Agent Local Store (PowerShell)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from...

Daemonize Process (Zig)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Zig", "description": "Detach from the controlling terminal on Un...

Hide Process argv (Zig)

Replace process name with an innocuous value on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig import emithideargv class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process arg...

Technicolor TC7200 Password Disclosure

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DCS-930L Auth RCE

Module exploits D-Link DCS-930L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS-930L Auth RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import...

ZTE F460 & F660 Backdoor RCE

Exploits ZTE F460 and F660 backdoor vulnerability that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460 & F660 Backdoor RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler...

D-Link DWR-932B - UDP Backdoor (HELODBG)

Sends the HELODBG UDP packet to enable the hidden telnet service on D-Link DWR-932B devices, then opens a framework shell session as root. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932B UDP HELODBG backdoor — opens framework shell session.""" from future import annotations import...

Netcore/Netis UDP/53413 Backdoor RCE

Exploits the Netcore/Netis UDP backdoor on port 53413 for unauthenticated remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP/53413 backdoor RCE — opens execute session.""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Belkin Play Max Persistent RCE

Module exploits Belkin SSID injection vuln, allowing to execute arbitrary command at every boot. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Play Max Persistent RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient:...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability through dnslookup.cgi resource. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient,...

BEWARD N100 RCE

BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution.shodan search: WWW-Authenticate: Basic realm="N100 H.264 IP Camera"censys search: services.http.response.headers.wwwauthenticate:"N100 H.264 IP Camera"zoomeye search: "headers:"N100 H.264 IP Camera" !/usr/bin/env python3 -- coding:...

Cisco RV320 Command Injection

Module exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320 Command Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zyxel ZyWALL USG Extract Hashes

Exploit implementation for ZyWall USG 20 Authentication Bypass In Configuration Import/Export. If the tharget is vulnerable it allows to download configuration files which contains sensitive data like password hashes, firewall rules and other network related configurations. !/usr/bin/env python3 ...

Netgear R7000 & R6400 RCE

Module exploits remote command execution in Netgear R7000 and R6400 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear R7000 & R6400 RCE""" from kittysploit import from...

Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

JVC & Vanderbilt & Honeywell IP-Camera Path Traversal

Module exploits JVC IP-Camera VN-T216VPRU, Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR and Honeywell IP-Camera HICC-1100PT Path Traversal vulnerability. If target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """JVC & Vanderbilt &...

P2P wificam credential disclosure

A credential disclosure in several cameras which utilize the GoAhead webserver. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam credential disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name'...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

D-Link DSL-2780B & DSL-2730B & DSL-526B DNS Change

Module exploits D-Link DSL-2780B, DSL-2730B and DSL-526B dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2780B & DSL-2730B & DSL-526B DNS Change""" import re from kittysploit import from...

Technicolor DWG-855 Auth Bypass

Module exploits Technicolor DWG-855 Authentication Bypass vulnerability which allows changing administrator's password. NOTE: This module will errase previous credentials, this is NOT stealthy. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor DWG-855 Auth Bypass""" import re from...

Huawei E5331 Info Disclosure

Module exploits information disclosure vulnerability in Huawei E5331 MiFi Mobile Hotspotdevices. If the target is vulnerable it allows to read sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei E5331 Info Disclosure""" import re from kittysploit import from...

Netgear JNR1010 Path Traversal

Module exploits Netgear JNR1010 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear JNR1010 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Linksys SMART WiFi Password Disclosure

Exploit implementation for Linksys SMART WiFi Password Disclosure vulnerability. If target is vulnerable administrator's MD5 passsword is retrieved. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys SMART WiFi Password Disclosure""" import re from kittysploit import from...

Thomson TWG850 Password Disclosure

Module exploits Thomson TWG850 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Thomson TWG850 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Grandstream GXV3611 HD - Telnet Backdoor

Triggers the hidden Grandstream GXV3611 HD telnet backdoor !/ port lol which starts a root shell on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session.""" import time from...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability in the ping.cgi script. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient, Handler: inf...

D-Link Multi HNAP RCE

Module exploits HNAP remote code execution vulnerability in multiple D-Link devices which allows executing commands on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Multi HNAP RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

3Com OfficeConnect RCE

Module exploits 3Com OfficeConnect remote command execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Zyxel P660HN-T v1 RCE

Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T v1 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v1 RCE""" from kittysploit import from lib.protocols.http.httpclien...

FortiGate OS - SSH Backdoor (Fortimanager_Access)

Authenticates to FortiGate OS 4.x through 5.0.7 using the hard-coded FortimanagerAccess account and interactive SSH challenge response. !/usr/bin/env python3 -- coding: utf-8 -- """FortiGate OS 4.x–5.0.7 SSH backdoor FortimanagerAccess.""" from future import annotations import base64 import hashl...

D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE

Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE""" import socket from kittysploit import from lib.exploit.handler...

Asus Infosvr Backdoor RCE

Module exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Asus Infosvr Backdoor RCE""" import struct import time import socket from...

Agent Local Store (Zig)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Zig emitter.""" from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.zig...

Asmax AR1004G Password Disclosure

Exploits Asmax AR1004G Password Disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts. !/usr/bin/env python3 -- coding: utf-8 -- """Asmax AR1004G Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Billion 7700NR4 Password Disclosure

Exploits Billion 7700NR4 password disclosure vulnerability that allows to fetch credentials for admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 7700NR4 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Jovision camera credential disclosure

Exploit implementation for jovision IP camera Credential Disclosure vulnerability. If target is vulnerable details of user accounts on the device including usernames and passwords are returned. !/usr/bin/env python3 -- coding: utf-8 -- """Jovision camera credential disclosure""" import json impor...

D-Link DIR-645 Password Disclosure

Module exploits D-Link DIR-645 password disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link...

D-Link DIR-8XX Password Disclosure

Module exploits D-Link DIR-8XX password disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-8XX Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DWR-932 Info Disclosure

Module explois information disclosure vulnerability in D-Link DWR-932 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932 Info Disclosure""" import json import re from kittysploit import from...

Huawei HG530 & HG520b Password Disclosure

Module exploits password disclosure vulnerability in Huawei HG530 and HG520b devices. If the target is vulnerable it allows to read credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG530 & HG520b Password Disclosure""" import re from kittysploit import from...

Cisco IOS HTTP Unauthorized Administrative Access

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS HTTP Unauthorized Administrative Access"""...

Thomson TWG849 Info Disclosure

Module exploits Thomson TWG849 information disclosure vulnerability which allows reading sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Thomson TWG849 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco Unified Multi Path Traversal

Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 --...

TP-Link WDR842ND configure Disclosure

Module exploits TP-Link WDR842ND configure disclosure vulnerability which allows fetching configure. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR842ND configure Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

P2P wificam remote code execution

A credential disclosure in several cameras which utilize the GoAhead webserver, combined with an authenticated RCE allows for unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam remote code execution""" from kittysploit import from...

Linksys E1500/E2500

Module exploits remote command execution in Linksys E1500/E2500 devices. Diagnostics interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E1500/E2500""" import time from kittysploit import...

TP-Link Archer C2 & C20i

Exploits TP-Link Archer C2 and Archer C20i remote code execution vulnerability that allows executing commands on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C2 & C20i""" import time from kittysploit import from...

Asmax AR 804 RCE

Module exploits Asmax AR 804 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Asmax AR 804 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...