Elasticsearch Listener

Elasticsearch listener - creates interactive Elasticsearch shell session !/usr/bin/env python3 -- coding: utf-8 -- """ Elasticsearch listener - connects to an Elasticsearch cluster and creates an interactive session. """ from kittysploit import from elasticsearch import Elasticsearch from...

DNS C2 (Kittysploit DNS)

Uses Kittysploit DNS server API to send commands and receive agent output. Create URLs via API, no local UDP. !/usr/bin/env python3 -- coding: utf-8 -- """ DNS C2 Kittysploit DNS - Uses your Kittysploit DNS server API to send commands and receive agent output. No UDP listener: commands are pushed...

MongoDB Listener

MongoDB NoSQL listener - creates interactive MongoDB shell session !/usr/bin/env python3 -- coding: utf-8 -- """ MongoDB listener - connects to a MongoDB server and creates an interactive session. """ from kittysploit import from pymongo import MongoClient from pymongo.errors import PyMongoError...

Redis Listener

Redis in-memory store listener - creates interactive Redis shell session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import redis class ModuleListener: info = 'name': 'Redis Listener', 'description': 'Redis in-memory store listener - creates interactive Redis shell session',...

LDAP Listener

LDAP directory listener - creates interactive LDAP shell session !/usr/bin/env python3 -- coding: utf-8 -- """ LDAP listener - connects to an LDAP server and creates an interactive session. """ from kittysploit import from ldap3 import Server, Connection, ALL, SUBTREE from ldap3.core.exceptions...

PostgreSQL Listener

PostgreSQL database listener - creates interactive PostgreSQL shell session !/usr/bin/env python3 -- coding: utf-8 -- """ PostgreSQL database listener - connects to a PostgreSQL server and creates an interactive session. """ from kittysploit import import psycopg2 class ModuleListener:...

Windows Process Migration

Migrates the Meterpreter session to a different process !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import re class ModulePost: """Windows Process Migration Module Migrates the Meterpreter session to a different process. This is useful for: - Hiding in a legitimate process -...

Install Python for Windows

Downloads and extracts an embeddable Python3 distribution onto the target !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.framework.failure import FailureType, ProcedureError from lib.post.windows.session import wincompatfailuretype, winprobepowershell import os import...

Windows UAC Bypass

Bypasses User Account Control UAC using various techniques to obtain administrator privileges !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import tempfile import time class ModulePost: info = "name": "Windows UAC Bypass", "description": "Bypasses User Account Contro...

LimeSurvey 5.2.4 - Authenticated Remote Code Execution (RCE)

CVE-2021-44967 - LimeSurvey Authenticated RCE via malicious plugin upload !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from bs4 import BeautifulSoup import zipfile import tempfile import os import warnings from io import...

AlchemyCMS Authenticated eval() RCE

Authenticated Remote Code Execution RCE via unsafe eval in resourceurlproxy helper. The helper method Alchemy::ResourcesHelperresourceurlproxy in app/helpers/alchemy/resourceshelper.rb insecurely processes the enginename attribute from a resourcehandler object, passing it directly to Ruby eval...

Windows Python Meterpreter, Reverse TCP

Small Meterpreter stager for Windows - receives stage in memory requires Python on target !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Python Meterpreter Reverse TCP Payload Author: KittySploit Team Version: 2.0.0 This payload creates a small Meterpreter stager that connects back to the...

SmarterMail Auth Bypass and RCE

Authentication bypass via force-reset-password no valid old password required followed by login and RCE via AddOrUpdateMount API. The /api/v1/auth/force-reset-password endpoint allows resetting the admin password with an arbitrary old password. After reset, login yields an access token. The...

Telnet NEW-ENVIRON Command Injection

Exploits the Telnet NEW-ENVIRON vulnerability CVE-1999-0047 by injecting commands into the USER environment variable during Telnet option negotiation. This spawns an interactive shell session that is managed by the framework. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

PowerShell Command Shell, Reverse TCP

Connect back and create a command shell via PowerShell !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 from lib.c2.stagerevasion import powershellprelude from lib.c2.tcpresilience import buildpowershellreconnectwrapper, parsecoverendpoints class ModulePayload:...

