Windows Take Screenshot

Capture the primary monitor desktop to a PNG file on a Windows shell or Meterpreter session, then download the image through the session. !/usr/bin/env python3 -- coding: utf-8 -- """ Capture the primary Windows desktop to a PNG on the target, then download it through the current shell or...

OpenClaw AI Agent Gateway RCE

Exploits exposed OpenClaw AI agent gateways by abusing operator WebSocket access chat.send with a stolen or supplied gateway token. Also supports CVE-2026-25253 malicious URL generation for token exfiltration chains. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Laravel Ignition RCE (CVE-2021-3129)

Exploits CVE-2021-3129 in Laravel Ignition via log poisoning and PHPGGC deserialization chains to execute arbitrary system commands. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from kittysploit import from lib.exploits.laravel.ignition import buildsolutionpayload,...

WordPress OrderConvo < 14 - Unauthenticated Path Traversal

CVE-2025-10162: Admin and Client Message After Order for WooCommerce OrderConvo before version 14 does not validate file paths in the REST route /wp-json/wooconvo/v1/download-file, allowing unauthenticated attackers to read arbitrary files via path traversal in the filename parameter. !/usr/bin/e...

AD honeytoken hunt (SAMR lastLogon oracle)

Enumerates AD accounts via native SAMR/NetAPI port 445 and flags probable honeytokens from empty auth history; feeds Guardian. !/usr/bin/env python3 -- coding: utf-8 -- """ Chasse aux honeytokens AD via SAMR / NetUserEnum port 445, sans LDAP ni Impacket. Collecte lastLogon et logonCount dans le...

Bluetooth LE Scanner

Discover nearby BLE devices using passive/active advertisement scanning. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby Bluetooth Low Energy BLE devices.""" from future import annotations import asyncio from typing import Dict from kittysploit import class ModuleAuxiliary: info =...

Windows Gather Autologon and Unattend Secrets

Read Winlogon autologon values from the registry and scan Panther/Sysprep unattend XML files for cleartext passwords on a Windows session. !/usr/bin/env python3 -- coding: utf-8 -- """ Search Winlogon autologon registry values and unattend/sysprep XML files for embedded credentials on a Windows...

Android WiFi Saved Networks

List saved Wi-Fi networks and security types from an Android session !/usr/bin/env python3 -- coding: utf-8 -- """List saved Wi-Fi networks on a compromised Android device.""" from future import annotations from kittysploit import from lib.protocols.adb.wifi import AdbWifi class ModulePost: info ...

Forensic File Hash Inventory

Builds an offline file inventory with hashes, sizes and timestamps for evidence triage. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import hashlib import json import os from datetime import datetime, timezone class ModuleAnalysis: info = "name": "Forensic File Hash Inventory...

Test

Test payload !/usr/bin/env python3 from kittysploit import class ModulePayload: info = 'name': 'Test', 'description': 'Test payload', 'listener': 'listeners/multi/reversetcp', def generateself: return b"\x90\xcc"...

OpenClaw AI agent gateway detection

Detects exposed OpenClaw formerly Clawdbot/Moltbot AI agent gateways and flags versions likely affected by CVE-2026-25253 token exfiltration. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Laravel Ignition RCE detection (CVE-2021-3129)

Detects CVE-2021-3129 by probing the Laravel Ignition execute-solution endpoint, extracting the log path and Laravel version, and optionally confirming RCE with a harmless marker command via PHPGGC. !/usr/bin/env python3 -- coding: utf-8 -- from pathlib import Path from kittysploit import from...

Windows Gather Password Vault Credentials

Extract credentials stored in the Windows Credential Manager Password Vault on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re class...

Windows Gather VPN Profiles

List VPN connections via Get-VpnConnection and dump rasphone.pbk phonebook files on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved VPN connection details from a Windows session. """ from kittysploit import from lib.post.windows.session import...

Windows Gather PowerShell History

Read PSReadLine command history files Windows PowerShell and PowerShell Core from a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read PSReadLine ConsoleHosthistory.txt from a Windows session. Works from cmd.exe by typing the history files directly. PowerShel...

Windows Backup Registry

Export selected registry hives HKCU, HKLM, HKCR, HKU, HKCC using reg.exe on a Windows shell or Meterpreter session, then download the .reg files. !/usr/bin/env python3 -- coding: utf-8 -- """ Export selected Windows registry hives with reg.exe on a shell or Meterpreter session. .reg files are...

