Windows Gather Clipboard

Read the current clipboard text from the interactive desktop session on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read the current Windows clipboard text from an interactive user session. """ from kittysploit import from lib.post.windows.session import...

RF SDR Discovery

Detect software-defined radio USB devices and optionally run a quick spectrum sweep with rtlpower when rtl-sdr tools are installed. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RTL-SDR dongles and run a quick RF power sweep when tools are available.""" from future import annotations import...

Bluetooth Classic Scanner

Discover nearby classic Bluetooth devices using hcitool or bluetoothctl inquiry scans. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby classic Bluetooth devices via inquiry scan.""" from future import annotations import re import shutil import subprocess from typing import Dict from...

Frigate NVR blind RCE (CVE-2026-25643)

Exploits CVE-2026-25643 in Frigate NVR = 0.16.3 by injecting a malicious go2rtc stream and camera entry into the configuration, triggering blind command execution during service restart authenticated or unauthenticated. !/usr/bin/env python3 -- coding: utf-8 -- import json import time import yaml...

Android WiFi Saved Networks

List saved Wi-Fi networks and security types from an Android session !/usr/bin/env python3 -- coding: utf-8 -- """List saved Wi-Fi networks on a compromised Android device.""" from future import annotations from kittysploit import from lib.protocols.adb.wifi import AdbWifi class ModulePost: info ...

Microsoft Exchange SSRF arbitrary file read (CVE-2026-45504)

CVE-2026-45504: authenticated Microsoft Exchange Server arbitrary file read via EWS reference-attachment SSRF and OWA GetAttachmentPreview. Valid domain credentials are required; a callback HTTP server reachable by the Exchange host serves a OneDrive-style XML response pointing at a local file://...

WiFi Client Enumerator

Passively enumerate wireless clients on a monitor-mode interface by observing probe requests, association frames, and data traffic. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate 802.11 wireless clients from probe, association, and data frames.""" from future import annotations from typin...

Laravel Ignition RCE detection (CVE-2021-3129)

Detects CVE-2021-3129 by probing the Laravel Ignition execute-solution endpoint, extracting the log path and Laravel version, and optionally confirming RCE with a harmless marker command via PHPGGC. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from kittysploit import from...

AD honeytoken hunt (lastLogon oracle)

Flags probable AD honeytokens/decoys via empty auth history lastLogon=0, logonCount=0 and feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Repérage de honeytokens AD via l'oracle lastLogon historique comportemental. Préférer le module SMB SAMR, port 445 : scanner/smb/honeytokenhunt C...

Windows Backup SAM and SYSTEM (VSS)

Create a VSS shadow copy and copy SAM/SYSTEM registry hives or NTDS.dit and SYSTEM on domain controllers to a remote directory, then download the files through the current session. !/usr/bin/env python3 -- coding: utf-8 -- """ Backup SAM and SYSTEM hives or NTDS.dit + SYSTEM on domain controllers...

Windows Gather Password Vault Credentials

Extract credentials stored in the Windows Credential Manager Password Vault on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re class...

Windows Gather WiFi Keys

List saved WLAN profiles and extract cleartext PSKs with 'netsh wlan show profile key=clear' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved WiFi profile keys from a Windows shell or Meterpreter session using netsh wlan, then display and save...

OpenClaw AI Agent Gateway RCE

Exploits exposed OpenClaw AI agent gateways by abusing operator WebSocket access chat.send with a stolen or supplied gateway token. Also supports CVE-2026-25253 malicious URL generation for token exfiltration chains. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Windows Backup Registry

Export selected registry hives HKCU, HKLM, HKCR, HKU, HKCC using reg.exe on a Windows shell or Meterpreter session, then download the .reg files. !/usr/bin/env python3 -- coding: utf-8 -- """ Export selected Windows registry hives with reg.exe on a shell or Meterpreter session. .reg files are...

AD honeytoken hunt (SAMR lastLogon oracle)

Enumerates AD accounts via native SAMR/NetAPI port 445 and flags probable honeytokens from empty auth history; feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Chasse aux honeytokens AD via SAMR / NetUserEnum port 445, sans LDAP ni Impacket. Collecte lastLogon et logonCount dans le...

Windows Gather Autologon and Unattend Secrets

Read Winlogon autologon values from the registry and scan Panther/Sysprep unattend XML files for cleartext passwords on a Windows session. !/usr/bin/env python3 -- coding: utf-8 -- """ Search Winlogon autologon registry values and unattend/sysprep XML files for embedded credentials on a Windows...

Windows Gather VPN Profiles

List VPN connections via Get-VpnConnection and dump rasphone.pbk phonebook files on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved VPN connection details from a Windows session. """ from kittysploit import from lib.post.windows.session import...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

Windows Take Screenshot

Capture the primary monitor desktop to a PNG file on a Windows shell or Meterpreter session, then download the image through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Capture the primary Windows desktop to a PNG on the target, then download it through the current shell or...

Android WiFi Audit

Audit Android Wi-Fi posture: radio state, current connection, saved networks, MAC randomization, proxy, and insecure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Audit Wi-Fi posture on a compromised Android device.""" from future import annotations import re from kittysploit impor...

Forensic Artifact Carver

Carves lightweight forensic indicators such as URLs, emails, IPs and hashes from local files. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os import re class ModuleAnalysis: info = "name": "Forensic Artifact Carver", "author": "KittySploit Team",...

Forensic Log Triage

Scans local logs for authentication failures, suspicious commands, IPs and error indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import gzip import json import os import re from collections import Counter class ModuleAnalysis: info = "name": "Forensic Log Triage",...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...

Forensic File Hash Inventory

Builds an offline file inventory with hashes, sizes and timestamps for evidence triage. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import hashlib import json import os from datetime import datetime, timezone class ModuleAnalysis: info = "name": "Forensic File Hash Inventory...