Fake CAPTCHA Reverse Shell

Generate a fake CAPTCHA modal that tricks users into executing a PowerShell reverse shell via Win+R Copy and Paste attack vector. Serves payload via HTTP server. from kittysploit import from lib.protocols.http.httpserver import Httpserver import json class ModuleBrowserExploit, Httpserver: info =...

MySQL Listener

MySQL database listener - creates interactive MySQL shell session from kittysploit import import pymysql class ModuleListener: info = 'name': 'MySQL Listener', 'description': 'MySQL database listener - creates interactive MySQL shell session ', 'author': 'KittySploit Team', 'handler': Handler.BIN...

MySQL Database Connection

Connect to MySQL database and execute SQL queries from kittysploit import class ModulePost: info = "name": "MySQL Database Connection", "description": "Connect to MySQL database and execute SQL queries", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent':...

WordPress MySQL Connection

Extract MySQL credentials from wp-config.php and create MySQL session from kittysploit import import re class ModulePost: info = "name": "WordPress MySQL Connection", "description": "Extract MySQL credentials from wp-config.php and create MySQL session", "author": "KittySploit Team", "sessiontype...

Linux Gather Configurations

Linux Gather Configurations with enumeration of configuration files from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Gather Configurations", "description": "Linu...

Linux Port Forwarding

Create port forwards through a compromised Linux session for network pivoting from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import socket import threading import time class ModulePost, System, LinuxSessionMixin: info = "name"...

Disable DevTools

Disable browser DevTools using multiple protection techniques F12, right-click, keyboard shortcuts, etc. from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Disable DevTools", "description": "Disable browser DevTools using multiple protection techniques F12, right-click, keyboar...

Hidden Form Capture

Create a hidden form to trigger browser autofill and capture saved credentials email/username/password from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Hidden Form Capture", "description": "Create a hidden form to trigger browser autofill and capture saved credentials...

Windows Gather Local User Account Password Hashes (Registry)

Dumps local user account password hashes from the SAM database using registry access. Requires SYSTEM privileges. !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Gather Local User Account Password Hashes Registry Extracts password hashes from the SAM database using registry access """ from...

FTP Gather System Information

Gathers detailed system information from FTP server including version, features, and capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import socket import re class ModulePost, FTPClientMixin: """FTP System...

FTP Search Files

Searches for files on FTP server by name pattern, extension, or content keywords !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import re class ModulePost, FTPClientMixin: """FTP File Search Module""" info = "name...

Browser In The Browser

Create a fake browser interface inside the real browser to capture user interactions URLs, clicks, keystrokes from kittysploit import import uuid import time import json class ModuleBrowserAuxiliary: info = "name": "Browser In The Browser", "description": "Create a fake browser interface inside t...

Execute JavaScript

Execute JavaScript code on browser victim from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Execute JavaScript", "description": "Execute JavaScript code on browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype":...

Keylogger

Log keystrokes from browser victim and receive them in real-time from kittysploit import import time class ModuleBrowserAuxiliary: info = "name": "Keylogger", "description": "Log keystrokes from browser victim and receive them in real-time", "author": "KittySploit Team", "browser": Browser.ALL,...

Password Harvest

Extract saved passwords from browser autofill by revealing hidden password fields from kittysploit import import json import time class ModuleBrowserAuxiliary: info = "name": "Password Harvest", "description": "Extract saved passwords from browser autofill by revealing hidden password fields",...

Redirect Browser

Redirect browser victim to a URL from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Redirect Browser", "description": "Redirect browser victim to a URL", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, url =...

Play Sound

Play a sound on the browser victim requires user interaction on modern browsers from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Play Sound", "description": "Play a sound on the browser victim requires user interaction on modern browsers", "author": "KittySploit Team",...