Windows Gather Clipboard

Read the current clipboard text from the interactive desktop session on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Read the current Windows clipboard text from an interactive user session. """ from kittysploit import from lib.post.windows.session import...

Windows Gather RDP Files

Find and parse saved Remote Desktop .rdp files in common user locations on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate and parse saved .rdp client files on a Windows session. """ from kittysploit import from lib.post.windows.session import...

WiFi Handshake Capture

Passively capture WPA/WPA2 EAPOL key exchanges on a monitor-mode interface and save matching frames to a PCAP file for offline cracking. !/usr/bin/env python3 -- coding: utf-8 -- """Passively capture WPA/WPA2 EAPOL handshakes on a monitor-mode interface.""" from future import annotations import o...

WiFi Probe Request Scanner

Capture 802.11 probe requests on a monitor-mode interface to reveal SSID names including hidden networks and client MAC addresses. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 probe requests to discover SSIDs and probing clients.""" from future import annotations from typing import...

WordPress The Events Calendar CVE-2026-49772 (SQLi)

Detects CVE-2026-49772 in The Events Calendar 6.15.12–6.16.2: unauthenticated blind SQL injection via the order parameter on /wp-json/tec/v1/events. !/usr/bin/env python3 -- coding: utf-8 -- import time from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient...

Android WiFi Audit

Audit Android Wi-Fi posture: radio state, current connection, saved networks, MAC randomization, proxy, and insecure configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Audit Wi-Fi posture on a compromised Android device.""" from future import annotations import re from kittysploit impor...

Forensic File Timeline

Creates a sorted filesystem timeline from MAC timestamps for local evidence triage. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os from datetime import datetime, timezone class ModuleAnalysis: info = "name": "Forensic File Timeline", "author": "KittySploit...

OpenClaw CVE-2026-25253 token exfil URL builder

Builds malicious OpenClaw Control UI URLs that abuse gatewayUrl query parameter handling CVE-2026-25253 to exfiltrate gateway tokens to an attacker-controlled WebSocket endpoint. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.openclaw.gatewayclient import...

Forensic Artifact Carver

Carves lightweight forensic indicators such as URLs, emails, IPs and hashes from local files. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os import re class ModuleAnalysis: info = "name": "Forensic Artifact Carver", "author": "KittySploit Team",...

Windows Gather WiFi Keys

List saved WLAN profiles and extract cleartext PSKs with 'netsh wlan show profile key=clear' on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved WiFi profile keys from a Windows shell or Meterpreter session using netsh wlan, then display and save...

Forensic Log Triage

Scans local logs for authentication failures, suspicious commands, IPs and error indicators. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import gzip import json import os import re from collections import Counter class ModuleAnalysis: info = "name": "Forensic Log Triage",...

Windows Gather PuTTY WinSCP FileZilla Sessions

Collect saved PuTTY registry sessions, WinSCP registry sessions, and FileZilla XML site entries on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract saved PuTTY, WinSCP, and FileZilla session data from a Windows session. """ from kittysploit import from...

WiFi Beacon Scanner

Capture 802.11 beacon frames on a monitor-mode interface and list visible wireless networks SSID and BSSID. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 beacon frames on a monitor-mode interface.""" from future import annotations from typing import Dict from kittysploit import class...

RF SDR Discovery

Detect software-defined radio USB devices and optionally run a quick spectrum sweep with rtlpower when rtl-sdr tools are installed. !/usr/bin/env python3 -- coding: utf-8 -- """Detect RTL-SDR dongles and run a quick RF power sweep when tools are available.""" from future import annotations import...

Frigate NVR RCE detection (CVE-2026-25643)

Detects CVE-2026-25643 by fingerprinting Frigate NVR and checking whether the reported version is = 0.16.3. Optionally confirms an unauthenticated exploit path when /api/config/raw is reachable without credentials. !/usr/bin/env python3 -- coding: utf-8 -- import json from kittysploit import from...

Bluetooth Classic Scanner

Discover nearby classic Bluetooth devices using hcitool or bluetoothctl inquiry scans. !/usr/bin/env python3 -- coding: utf-8 -- """Discover nearby classic Bluetooth devices via inquiry scan.""" from future import annotations import re import shutil import subprocess from typing import Dict from...

Microsoft Exchange SSRF arbitrary file read (CVE-2026-45504)

CVE-2026-45504: authenticated Microsoft Exchange Server arbitrary file read via EWS reference-attachment SSRF and OWA GetAttachmentPreview. Valid domain credentials are required; a callback HTTP server reachable by the Exchange host serves a OneDrive-style XML response pointing at a local file://...

