F5 BIG-IP SSH Private Key Exposure

F5 ships a public/private key pair on BIG-IP appliances that allows passwordless authentication to any other BIG-IP box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name': 'F5...

Quantum DXi V1000 SSH Private Key Exposure

Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that allows passwordless authentication to any other DXi box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info =...

Quantum vmPRO Backdoor Command

Any user, even one without admin privileges, can get access to the restricted SSH shell from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name': 'Quantum vmPRO Backdoor Command',...

Debian Package Creator

Debian Package Creator from kittysploit import import os import shutil from pathlib import Path from lib.compile.debevasionhelpers import createararchive, createcontroltar, createdatatar, class ModuleBackdoor: info = 'name': 'Debian Package Creator', 'description': 'Debian Package Creator',...

List running processes

List running processes from kittysploit import class ModulePost: info = "name": "List running processes", "description": "List running processes", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired': True,...

Windows http.sys Driver DoS

Windows http.sys double free causing DoS. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Windows http.sys Driver DoS", "description": "Windows http.sys double free causing DoS.", "author": "KittySploit Team", "cve":...

Allegro Software RomPager "Misfortune Cookie"

This module exploits HTTP servers that appear to be vulnerable to the'Misfortune Cookie' vulnerability which affects Allegro SoftwareRompager versions before 4.34 and can allow attackers to authenticateto the HTTP service as an administrator without providing validcredentials. from kittysploit...

D-Link DIR-615 CSRF

D-Link DIR-615 router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-615 CSRF", "description": "D-Link DIR-615 router - Change wireless password via CSRF POST", "author":...

FTP Upload Web Shell

Uploads a web shell file to the FTP server for persistent web-based access !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import tempfile import time class ModulePost, FTPClientMixin: """FTP Web Shell Upload...

Web Download File

Download a file from a web server from kittysploit import class ModulePost: info = "name": "Web Download File", "description": "Download a file from a web server", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

Linux x64 Reverse TCP Stager

Linux x64 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Linux x64 Reverse TCP Stager', 'description': 'Linux x64 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.LINUX, 'listener':...

D-Link DIR-605 CSRF

D-Link DIR-605 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-605 CSRF", "description": "D-Link DIR-605 router - Change admin password via CSRF POST", "author": "KittySplo...

Generic HTTP Client Listener

Ultra-simple HTTP client listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP Client Listener - Ultra-simple implementation following generic pattern Author: KittySploit Team Version: 1.0.0 """ from kittysploit import import requests class...

Python Reverse ICMP Shell

Covert reverse shell over ICMP Echo packets requires scapy + root/CAPNETRAW !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import ICMPAGENTTEMPLATE = r'''import subprocess import os import sys import time import queue import platform try: from scapy.all import IP, ICMP, sniff, send, R...

Zig Meterpreter Linux, Reverse TCP (compat)

Linux Meterpreter payload in Zig compatibility path; requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility module for the Linux Zig Meterpreter reverse TCP payload. Prefer payloads/singles/cmd/unix/zigmeterpreterlinuxreversetcp. """ from kittysploit import from...

Create ssh server

Create a ssh server and listen for connections from kittysploit import import paramiko import threading import socket from io import StringIO class ModuleListener: info = "name": "Create ssh server", "description": "Create a ssh server and listen for connections", "handler": Handler.REVERSE,...

Adive Framework 2.0.7

Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users editor or developer to create an administrator account via admin/user/add from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.httplogin import Httplogin class...

Ceragon FibeAir IP-10 SSH Private Key Exposure

Ceragon FibeAir IP-10 have a default SSH public key in the authorizedkeys file for the mateidu user, which allows remote attackers to obtain SSH acces by leveraging knowledge of the private key. from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler...

Sickbeard 0.1 csrf

Sickbeard 0.1 csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "Sickbeard 0.1 csrf", "description": "Sickbeard 0.1 csrf", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, target =...

D-Link DCS-900 CSRF

D-Link DCS-900 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-900 CSRF", "description": "D-Link DCS-900 camera - Change root password via CSRF POST", "author": "KittySploit...

Generic SSH Client Listener

Ultra-simple SSH client listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import paramiko class ModuleListener: info = 'name': 'Generic SSH Client Listener', 'description': 'Ultra-simple SSH client listener - framework handles sessio...

D-Link DI-524 CSRF (password change)

D-Link DI-524 Wireless 150 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DI-524 CSRF password change", "description": "D-Link DI-524 Wireless 150 router - Change admin passwo...

Enumerate AWS Secrets

Enumerate secrets from AWS Secrets Manager and Systems Manager Parameter Store !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Secrets Manager Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates secrets from AWS Secrets Manager and Parameter Store. """ from...

Windows x86 Reverse TCP Stager

Windows x86 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Windows x86 Reverse TCP Stager', 'description': 'Windows x86 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.WINDOWS, 'listener...

Unix Command Shell, Reverse TCP (via Python)

Connect back and create a command shell via Python Linux/Unix only; use singles/cmd/windows/pythonreversetcp on Windows from kittysploit import from lib.shell.ptyruntime import buildunixptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Reverse TCP via...

Enumerate AWS EC2

Enumerate EC2 instances, security groups, and related resources !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates EC2 instances, security groups, and related resources. """ from kittysploit import import json fr...