Linux User Enumeration

Enumerate users, groups, login history, sudo permissions, SSH keys, and shell history from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux User Enumeration",...

Linux Credentials Gathering

Gather credentials including password hashes, SSH keys, API tokens, and passwords in configuration files from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import re class ModulePost, System, LinuxSessionMixin: info = "name": "Lin...

Linux Virtual Machine Detection

Detect if the target system is running inside a virtual machine from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import re class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Virtual Machine Detection",...

FTP Delete File

Deletes files or directories from the FTP server !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Deletion Module""" info = "name": "FTP Delete File", "description":...

Detect Properties

Detect comprehensive properties of the browser victim plugins, features, fingerprinting data from kittysploit import import json from datetime import datetime class ModuleBrowserAuxiliary: info = "name": "Detect Properties", "description": "Detect comprehensive properties of the browser victim...

XSS Alert

Execute alert on browser victim from kittysploit import class ModuleBrowserAuxiliary: info = "name": "XSS Alert", "description": "Execute alert on browser victim", "author": "KittySploit Team", "tags": "xss", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER,...

Get Cookies

Get cookies from browser victim from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Get Cookies", "description": "Get cookies from browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, def runself:...

Generate Fingerprint

Generate a unique fingerprint hash from browser properties for session matching from kittysploit import import json import hashlib from datetime import datetime class ModuleBrowserAuxiliary: info = "name": "Generate Fingerprint", "description": "Generate a unique fingerprint hash from browser...

CMD Base64 Encoder

Encodes command-line payloads in base64 to avoid bad characters. Supports Unix/Linux shells with multiple decoding methods. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "CMD Base64 Encoder", "description": "Encodes command-lin...

FTP Create Persistence

Creates persistent backdoor access by uploading scheduled task scripts, cron jobs, or startup scripts !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import tempfile import time class ModulePost, FTPClientMixin:...

Linux Network Enumeration

Enumerate network interfaces, connections, routes, firewall rules, and DNS configuration from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Network Enumeration",...

Linux Internal Network Scanner

Scan internal network from compromised Linux machine for pivoting targets from kittysploit import from lib.post.linux.system import System from lib.post.linux.session import LinuxSessionMixin import re class ModulePost, System, LinuxSessionMixin: info = "name": "Linux Internal Network Scanner",...

Windows WSL Alpine Relay

Reuses existing WSL distributions when possible, otherwise installs Alpine, then deploys a resilient reverse relay with persistence. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 import textwrap import time class ModulePost: """Deploy and persist a reverse relay...

capture all form

Capture all form data from the browser victim from kittysploit import class ModuleBrowserAuxiliary: info = "name": "capture all form", "description": "Capture all form data from the browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype":...

Find Similar Sessions

Find browser sessions with similar fingerprints 90% match from kittysploit import import json from difflib import SequenceMatcher class ModuleBrowserAuxiliary: info = "name": "Find Similar Sessions", "description": "Find browser sessions with similar fingerprints 90% match", "author": "KittySploi...

Get Local Storage

Extract all data from localStorage of the browser victim from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Get Local Storage", "description": "Extract all data from localStorage of the browser victim", "author": "KittySploit Team", "browser": Browser.ALL, "platform...

XSS DOM Scanner

Advanced XSS vulnerability scanner that analyzes the DOM for potential XSS vulnerabilities DOM-based, reflected, stored from kittysploit import class ModuleBrowserAuxiliary: info = "name": "XSS DOM Scanner", "description": "Advanced XSS vulnerability scanner that analyzes the DOM for potential XS...

Control Web Panel /admin/index.php Unauthenticated RCE

Control Web Panel CWP versions = 0.9.8.1208 are vulnerable to unauthenticated OS command injection. User input passed via the "key" GET parameter to /admin/index.php when the "api" parameter is set is not properly sanitized before being used to execute OS commands. This can be exploited by...