MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

NUUO NVRmini 2 - File Upload Detection (CVE-2018-11523)

Detects CVE-2018-11523 by uploading a PHP phpinfo payload to /upload.php and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated PHP upload CVE-2018-11523.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TerraMaster TOS - makecvs.php Command Injection (CVE-2020-28187)

Exploits CVE-2020-28187 by writing a temporary PHP webshell via /include/makecvs.php?Event= and executing OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS makecvs.php Event RCE CVE-2020-28187 — opens execute session.""" import re impo...

TCExam - Unauthenticated File Upload RCE (CVE-2010-2153)

Exploits CVE-2010-2153 by uploading a PHP shell via tcefunctionstcecodeeditor.php into /cache/. !/usr/bin/env python3 -- coding: utf-8 -- """TCExam unauthenticated upload RCE CVE-2010-2153.""" import re from random import randint from kittysploit import from lib.protocols.http.httpclient import...

Lucee - imgProcess.cfm Unauth Access Detection (CVE-2021-21307)

Detects CVE-2021-21307 by writing a unique CFML marker via /lucee/admin/imgProcess.cfm?file=.cfm and confirming it on GET. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee admin imgProcess.cfm unauthenticated access CVE-2021-21307.""" from kittysploit import from lib.protocols.http.httpclient...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

Unraid OS - Web UI Auth Bypass Detection (CVE-2020-5849)

Detects CVE-2020-5849 by requesting /webGui/images/green-on.png/Settings and looking for authenticated Settings panel markers without login. !/usr/bin/env python3 -- coding: utf-8 -- """Unraid OS 6.8.0 Web UI authentication bypass CVE-2020-5849.""" from kittysploit import from...

QNAP QTS/QuTS - Uninitialized quick.cgi Detection (CVE-2023-47218)

Detects an uninitialized QNAP NAS exposing /cgi-bin/quick/quick.cgi CVE-2023-47218 command injection surface. Looks for HTTP 200 with firmwareinfo or a failure/801 response to a random func parameter. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS/QuTS hero uninitialized quick.cgi...

D-Link DWR - /uir Path Traversal Detection (CVE-2017-6190)

Detects CVE-2017-6190 by requesting /uir/../../../../../../etc/passwd ../ traversal after /uir/, distinct from CVE-2018-10822 // style. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR /uir path traversal CVE-2017-6190.""" import re from kittysploit import from lib.protocols.http.httpclien...

ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)

Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

Rails - XML YAML Deserialization Detection (CVE-2013-0156)

Detects CVE-2013-0156 by POSTing XML probes string vs yaml Time vs null-byte object to /posts/search and comparing status codes. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization probe CVE-2013-0156.""" from kittysploit import from lib.protocols.http.httpclient...

Kyocera Printer - Address Book Disclosure Detection (CVE-2022-1026)

Kyocera printers exposing gSOAP allow unauthenticated SOAP calls to /ws/km-wsdl/setting/addressbook to export the personal address book CVE-2022-1026. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer address book disclosure via gSOAP CVE-2022-1026.""" import re import time from...

D-Link - User-Agent Backdoor Detection (CVE-2013-6026)

Detects CVE-2013-6026 by comparing unauthorized responses with and without User-Agent xmlsetroodkcableoj28840ybtide on thttpd-alphanetworks. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link string-reversed User-Agent backdoor CVE-2013-6026.""" from kittysploit import from...

MikroTik Winbox - user.dat Disclosure Detection (CVE-2018-14847)

Detects CVE-2018-14847 by requesting flash/rw/store/user.dat via Winbox TCP 8291 and decrypting leaked credentials when present. !/usr/bin/env python3 -- coding: utf-8 -- """MikroTik Winbox user.dat information disclosure CVE-2018-14847.""" import hashlib import socket from kittysploit import fro...

GoAhead - ../.x/ Path Traversal Detection (CVE-2014-9707)

Detects CVE-2014-9707 by requesting /../../../.x/.x/.x/.x/.x/.x/etc/passwd style paths on Embedthis GoAhead. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead ../.x/ path traversal CVE-2014-9707.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

OpenMRS - REST concept XStream RCE Fingerprint (CVE-2018-19276)

Soft-detects CVE-2018-19276 by POSTing empty body with Content-Type: text/xml to /ws/rest/v1/concept and looking for XStream / unmarshal related errors full RCE check needs outbound ICMP. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS REST concept endpoint XStream RCE fingerprint...

