path privileged container, shared PID+mount, or hostPath e.g...

VirtualBox VMSVGA COTable UAF Guest Escape (CVE-2026-21955)

Exploits a use-after-free in VirtualBox VMSVGA COTable/MOB handling from a privileged Linux guest. Compiles a static ELF, optionally unbinds vmwgfx, uploads the binary, and triggers host code execution with a configurable command. Auto-detects the host OS PE/WinExec on Windows, ELF/libc system on...

WinRM Gather PuTTY WinSCP FileZilla

Collect PuTTY, WinSCP, and FileZilla saved sessions through WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather PuTTY WinSCP...

WinRM Gather WiFi Keys

Extract saved WLAN profile PSKs via netsh over a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin import re class ModulePost, WinRMSessionMixin: info = "name": "WinRM Gather WiFi Keys", "description...

WinRM PowerShell Exec

Execute a PowerShell command or script through an active WinRM session !/usr/bin/env python3 -- coding: utf-8 -- import base64 from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM PowerShell Exec",...

WinRM Persistence Service

Create, start, or remove a Windows service for persistence via WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Service", "description"...

WinRM Gather Network

Enumerate network interfaces, routes, DNS, ARP, connections, and shares through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather Network", "description": "Enumerate network interfaces, routes, DNS, ARP, connections, a...

WinRM Gather Users

Enumerate current user, local users/groups, and interactive sessions through a WinRM session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePost: info = "name": "WinRM Gather Users", "description": "Enumerate current user, local users/groups, and interactive session...

WinRM Download File

Download a remote file through an active WinRM session pypsrp fetch !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Download File",...

WinRM Upload File

Upload a local file to the remote host through an active WinRM session pypsrp copy !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Upload File...

WinRM Persistence Run Key

Add or remove a Run/RunOnce registry persistence entry via WinRM !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.winrm.winrmsessionmixin import WinRMSessionMixin class ModulePost, WinRMSessionMixin: info = "name": "WinRM Persistence Run Key", "description": "A...

WinRM Spawn Reverse Shell

From the current WinRM session, open a reverse TCP listener lhost:lport and run a PowerShell stager so the target connects back as a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Spawn a reverse TCP shell from an existing WinRM session. Starts a local reverse handler, runs a...

phpMyAdmin Authenticated Remote Code Execution (CVE-2018-12613)

phpMyAdmin v4.8.0 and v4.8.1 are vulnerable to local file inclusion, which can be exploited post-authentication to execute PHP code by application. Tested against phpMyAdmin v4.8.1. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin 4.8.0/4.8.1 authenticated LFI to RCE — CVE-2018-12613...

Metasploitable3 Windows Environment

Metasploitable3 Windows Server 2008 R2 lab VM via Vagrant — intentionally vulnerable Windows target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleVagrantEnvironment: info = "name": "Metasploitable3 Windows Environment",...

Drupal login bruteforce

Bruteforce Drupal /user/login with username/password wordlists. Extracts formbuildid / formtoken and detects success via session cookies SESS/SSESS and redirects away from the login form. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal user/login credential spray — wordlist or single-pair...

SMB enumshares

Connects over SMB null session, guest, or supplied credentials and lists available shares with optional top-level directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """Énumération des partages SMB NetShareEnum via pysmb.""" import socket from typing import Any, Dict, List, Optional, Tup...

Splunk Authenticated RCE via SimpleXML Dashboard PDF (CVE-2022-43571)

Exploits CVE-2022-43571 in Splunk Enterprise: authenticated Python code injection via sparkline style parameters fillColor/lineColor in a SimpleXML dashboard. Payload executes when PDF export is triggered. Affected: versions prior to 8.1.12, 8.2.0 through 8.2.8, and 9.0.0 through 9.0.1. Requires...

Splunk CVE-2022-43571 (SimpleXML PDF RCE) detection

Detects Splunk Enterprise instances in the CVE-2022-43571 affected version ranges 8.1.12, 8.2.0–8.2.8, 9.0.0–9.0.1. Reads the version from the login page by default; optional credentials refine the check via the authenticated home page. Does not exploit. !/usr/bin/env python3 -- coding: utf-8 --...

Moodle detection

Detects a Moodle installation and reports the version from lib/upgrade.txt when available. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Moodle and report the version from lib/upgrade.txt.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Metasploitable3 Linux Environment

Metasploitable3 Ubuntu 14.04 lab VM packaged for Docker — intentionally vulnerable Linux target for authorized internal-lab agent benchmarks. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = "name": "Metasploitable3 Linux Environment",...

SMB Client

Connects to a remote SMB server and creates an interactive SMB shell session !/usr/bin/env python3 -- coding: utf-8 -- """ SMB client listener — connects to a remote SMB service and creates an interactive session. """ from kittysploit import from lib.protocols.smb.smbclient import SMBAuth,...

SMB Linux Deploy PHP Webshell

Uploads a PHP command webshell through a writable Samba share. Use when the SMB share is also served by a web server. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy a small PHP webshell through a writable Samba share.""" import os import tempfile from urllib.parse import quote, urlparse from...

Linux Docker / Container Detection

Detect whether the session runs inside Docker, Podman, LXC, or Kubernetes /.dockerenv, cgroups, mountinfo, systemd-detect-virt -c. Unlike detectvm, this does not rely on hypervisor/DMI signals. from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import...

