IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Horde javascript.php Backdoor RCE (CVE-2012-0209)

Exploits CVE-2012-0209 by passing shell commands through the href Cookie to /services/javascript.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Horde javascript.php backdoor RCE CVE-2012-0209 — execute session.""" from future import annotations import re...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

Apache Solr CVE-2023-50386 Backup/Restore RCE Detection

Detects Apache Solr 6.0.0–8.11.2 / 9.0.0–9.4.0 in SolrCloud mode with reachable ConfigSets API CVE-2023-50386 attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2023-50386 detection backup/restore ConfigSet RCE surface.""" import re from kittysploit import from...

Apache Solr CVE-2019-0193 Velocity RCE Detection

Detects CVE-2019-0193 by running a marker echo through the Velocity response writer on /core/select wt=velocity. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2019-0193 Velocity template RCE detection.""" import re from kittysploit import from lib.protocols.http.httpclient import...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

Linksys E1200 v2 - tmUnblock.cgi Command Injection (CVE-2025-60689)

Unauthenticated OS command injection in Linksys E1200 firmware = v2.0.04 via POST /tmUnblock.cgi ttcpip. Blind injection: use the default reverse payload/listener or nopayload + execute session. Admin UI is often on port 80 or 8080 depending on deployment. !/usr/bin/env python3 -- coding: utf-8 -...

IPFire Shellshock

Exploits shellshock vulnerability in IPFire = 2.15 Core Update 82. If the target is vulnerable it is possible to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Shellshock""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

routeros_jailbreak

routerosjailbreak !/usr/bin/env python3 -- coding: utf-8 -- """routerosjailbreak""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'routerosjailbreak', 'description': 'routerosjailbreak', 'author': 'KittySploit Team',...

Misfortune Cookie

Exploit implementation for Misfortune Cookie Authentication Bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Misfortune Cookie""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Misfortune...

2Wire 4011G & 5012NV Path Traversal

Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire 4011G & 5012NV Path Traversal""" import re from kittysploit import from...

TP-Link Archer C9 admin password reset (CVE-2017-11519)

Module exploits TP-Link Archer C9 password reset feature by leveraging a predictable random number generator seed. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C9 admin password reset CVE-2017-11519""" import json import re from kittysploit import from lib.protocols.http.httpclient...

DVR Creds Disclosure

Module exploits authentication bypass vulnerability in multiple DVR devices allowing attacker to retrieve users credentials. !/usr/bin/env python3 -- coding: utf-8 -- """DVR Creds Disclosure""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

Zyxel Eir D1000 WiFi Password Disclosure

Module exploits WiFi Password Disclosure vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to read WiFi password. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 WiFi Password Disclosure""" import re from kittysploit import from...

D-Link DIR-850L Creds Disclosure

Module exploits D-Link DIR-850L credentials disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-850L Creds Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSL-2730U/2750U/2750E Path Traversal

Module exploits D-Link DSL-2730U/2750U/2750E Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2730U/2750U/2750E Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

Belkin Play Max Persistent RCE

Module exploits Belkin SSID injection vuln, allowing to execute arbitrary command at every boot. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Play Max Persistent RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient:...

Asus RT-N16 Password Disclosure

Module exploits password disclosure vulnerability in Asus RT-N16 devices that allows to fetch credentials for the device. !/usr/bin/env python3 -- coding: utf-8 -- """Asus RT-N16 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco Secure ACS Unauthorized Password Change

Module exploits an authentication bypass issue which allows arbitrary password change requests to be issued for any user in the local store. Instances of Secure ACS running version 5.1 with patches 3, 4, or 5 as well as version 5.2 with either no patches or patches 1 and 2 are vulnerable...

Technicolor TC7200 Password Disclosure V2

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure V2""" import re import struct from kittysploit import from lib.protocols.http.httpclient import...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ZTE ZXHN H108N Wifi Password Disclosure

Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability that allows to retrieve password for wifi connection. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXHN H108N Wifi Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

BHU uRouter RCE

Module exploits BHU uRouter unauthenticated remote code execution vulnerability, which allows executing commands on the router with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """BHU uRouter RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DSL-2750B RCE

Module exploits remote code execution vulnerability in D-Link DSL-2750B devices. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2750B RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit,...

Linksys E-Series TheMoon RCE

Module exploits remote code execution vulnerability in multiple Linksys E-Series devices. Vulnerability was actively used by TheMoon Worm. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E-Series TheMoon RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

IPFire Proxy RCE

Module exploits IPFire 2.19 Core Update 101 Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Proxy RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DIR-815 & DIR-850L RCE

Module exploits D-Link DIR-815 and DIR-850L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-815 & DIR-850L RCE""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Netcore/Netis UDP/53413 Backdoor RCE

Exploits the Netcore/Netis UDP backdoor on port 53413 for unauthenticated remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP/53413 backdoor RCE — opens execute session.""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Agent Local Store (Python)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Python emitter.""" from typing import Any, Dict from kittysploit import from...

Daemonize Process (Zig)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Zig", "description": "Detach from the controlling terminal on Un...

Hide Process argv (Zig)

Replace process name with an innocuous value on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig import emithideargv class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process arg...

Transform Chain

Stack multiple stream transforms comma-separated module paths. !/usr/bin/env python3 -- coding: utf-8 -- """Composable transform chain — stack multiple stream transforms on one C2 channel.""" from future import annotations import importlib import re from typing import List, Optional from...

3Com AP8760 Password Disclosure

Exploits 3Com AP8760 password disclosure vulnerability.If the target is vulnerable it is possible to fetch credentials for administration user. !/usr/bin/env python3 -- coding: utf-8 -- """3Com AP8760 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Brickcom Corp Network Camera Conf Disclosure

Module exploits Brickcom Corporation Network Camera Configuration Dislosure vulnerability. If target is vulnerable it is possible to read device configuration including administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Corp Network Camera Conf Disclosure""" import ...

D-Link DCS Cameras Authentication Bypass

D-Link DCS web cameras allow unauthenticated attackers to obtain the configuration of the device remotely. A copy of the device configuration can be obtained by accessing unprocteted URL. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS Cameras Authentication Bypass""" import re from...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

D-Link DVG-N5402SP Path Traversal

Module exploits D-Link DVG-N5402SP path traversal vulnerability, which allows reading files form the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DVG-N5402SP Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco RV320 Command Injection

Module exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320 Command Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Netgear Multi Password Disclosure

Module exploits Password Disclosure vulnerability in multiple Netgear devices. If target is vulnerable administrator's password is retrieved. This exploit only works if 'password recovery' in router settings is OFF. If the exploit has already been run, then it might not work anymore until device...

Asus B1M Projector RCE

Module exploits Asus B1M Projector Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Asus B1M Projector RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

D-Link DCS-930L Auth RCE

Module exploits D-Link DCS-930L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS-930L Auth RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability through dnslookup.cgi resource. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient,...

D-Link DSP-W110 RCE

Module exploits D-Link DSP-W110 Remote Command Execution vulnerability which allows executing command on the operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSP-W110 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...