Apache Tapestry - AppModule.class Disclosure Detection (CVE-2021-27850)

Detects CVE-2021-27850 by requesting /assets/app/something/services/AppModule.class/, following the redirect, and checking for application/java content containing InnerClasses. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tapestry AppModule.class asset disclosure CVE-2021-27850.""" from...

w-CMS - userFunctions.php RCE Detection

Detects w-CMS 2.0.1 RCE by writing phpinfo via userFunctions.php and fetching /public/. !/usr/bin/env python3 -- coding: utf-8 -- """w-CMS userFunctions.php arbitrary PHP write RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

vtiger CRM - graph.php OrganizationConfig Auth Bypass Detection

Detects vtiger = 5.2.1 auth bypass by requesting graph.php?module=Settings&action=OrganizationConfig and matching Company Details. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vtiger = 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Monit - Default Credentials Detection

Tries admin:monit against Monit Basic auth WWW-Authenticate realm=monit and looks for Monit: in a 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Monit default credentials admin:monit.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TWiki - debugenableplugins RCE Detection (CVE-2014-7236)

Detects CVE-2014-7236 by injecting Perl systemid via debugenableplugins on /view/Main/WebHome. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins RCE CVE-2014-7236.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

PROMOTIC SCADA - Directory Traversal Detection (CVE-2011-4518)

Detects CVE-2011-4518 via /webdir/../../../../../../../../windows/win.ini. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4518 via /webdir/.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

tcPbX - tcpbx_lang LFI Detection

Detects tcPbX LFI via Cookie tcpbxlang=../../../../etc/passwd%00 on /tcpbx/. !/usr/bin/env python3 -- coding: utf-8 -- """tcPbX tcpbxlang cookie local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

MySQL/MariaDB - Auth Bypass Detection (CVE-2012-2122)

Detects CVE-2012-2122 by repeatedly attempting root login with a wrong password until memcmp returns success or max attempts. !/usr/bin/env python3 -- coding: utf-8 -- """MySQL/MariaDB memcmp authentication bypass CVE-2012-2122.""" import socket import struct from kittysploit import from...

NUUO NVRmini 2 - Unauth handle_import_user Detection (CVE-2022-23227)

NUUO NVRmini 2 devices expose /handleimportuser.php without authentication CVE-2022-23227 / related CVE-2011-5325 upload surface. Detection matches the Greenbone active check response fingerprint. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated handleimportuser.php...

rConfig - ajaxServerSettingsChk.php RCE (CVE-2019-16662)

Exploits CVE-2019-16662 by injecting OS commands into rootUname of /install/lib/ajaxHandlers/ajaxServerSettingsChk.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig ajaxServerSettingsChk.php unauthenticated RCE CVE-2019-16662 — opens execute session."...

OpenEMR - ignoreAuth Auth Bypass Detection (CVE-2015-4453)

Detects CVE-2015-4453 by requesting /interface/billing/sleobsearch.php?ignoreAuth=1. !/usr/bin/env python3 -- coding: utf-8 -- """OpenEMR ignoreAuth authentication bypass CVE-2015-4453.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

OpenMRS - dataexchange export.form Disclosure Detection (CVE-2020-5732)

Detects OpenMRS unauthenticated data export by POSTing conceptIds=1 to /module/dataexchange/export.form and looking for HTTP 201 with conceptdatatypeid. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS dataexchange export.form unauthenticated access CVE-2020-5732...""" from kittysploit import...

Elasticsearch - Groovy Script RCE (CVE-2015-1427)

Exploits CVE-2015-1427 Groovy scriptfields RCE on Elasticsearch /search. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Elasticsearch Groovy RCE CVE-2015-1427 — opens execute session.""" import json import re from kittysploit import from...

D-Link DSL - login.cgi CLI RCE Detection (CVE-2016-20017)

Detects CVE-2016-20017 by injecting cat /etc/passwd into login.cgi?cli= and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL login.cgi CLI command injection CVE-2016-20017.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

OpenSMTPD - Unauthenticated RCE via MAIL FROM (CVE-2020-7247)

Exploits OpenSMTPD CVE-2020-7247 Qualys by injecting a shell via a crafted MAIL FROM address, then delivering a reverse CMD payload in the message DATA. Waits for a reverse shell session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD unauthenticated RCE via MAIL FROM injection...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

Beward IP Camera - fileread Disclosure Detection

Detects unauthenticated file disclosure via /cgi-bin/operator/fileread?READ.filePath=/etc/passwd on Beward IP cameras. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera fileread arbitrary file disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

TYPO3 - download.php localconf.php Disclosure Detection

Detects TYPO3 fileadmin/download.php LFI reading typo3conf/localconf.php TYPO3CONFVARS / typodbpassword. !/usr/bin/env python3 -- coding: utf-8 -- """Detects TYPO3 fileadmin/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TerraMaster TOS - exportUser.php Command Injection (CVE-2020-15568)

Exploits CVE-2020-15568 by injecting OS commands via /include/exportUser.php func=exec and reading redirected stdout from /include/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS exportUser.php exec RCE CVE-2020-15568 — opens execute...