Simple Workflow

Workflow basic demonstration of base features !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleWorkflow: info = 'name': 'Simple Workflow', 'description': 'Workflow basic demonstration of base features', 'author': 'KittySploit Team', Options target = OptString"", "Targ...

reverse aws sqs command

AWS SQS command executor listener - execute commands via SQS without interactive shell !/usr/bin/env python3 -- coding: utf-8 -- """ AWS SQS Command Executor Listener Author: KittySploit Team Version: 1.0.0 This listener uses AWS SQS to execute commands remotely without an interactive shell. It's...

Generic Bind TCP Listener

Ultra-simple bind TCP listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket class ModuleListener: info = 'name': 'Generic Bind TCP Listener', 'description': 'Ultra-simple bind TCP listener - framework handles session...

Web Cookie Listener

Web Cookie Listener from kittysploit import from lib.protocols.http.httpclient import Httpclient from base64 import b64encode class ModuleListener, Httpclient: info = 'name': 'Web Cookie Listener', 'description': 'Web Cookie Listener', 'author': 'KittySploit Team', 'arch': Arch.PHP, 'handler':...

Check MySQL User Privileges

Check current MySQL user privileges and capabilities from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Check MySQL User Privileges", "description": "Check current MySQL user privileges and capabilities", "author":...

Reverse UDP Listener

UDP reverse shell listener one session at a time. Waits for KSUDPHELLO, then exchanges line commands with chunked responses. !/usr/bin/env python3 -- coding: utf-8 -- """Reverse UDP listener with a socket-like wrapper for ClassicShell.""" from future import annotations import socket import...

Bind TCP shell

Bind TCP shell in PHP using a bind handler from kittysploit import from lib.exploit.handler import Bind class ModulePost, Bind: info = "name": "Bind TCP shell", "description": "Bind TCP shell in PHP using a bind handler", "author": "KittySploit Team", "arch": Arch.PHP, 'agent': 'risk': 'intrusive...

Reverse TCP shell

Reverse TCP shell in PHP using a reverse handler from kittysploit import from lib.exploit.handler import Reverse class ModulePost, Reverse: info = "name": "Reverse TCP shell", "description": "Reverse TCP shell in PHP using a reverse handler", "author": "KittySploit Team", "arch": Arch.PHP, 'agent...

Enumerate MySQL Databases

Enumerate all databases, tables, and columns in MySQL from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "Enumerate MySQL Databases", "description": "Enumerate all databases, tables, and columns in MySQL", "author":...

Show PHP config

Show PHP config from kittysploit import class ModulePost: info = "name": "Show PHP config", "description": "Show PHP config", "author": "KittySploit Team", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False,...

MySQL Trigger Backdoor

Create a malicious MySQL trigger that executes commands - requires TRIGGER privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Trigger Backdoor", "description": "Create a malicious MySQL trigger that execut...

MySQL UDF Command Execution

Execute system commands via MySQL UDF User Defined Functions - requires FILE privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient import platform class ModulePost, MySQLClient: info = "name": "MySQL UDF Command Execution", "description": "Execute system comman...

MySQL Read File

Read files from filesystem using MySQL LOADFILE - requires FILE privilege from kittysploit import from core.framework.failure import ProcedureError, FailureType from lib.protocols.mysql.mysqlclient import MySQLClient class ModulePost, MySQLClient: info = "name": "MySQL Read File", "description":...

PHP 7.1-7.3 disable_functions bypass

PHP 7.1-7.3 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.1-7.3 disablefunctions bypass", "description": "PHP 7.1-7.3 json disablefunctions bypass", "arch": Arch.PHP,...

Loadbalancer.org Enterprise VA SSH Private Key Exposure

Loadbalancer.org ships a public/private key pair on Enterprise virtual appliances version 7.5.2 that allows passwordless authentication to any other LB Enterprise box from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class...

Monsta FTP CVE-2025-34299

Monsta FTP - Arbitrary file download from malicious FTP server leading to RCE CVE-2025-34299 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpserver import Ftpserver import json import os import random import string import tempfile import threading impor...

PHP 7.0-7.4 disable_functions bypass

PHP 7.0-7.4 disablefunctions bypass 7.0 - all versions 7.1 - all versions 7.2 - all versions 7.3 7.3.15 7.4 7.4.3 from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.4 disablefunctions bypass",...

Check Disable Functions

Check Disable Functions from kittysploit import class ModulePost: info = "name": "Check Disable Functions", "description": "Check Disable Functions", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired':...

IAM Privilege Escalation

Attempt to escalate IAM privileges by creating privileged users/roles !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Privilege Escalation Module Author: KittySploit Team Version: 1.0.0 This module attempts to escalate IAM privileges by creating new users/roles or modifying existing ones...

Enumerate AWS Credentials

Enumerate AWS credentials from environment variables, credential files, and EC2 metadata !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Credentials Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates AWS credentials from various sources: - Environment variables -...

Analyze CAN Messages

Analyzes CAN messages from a CANBUS session, detecting patterns and anomalies !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Message Analyzer - Analyzes CAN messages from a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler import...

Download from S3

Download files or entire buckets from S3 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import json import os class ModulePost: """Download files or buckets from S3""" info = "name": "Download from S3", "description": "Download files or entire buckets from S3", "author":...

Enumerate AWS S3

Enumerate S3 buckets, list objects, and check permissions !/usr/bin/env python3 -- coding: utf-8 -- """ AWS S3 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates S3 buckets and their contents. """ from kittysploit import import json from core.outputhandler import...

IAM Backdoor User

Create a persistent IAM user with administrator access !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Backdoor User Module Author: KittySploit Team Version: 1.0.0 This module creates a persistent backdoor IAM user with administrator access. WARNING: This is for authorized penetration testi...