WiFi Probe Request Scanner

Capture 802.11 probe requests on a monitor-mode interface to reveal SSID names including hidden networks and client MAC addresses. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 probe requests to discover SSIDs and probing clients.""" from future import annotations from typing import...

WordPress The Events Calendar blind SQLi (CVE-2026-49772)

Exploits unauthenticated blind SQL injection in The Events Calendar 6.15.12–6.16.2 via ORDER BY on /wp-json/tec/v1/events. Read-only extraction users, recon, custom SELECT. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from...

WordPress OrderConvo < 14 - Unauthenticated Path Traversal

CVE-2025-10162: Admin and Client Message After Order for WooCommerce OrderConvo before version 14 does not validate file paths in the REST route /wp-json/wooconvo/v1/download-file, allowing unauthenticated attackers to read arbitrary files via path traversal in the filename parameter. !/usr/bin/e...

Frigate NVR RCE detection (CVE-2026-25643)

Detects CVE-2026-25643 by fingerprinting Frigate NVR and checking whether the reported version is = 0.16.3. Optionally confirms an unauthenticated exploit path when /api/config/raw is reachable without credentials. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

WordPress The Events Calendar CVE-2026-49772 (SQLi)

Detects CVE-2026-49772 in The Events Calendar 6.15.12–6.16.2: unauthenticated blind SQL injection via the order parameter on /wp-json/tec/v1/events. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient...

Bluetooth LE Scanner

Discover nearby BLE devices using passive/active advertisement scanning. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby Bluetooth Low Energy BLE devices.""" from future import annotations import asyncio from typing import Dict from kittysploit import class ModuleAuxiliary: info =...

OpenClaw CVE-2026-25253 token exfil URL builder

Builds malicious OpenClaw Control UI URLs that abuse gatewayUrl query parameter handling CVE-2026-25253 to exfiltrate gateway tokens to an attacker-controlled WebSocket endpoint. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.openclaw.gatewayclient import...

Forensic File Timeline

Creates a sorted filesystem timeline from MAC timestamps for local evidence triage. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os from datetime import datetime, timezone class ModuleAnalysis: info = "name": "Forensic File Timeline", "author": "KittySploit...

Laravel Ignition RCE (CVE-2021-3129)

Exploits CVE-2021-3129 in Laravel Ignition via log poisoning and PHPGGC deserialization chains to execute arbitrary system commands. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from kittysploit import from lib.exploits.laravel.ignition import buildsolutionpayload,...

Burp Crawler Accept Path Traversal Trap

Serves a malicious HTML upload form whose file input accept attribute contains path traversal into the Windows Startup folder. The trap also serves a .bat embedding a PowerShell reverse shell. When Burp Suite Scanner crawls the page, its headless Chromium may drop the .bat on the operator's machi...

OpenEMR Fax/SMS authenticated arbitrary file read

CVE-2026-24849: OpenEMR 7.0.4 exposes an authenticated arbitrary file read in the Fax/SMS EtherFax disposeDoc/disposeDocument action. Any valid OpenEMR user can read files reachable by the web-server user when the module/provider is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from...

Unix Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + PTY. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix Command Shell, P2...

Unix Command Shell, P2P Relay (via Bash)

Connect to a P2P relay hub as AGENT cleartext KSRL v1. For E2E encryption + PTY use payloads/singles/cmd/unix/pythonp2prelay. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Unix Command Shell, P2P Relay via Bash", "description": "Connect to ...

P2P Relay Listener

Operator listener for NAT-friendly C2 via KittyRelay hub v2 E2E encrypted. Start the hub with the standalone command: kittyrelay no framework. Agents use p2p relay payloads; operators use this module role=operator. !/usr/bin/env python3 -- coding: utf-8 -- """ P2P Relay Listener operator side The...

TCP Port Scanner

Scan TCP ports on one or more hosts using parallel connect probes. !/usr/bin/env python3 -- coding: utf-8 -- """Parallel TCP connect port scanner for authorized engagements.""" from future import annotations import ipaddress import socket from concurrent.futures import ThreadPoolExecutor,...

OpenEMR CVE-2026-24849 detection

Fingerprints OpenEMR and flags versions 7.0.4 affected by CVE-2026-24849 authenticated arbitrary file read in Fax/SMS EtherFax. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Enumerate PostgreSQL Privilege Escalation Paths

Find likely PostgreSQL privilege escalation paths: superuser role chain, SECURITY DEFINER functions, unsafe searchpath, and risky extensions from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate...

Check PostgreSQL Hardening

Audit common PostgreSQL security misconfigurations from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Hardening", "description": "Audit common PostgreSQL security misconfigurations",...

Dump PostgreSQL Role Password Hashes

Dump role password hashes from pgauthid/pgshadow superuser. Supports SCRAM-SHA-256 and legacy MD5 hashes for offline cracking from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Dump PostgreSQL Role...

Enumerate PostgreSQL Databases

Enumerate databases and tables/schemas in the current database from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Databases", "description": "Enumerate databases and tables/schemas...

Enumerate PostgreSQL Foreign Connections

List postgresfdw servers, user mappings, foreign tables, dblink sessions, and connection strings in function source from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Foreign...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Enumerate PostgreSQL Configuration

Dump security-relevant server settings and paths from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Configuration", "description": "Dump security-relevant server settings and paths...

Enumerate PostgreSQL Extensions

List installed extensions and versions pgcrypto, etc. from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate PostgreSQL Extensions", "description": "List installed extensions and versions pgcrypt...

Search PostgreSQL Sensitive Data

Find columns likely to hold secrets password, token, apikey, etc. and optionally dump a few sample rows from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Search PostgreSQL Sensitive Data",...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...