Icinga Web 2 - static/img Path Traversal Detection (CVE-2020-24368)

Detects CVE-2020-24368 by reading /etc/passwd via /static/img?modulename=&file=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Icinga Web 2 static/img module path traversal CVE-2020-24368.""" import re from kittysploit import from lib.protocols.http.httpclient import...

AVM FRITZ!Box - juis_boxinfo.xml Information Disclosure (CVE-2024-54767)

AVM FRITZ!Box devices may expose //juisboxinfo.xml without authentication, disclosing BoxInfo and UpdateConfig metadata CVE-2024-54767. !/usr/bin/env python3 -- coding: utf-8 -- """AVM FRITZ!Box unauthenticated juisboxinfo.xml disclosure CVE-2024-54767.""" from kittysploit import from...

Seagate Personal Cloud - getPhotoPlaylistPhotos LFI (CVE-2017-18263)

Detects CVE-2017-18263 by requesting /getPhotoPlaylistPhotos.psp?url=/etc/passwd and checking for passwd contents. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud Media Server path traversal CVE-2017-18263.""" import re from kittysploit import from lib.protocols.http.httpclien...

osCommerce - file_manager.php Arbitrary Upload Detection (CVE-2009-20006)

Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.php/login.php?action=save. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-20006 by uploading a marker PHP via admin/filemanager.""" import re from kittysploit import from lib.protocols.http.httpclient import...

ColdFusion - RDS Auth Bypass Detection (CVE-2013-0632)

Detects CVE-2013-0632 by POSTing adminpassword=&rdsPasswordAllowed=1 to administrator.cfc?method=login and accessing the admin homepage. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

RomPager - Misfortune Cookie Detection (CVE-2014-9222)

Detects CVE-2014-9222 by sending Cookie C107373883=/ to /tr069 and matching the token plus RomPager not-found marker. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie CVE-2014-9222.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

NETGEAR DGN - setup.cgi syscmd Detection (CVE-2024-12847)

Detects unauthenticated setup.cgi?todo=syscmd command injection by reading /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 / 2013 disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GitLab - ExifTool RCE Unpatched Fingerprint (CVE-2021-22205)

Detects unpatched GitLab instances vulnerable to CVE-2021-22205 by POSTing a multipart JPEG upload to a random path and looking for HTTP 422 with "The change you requested was rejected" Greenbone active check. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab CE/EE ExifTool RCE unpatched...

Miele PST10 - Directory Traversal Detection (CVE-2017-7240)

Detects CVE-2017-7240 on Miele PST10 WebServer by requesting /../../../../../../../../etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 PST10 directory traversal CVE-2017-7240.""" import re from kittysploit import from lib.protocols.http.httpclient import...

vBSEO - proc_deutf RCE Detection (CVE-2012-5223)

Detects CVE-2012-5223 by POSTing charrepl eval payload to /vbseocp.php with Code: base64passthru"id". !/usr/bin/env python3 -- coding: utf-8 -- """vBSEO procdeutf eval RCE CVE-2012-5223.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR - __show_info.php File Disclosure Detection (CVE-2017-12943)

Detects CVE-2017-12943 by requesting /model/showinfo.php?REQUIREFILE=/var/etc/httpasswd. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR showinfo.php file disclosure CVE-2017-12943.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Express.js - Debug Mode Stack Trace Disclosure

Detects Express apps running with NODEENV=development or similar debug error handlers by sending a GET with Content-Type: application/json and a non-JSON body, then looking for a 400 response that leaks a SyntaxError stack / nodemodules path. !/usr/bin/env python3 -- coding: utf-8 -- """Express.j...

securitydbData.xml - Credential Disclosure Detection

Detects exposed /conf/securitydbData.xml containing AUTHORIZATION-DATA passwords. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vendors conf/securitydbData.xml credential disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Apache Guacamole - Default Credentials Detection

Tries guacadmin:guacadmin against /api/tokens and looks for authToken in a JSON 200 response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Guacamole default credentials guacadmin/guacadmin.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...