Windows Backup SAM and SYSTEM (VSS)

Create a VSS shadow copy and copy SAM/SYSTEM registry hives or NTDS.dit and SYSTEM on domain controllers to a remote directory, then download the files through the current session. !/usr/bin/env python3 -- coding: utf-8 -- """ Backup SAM and SYSTEM hives or NTDS.dit + SYSTEM on domain controllers...

WiFi Client Enumerator

Passively enumerate wireless clients on a monitor-mode interface by observing probe requests, association frames, and data traffic. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate 802.11 wireless clients from probe, association, and data frames.""" from future import annotations from typin...

Unix Command Shell, P2P Relay (via Python)

P2P relay agent KSRL v2 E2E + Ed25519 identity + PTY. Requires cryptography on target. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.relay.payloadstub import buildrelayptyagentscript class ModulePayload: CLIENTLANGUAGE = "python" info = "name": "Unix Command Shell, P2...

OpenEMR Fax/SMS authenticated arbitrary file read

CVE-2026-24849: OpenEMR 7.0.4 exposes an authenticated arbitrary file read in the Fax/SMS EtherFax disposeDoc/disposeDocument action. Any valid OpenEMR user can read files reachable by the web-server user when the module/provider is enabled. !/usr/bin/env python3 -- coding: utf-8 -- from...

OpenEMR CVE-2026-24849 detection

Fingerprints OpenEMR and flags versions 7.0.4 affected by CVE-2026-24849 authenticated arbitrary file read in Fax/SMS EtherFax. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TCP Port Scanner

Scan TCP ports on one or more hosts using parallel connect probes. !/usr/bin/env python3 -- coding: utf-8 -- """Parallel TCP connect port scanner for authorized engagements.""" from future import annotations import ipaddress import socket from concurrent.futures import ThreadPoolExecutor,...

Unix Command Shell, P2P Relay (via Bash)

Connect to a P2P relay hub as AGENT cleartext KSRL v1. For E2E encryption + PTY use payloads/singles/cmd/unix/pythonp2prelay. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModulePayload: info = "name": "Unix Command Shell, P2P Relay via Bash", "description": "Connect to ...

P2P Relay Listener

Operator listener for NAT-friendly C2 via KittyRelay hub v2 E2E encrypted. Start the hub with the standalone command: kittyrelay no framework. Agents use p2p relay payloads; operators use this module role=operator. !/usr/bin/env python3 -- coding: utf-8 -- """ P2P Relay Listener operator side The...

Burp Crawler Accept Path Traversal Trap

Serves a malicious HTML upload form whose file input accept attribute contains path traversal into the Windows Startup folder. The trap also serves a .bat embedding a PowerShell reverse shell. When Burp Suite Scanner crawls the page, its headless Chromium may drop the .bat on the operator's machi...

PostgreSQL Read Server File

Read a server file via pgreadfile requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Read Server File", "description": "Read a server file via pgreadfile requires...

Search PostgreSQL Sensitive Data

Find columns likely to hold secrets password, token, apikey, etc. and optionally dump a few sample rows from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Search PostgreSQL Sensitive Data",...

PostgreSQL Write Server File

Write a file on the server via COPY TO requires superuser from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL Write Server File", "description": "Write a file on the server via COPY TO requir...

Check PostgreSQL Hardening

Audit common PostgreSQL security misconfigurations from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Hardening", "description": "Audit common PostgreSQL security misconfigurations",...

Enumerate PostgreSQL Privilege Escalation Paths

Find likely PostgreSQL privilege escalation paths: superuser role chain, SECURITY DEFINER functions, unsafe searchpath, and risky extensions from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Enumerate...

PostgreSQL COPY FROM PROGRAM

Execute an OS command via COPY FROM PROGRAM superuser required from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "PostgreSQL COPY FROM PROGRAM", "description": "Execute an OS command via COPY FROM...

PostgreSQL pgcrypto Heap Overflow (CVE-2026-2005)

Multi-stage exploit against CVE-2026-2005 pgcrypto PGP session key heap overflow. Leaks heap pointers, performs arbitrary read/write, resolves PIE via local postgres ELF symbols, overwrites CurrentUserId, then runs COPY FROM PROGRAM. from kittysploit import from...

Dump PostgreSQL Role Password Hashes

Dump role password hashes from pgauthid/pgshadow superuser. Supports SCRAM-SHA-256 and legacy MD5 hashes for offline cracking from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Dump PostgreSQL Role...