GCP Storage HMAC Keys Loot

List Cloud Storage HMAC keys used for S3-compatible interoperability access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Storage HMAC Keys Loot", "description": "List Cloud...

GCP Add SSH Key Metadata

Add an SSH public key to project or instance metadata for legacy SSH access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Add SSH Key Metadata", "description": "Add an SSH...

GCP OS Login Import SSH Key

Import an SSH public key into OS Login for persistent VM access !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP OS Login Import SSH Key", "description": "Import an S...

GCP Cloud Build Pivot as Service Account

Run an arbitrary command in Cloud Build under a target service account identity !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build Pivot as Service Account"...

GCP Cloud Run Deploy Command Pivot

Create and run a Cloud Run job that executes an arbitrary command under a chosen identity !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Run Deploy...

GCP Compute SSH Pivot via OS Login

Pivot to a VM by importing an SSH key through OS Login and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via OS...

MeiG FORGE_SLT711 CVE-2026-36356 (GoAhead blind OS command injection) detection

Detects unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 GoAhead firmware. Fingerprints the web UI, then sends a timed sleep payload to POST /action/SetRemoteAccessCfg. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

WordPress GiveWP CVE-2024-5932 detection

Detects exposed GiveWP plugin versions affected by PHP object injection RCE. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "WordPre...

GCP Cloud SQL Instances

Enumerate Cloud SQL instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud SQL Instances", "description": "Enumerate Cloud SQL instances in t...

GCP Firebase Apps

Enumerate Firebase web apps in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Apps", "description": "Enumerate Firebase web apps in the current...

GCP Logging Sinks

Enumerate Cloud Logging sinks in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Logging Sinks", "description": "Enumerate Cloud Logging sinks in the...

GCP Pub/Sub Inventory

Enumerate Pub/Sub topics and subscriptions in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Pub/Sub Inventory", "description": "Enumerate Pub/Sub topic...

GCP Cloud Build Source Refs Loot

Extract Cloud Build source references GCS, CSR, Git, connected repos from build history !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build Source Refs Loot",...

GCP Firebase Realtime Database Loot

Discover Firebase RTDB instances and read database JSON via authenticated REST access !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Realtime Database Loot",...

GCP Secret Versions Loot

List Secret Manager secrets and access secret version payloads !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Versions Loot", "description": "List Secret...

GCP Set IAM Policy Binding

Add an IAM role binding for a member on the project or a service account !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Set IAM Policy Binding", "description": "Add an IAM role...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

GCP Cloud Function Deploy Command Pivot

Deploy a Gen2 Cloud Function via Cloud Build that executes an arbitrary command on HTTP invoke !/usr/bin/env python3 -- coding: utf-8 -- import json import re import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functi...

Azure VM Run Command Listener

Creates a command session backed by Azure VM Run Command. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import try: from azure.identity import DefaultAzureCredential from azure.mgmt.compute import ComputeManagementClient AZUREAVAILABLE = True except Exception: DefaultAzureCredential ...

WinRM Kerberos Client

Creates a WinRM session over HTTP/HTTPS using Kerberos tickets from KRB5CCNAME. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import try: from pypsrp.client import Client PYPSRPAVAILABLE = True except Exception: Client = None PYPSRPAVAILABLE = False class ModuleListener: in...

Kubernetes ServiceAccount Secret Reader

Reads a pod service-account token from a PHP session and uses it to query the Kubernetes API for secrets in a namespace. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import class ModulePost: info = "name": "Kubernetes ServiceAccount Secret Reader", "description": "Reads ...

GCP Compute Instances

Enumerate Compute Engine instances in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Instances", "description": "Enumerate Compute Engine...

AD Shadow Credentials Auto

Runs Certipy shadow auto against an account and surfaces the resulting TGT/NT hash output. !/usr/bin/env python3 -- coding: utf-8 -- import os import shlex import shutil import subprocess from kittysploit import class ModulePost: info = "name": "AD Shadow Credentials Auto", "description": "Runs...

WordPress DB User Takeover

Extracts WordPress DB credentials from wp-config.php through a PHP session, dumps wpusers, and optionally resets one user's password. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import class ModulePost: info = "name": "WordPress DB User Takeover", "description": "Extracts...

runc Wrapper Bind-Mount Helper

Builds a minimal runc bundle through a sudo-allowed wrapper, adds a bind mount for a host path, and optionally reads a target file from inside the container. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.linux.session import LinuxSessionMixin class ModulePost,...

GCP Compute Attack Surface

Map Compute Engine attack surface: public IPs, scopes, metadata, and weak controls !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Attack Surface", "description": "Map Compute Engin...

GCP Firebase Exposure

Analyze Firebase/Firestore exposure: apps, hosting, rules, remote config, and API keys !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Exposure", "description": "Analyze...

