Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

Linksys E1200 v2 - tmUnblock.cgi Command Injection (CVE-2025-60689)

Unauthenticated OS command injection in Linksys E1200 firmware = v2.0.04 via POST /tmUnblock.cgi ttcpip. Blind injection: use the default reverse payload/listener or nopayload + execute session. Admin UI is often on port 80 or 8080 depending on deployment. !/usr/bin/env python3 -- coding: utf-8 -...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

2Wire 4011G & 5012NV Path Traversal

Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire 4011G & 5012NV Path Traversal""" import re from kittysploit import from...

D-Link DSP-W110 RCE

Module exploits D-Link DSP-W110 Remote Command Execution vulnerability which allows executing command on the operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSP-W110 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

Netgear Multi Password Disclosure

Module exploits Password Disclosure vulnerability in multiple Netgear devices. If target is vulnerable administrator's password is retrieved. This exploit only works if 'password recovery' in router settings is OFF. If the exploit has already been run, then it might not work anymore until device...

IPFire Shellshock

Exploits shellshock vulnerability in IPFire = 2.15 Core Update 82. If the target is vulnerable it is possible to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Shellshock""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

DVR Creds Disclosure

Module exploits authentication bypass vulnerability in multiple DVR devices allowing attacker to retrieve users credentials. !/usr/bin/env python3 -- coding: utf-8 -- """DVR Creds Disclosure""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Zyxel Eir D1000 WiFi Password Disclosure

Module exploits WiFi Password Disclosure vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to read WiFi password. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 WiFi Password Disclosure""" import re from kittysploit import from...

D-Link DIR-850L Creds Disclosure

Module exploits D-Link DIR-850L credentials disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-850L Creds Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSL-2730U/2750U/2750E Path Traversal

Module exploits D-Link DSL-2730U/2750U/2750E Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2730U/2750U/2750E Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

routeros_jailbreak

routerosjailbreak !/usr/bin/env python3 -- coding: utf-8 -- """routerosjailbreak""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'routerosjailbreak', 'description': 'routerosjailbreak', 'author': 'KittySploit Team',...

Technicolor TC7200 Password Disclosure V2

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure V2""" import re import struct from kittysploit import from lib.protocols.http.httpclient import...

ZTE ZXHN H108N Wifi Password Disclosure

Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability that allows to retrieve password for wifi connection. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXHN H108N Wifi Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Linksys E-Series TheMoon RCE

Module exploits remote code execution vulnerability in multiple Linksys E-Series devices. Vulnerability was actively used by TheMoon Worm. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E-Series TheMoon RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

IPFire Oinkcode RCE

Module exploits IPFire 2.19 Core Update 110 Remote Code Execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Oinkcode RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

IPFire Proxy RCE

Module exploits IPFire 2.19 Core Update 101 Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Proxy RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Netgear RAX30 RCE

Module exploits remote command execution in Netgear RAX30 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear RAX30 RCE""" from kittysploit import from...

Cisco UCS Manager RCE

Module exploits Cisco UCS Manager 2.1 1b Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCS Manager RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Agent Local Store (Python)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Python emitter.""" from typing import Any, Dict from kittysploit import from...

Extract Embedded ZIP (Zig)

Native in-memory ZIP extraction before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback Zig emitter.""" from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig import emitextractzip class...

TP-Link Archer C9 admin password reset (CVE-2017-11519)

Module exploits TP-Link Archer C9 password reset feature by leveraging a predictable random number generator seed. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C9 admin password reset CVE-2017-11519""" import json import re from kittysploit import from lib.protocols.http.httpclient...

D-Link DCS Cameras Authentication Bypass

D-Link DCS web cameras allow unauthenticated attackers to obtain the configuration of the device remotely. A copy of the device configuration can be obtained by accessing unprocteted URL. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS Cameras Authentication Bypass""" import re from...

D-Link DVG-N5402SP Path Traversal

Module exploits D-Link DVG-N5402SP path traversal vulnerability, which allows reading files form the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DVG-N5402SP Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Misfortune Cookie

Exploit implementation for Misfortune Cookie Authentication Bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Misfortune Cookie""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Misfortune...

Cisco Secure ACS Unauthorized Password Change

Module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

LG_NAS_3718.510.a0_RCE

Module exploits LG-NAS Storage Remote Command Execution vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """LGNAS3718.510.a0RCE""" import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handl...

Linksys WAP54Gv3

Module exploits remote command execution in Linksys WAP54Gv3 devices. Debug interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WAP54Gv3""" import re from kittysploit import from...

Transform Chain

Stack multiple stream transforms comma-separated module paths. !/usr/bin/env python3 -- coding: utf-8 -- """Composable transform chain — stack multiple stream transforms on one C2 channel.""" from future import annotations import importlib import re from typing import List, Optional from...

3Com AP8760 Password Disclosure

Exploits 3Com AP8760 password disclosure vulnerability.If the target is vulnerable it is possible to fetch credentials for administration user. !/usr/bin/env python3 -- coding: utf-8 -- """3Com AP8760 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Brickcom Corp Network Camera Conf Disclosure

Module exploits Brickcom Corporation Network Camera Configuration Dislosure vulnerability. If target is vulnerable it is possible to read device configuration including administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Corp Network Camera Conf Disclosure""" import ...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

Huawei HG520 Information Disclosure

Module exploits Huawei EchoLife HG520 information disclosure vulnerablity. If the target is vulnerable it is possible to retrieve sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG520 Information Disclosure""" import re from kittysploit import from...

Asus RT-N16 Password Disclosure

Module exploits password disclosure vulnerability in Asus RT-N16 devices that allows to fetch credentials for the device. !/usr/bin/env python3 -- coding: utf-8 -- """Asus RT-N16 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BHU uRouter RCE

Module exploits BHU uRouter unauthenticated remote code execution vulnerability, which allows executing commands on the router with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """BHU uRouter RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DSL-2750B RCE

Module exploits remote code execution vulnerability in D-Link DSL-2750B devices. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2750B RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit,...

D-Link DIR-815 & DIR-850L RCE

Module exploits D-Link DIR-815 and DIR-850L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-815 & DIR-850L RCE""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Agent Local Store (PowerShell)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from...

Daemonize Process (Zig)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Zig", "description": "Detach from the controlling terminal on Un...