Moodle Webshell Plugin

Generate a Moodle local plugin webshell that can be installed under local/ and activated from Site administration Plugins from kittysploit import import os import re import zipfile class ModuleBackdoor: info = 'name': 'Moodle Webshell Plugin', 'description': 'Generate a Moodle local plugin webshe...

SMB Windows Deploy Reverse Shell

From an authenticated SMB session, upload a PowerShell reverse TCP stager and execute it remotely to obtain a classic shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ Deploy a Windows reverse shell from an SMB session. Uploads a PowerShell stager to a writable admin share, executes it...

SSH login

Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Attempts common and wordlist-based SSH credentials and registers an interactive SSH session on success. !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility alias for auxiliary/scanner/ssh/sshloginbruteforce. Prefer the...

Moodle SpellChecker Path Authenticated RCE (CVE-2021-21809)

Moodle allows an authenticated administrator to define spellcheck settings via the web interface. An administrator can update the aspell path to include a command injection similar to CVE-2013-3630. Requires admin credentials. Tested against Moodle 3.11.2, 3.10.0, 3.8.0. !/usr/bin/env python3 --...

Drupal 7.x SQLi RCE (CVE-2014-3704)

Exploits SA-CORE-2014-005 / CVE-2014-3704 Drupageddon in Drupal 7.x before 7.32: unauthenticated SQL injection via crafted array keys on the user login form. Delivers the selected PHP payload via form-cache injection default or the authenticated user-post PHP filter chain. !/usr/bin/env python3 -...

Spring Cloud Azure B2C Cross-Issuer Auth Bypass (CVE-2026-50338)

Mint an Entra clientcredentials token and call a B2C-protected API CVE-2026-50338 !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json from typing import Any, Optional from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Spring Cloud Azure B2C CVE-2026-50338 Detection

Detect B2C JWT-protected APIs; verify CVE-2026-50338 when Entra creds are set !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-50338 Spring Cloud Azure B2C cross-issuer auth bypass.""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import...

Linux Gather Sudo Policy Audit (GTFO)

GTFO-style sudo policy audit NOPASSWD / NOEXEC !/usr/bin/env python3 -- coding: utf-8 -- import os import re import time from kittysploit import from lib.post.linux.session import LinuxSessionMixin from lib.post.linux.sudopolicylists import ALWAYSBLOCK, ALLOWNOEXEC class ModulePost,...

Windows Gather Autoruns Surface

Enumerate Run keys, services, tasks, and startup folders !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Autoruns Surface", "description":...

Windows Gather Defender Posture Audit

Audit Defender status, preferences, and recent detections !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Defender Posture Audit", "description": "Audit...

Windows Gather Kerberos Ticket Audit

Dump klist and logon session Kerberos context !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Kerberos Ticket Audit", "description": "Dump...

Windows Gather WSL Posture Audit

List WSL distros, version, and host processes !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather WSL Posture Audit", "description": "List WSL...

WebRTC Leak Audit

Collect WebRTC ICE candidates for IP leak detection from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WebRTC Leak Audit", "description": "Collect WebRTC ICE candidates for IP leak detection", "author": "KittySploit Team", "browser": Browser.ALL, "platform":...

Windows Gather ADCS Posture Audit

Discover AD CS endpoints and risky certificate templates !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather ADCS Posture Audit", "description":...

Windows Gather AppLocker & WDAC Audit

Audit AppLocker and WDAC enforcement !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather AppLocker & WDAC Audit", "description": "Audit AppLocke...

Windows Gather Browser Profile Audit

Enumerate browser profiles and sensitive artifact paths !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Browser Profile Audit", "description": "Enumerat...

Windows Gather DLL & COM Hijack Surface

Find writable PATH dirs and HKCU COM overrides !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather DLL & COM Hijack Surface", "description": "Fi...

Windows Gather Event Log Triage

Pull recent security events logons, 4688, task creation !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Event Log Triage", "description":...

Windows Gather Installed Software Audit

Inventory installed software with version hints !/usr/bin/env python3 -- coding: utf-8 -- import json import re from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Installed Software Audit",...

Windows Gather Writable Share Audit

Find SMB shares writable by the current user !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Writable Share Audit", "description": "Find SMB...

CSP Audit

Probe CSP meta tags and inline/eval restrictions from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "CSP Audit", "description": "Probe CSP meta tags and inline/eval restrictions", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

Browser Permissions Audit

Query sensitive browser permission states from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Browser Permissions Audit", "description": "Query sensitive browser permission states", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

Service Worker Cache Audit

List service workers, cache storage, and quota from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Service Worker Cache Audit", "description": "List service workers, cache storage, and quota", "author": "KittySploit Team", "browser": Browser.ALL, "platform":...

Windows Gather Browser Credential Extract

Stage Chromium/Firefox Login Data and Cookies to temp !/usr/bin/env python3 -- coding: utf-8 -- import json import os import time from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Browser Credenti...

Windows Gather Firewall Posture Audit

List firewall profiles and inbound allow rules !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather Firewall Posture Audit", "description": "List...

Windows Gather PowerShell Logging Audit

Check Script Block, Module, and Transcription logging !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.windows.session import WindowsSessionMixin class ModulePost, WindowsSessionMixin: info = "name": "Windows Gather PowerShell Logging Audit",...