GCP Public Exposure

Detect publicly exposed GCP resources IAM, storage, firewalls, SQL, BigQuery !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Public Exposure", "description": "Detect publicly exposed GCP...

GCP Workload Identity Federation

Analyze workload identity pools, providers, and risky federation configurations !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Workload Identity Federation", "description":...

GCP Cloud Functions

Enumerate Cloud Functions Gen1 and Gen2 in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Functions", "description": "Enumerate Cloud Functions Ge...

Fortinet FortiOS 8.x Firmware Decryptor (forticrack_v8)

Decrypt Fortinet .out firmware FortiOS 8.0 / kernel 4.19.13 build 0167, extract flatkc and rootfs.gz from the boot partition, decrypt rootfs with RSA + FORT-RC4, and unpack the CPIO initramfs. Pure Python — no gunzip, binwalk, or cpio required. !/usr/bin/env python3 -- coding: utf-8 -- """ Fortin...

PHP Command Shell, Bind TCP

Listen on the target and expose a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Bind TCP', 'description': 'Listen on the target and expose a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP,...

PHP Command Shell, Reverse TCP

Connect back and create a command shell via PHP from kittysploit import class ModulePayload: CLIENTLANGUAGE = "php" info = 'name': 'PHP Command Shell, Reverse TCP', 'description': 'Connect back and create a command shell via PHP', 'category': PayloadCategory.SINGLE, 'arch': Arch.PHP, 'platform':...

MeiG FORGE_SLT711 GoAhead blind OS command injection (CVE-2026-36356)

Unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 firmware. The GoAhead endpoint POST /action/SetRemoteAccessCfg passes the JSON password field to sprintf"echo root:"%s"|chpasswd" and system as root. !/usr/bin/env python3 -- coding: utf-8 --...

GCP IAM Deny Policies

Analyze IAM v2 deny policies attached to the project and inherited ancestors !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP IAM Deny Policies", "description": "Analyze IAM v2...

GCP Org Folder Inheritance

Map project ancestry and inherited IAM bindings from folders and organization !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Org Folder Inheritance", "description": "Map projec...

Wing FTP Server CVE-2026-44403 - authenticated admin check

CVE-2026-44403: Wing FTP Server = 8.1.2 allows a full administrator to poison domain-admin session serialization via the mydirectory field, leading to Lua RCE. This auxiliary verifies admin panel presence, authenticates with supplied credentials, and reports whether the version hint is in the...

Google Cloud Compute SSH Listener

Creates a command session to a Google Compute Engine VM via gcloud or direct SSH. !/usr/bin/env python3 -- coding: utf-8 -- import json import os import shutil import subprocess import tempfile from kittysploit import DEFAULTSERVICEACCOUNTFILES = "service-account.json", "credentials.json",...

Slack Socket Mode Polling Shell

Uses Slack Socket Mode as a command/result transport for lab agents. !/usr/bin/env python3 -- coding: utf-8 -- import time from kittysploit import try: from slackbolt import App from slackbolt.adapter.socketmode import SocketModeHandler SLACKAVAILABLE = True except Exception: App =...

Reverse HTTP Polling Listener

HTTP polling C2 with beacon profiles, daisy-chain hops, cover-traffic decoys, and implant identity verification. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import json import random import threading import time from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer from...

GCP Compute Firewalls

Enumerate Compute Engine firewall rules in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute Firewalls", "description": "Enumerate Compute Engine...

GCP Enabled Services

Enumerate enabled Google Cloud API services in the current project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Enabled Services", "description": "Enumerate enabled Google...

GCP Firebase Hosting

Enumerate Firebase Hosting sites in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firebase Hosting", "description": "Enumerate Firebase Hosting sites i...

GCP Firestore Collections

List top-level Firestore collection IDs in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Firestore Collections", "description": "List top-level Firesto...

GCP GKE Clusters

Enumerate Google Kubernetes Engine clusters in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP GKE Clusters", "description": "Enumerate Google Kubernetes...

GCP Secret Manager

Enumerate Secret Manager secrets metadata only in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Secret Manager", "description": "Enumerate Secret Manag...

GCP Service Accounts

Enumerate IAM service accounts in the current GCP project !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Service Accounts", "description": "Enumerate IAM service accounts in th...

GCP Artifact Registry Images Loot

List Artifact Registry repositories, packages, and image versions !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Artifact Registry Images Loot", "description": "List Artifact...

GCP Cloud Build History Loot

Extract Cloud Build history, substitutions, images, and secret references !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Build History Loot", "description": "Extract Clou...

GCP Cloud Function Sources Loot

Extract Cloud Functions source locations and download archives when accessible !/usr/bin/env python3 -- coding: utf-8 -- import json from urllib.parse import quote from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Cloud Function...