IAM Backdoor User

Create a persistent IAM user with administrator access !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Backdoor User Module Author: KittySploit Team Version: 1.0.0 This module creates a persistent backdoor IAM user with administrator access. WARNING: This is for authorized penetration testi...

Meterpreter Reverse TCP

Advanced Meterpreter-like reverse TCP listener with post-exploitation capabilities !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket import threading import time import struct class ModuleListener: """Meterpreter reverse TCP listener with advanced post-exploitation...

firefox 66.0.3

Exploit spidermonkey firefox 66.0.3 from kittysploit import class ModuleBrowserExploit: info = "name": "firefox 66.0.3", "description": "Exploit spidermonkey firefox 66.0.3", "cve": "2019-11707", "platform": Platform.LINUX, "arch": Arch.X64, "payload": "default":...

FTP Honeypot Server

Advanced FTP honeypot that simulates a real FTP server and logs intrusion attempts from kittysploit import from lib.protocols.tcp.tcpserver import Tcpserver import socket import threading import datetime import os class ModuleAuxiliary, Tcpserver: info = 'name': 'FTP Honeypot Server',...

Kodi Plugin Generator

Kodi Plugin Generator for Kodi 19 from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'Kodi Plugin Generator', 'description': 'Kodi Plugin Generator for Kodi 19', 'author': 'KittySploit Team', 'arch': Arch.X86, Arch.X64, lhost = OptIP'','Connect-back IP address',...

Brickcom Corp Network Camera Conf Disclosure

Brickcom Corporation Network Camera Configuration Dislosure vulnerability from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Brickcom Corp Network Camera Conf Disclosure", "description": "Brickcom Corporation Network...

MantisBT password reset

MantisBT before 1.3.10, 2.2.4, and 2.3.1 are vulnerable to unauthenticated password reset. from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleAuxiliary, Httpclient: info = "name": "MantisBT password reset", "description": "MantisBT before 1.3.10,...

Shell Php POST

Shell Php POST from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php POST', 'description': 'Shell Php POST', 'author': 'KittySploit Team', 'listener': 'listeners/web/phppost', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, paramname = OptString"kittyshell", "param name for...

D-Link DCS-2000 CSRF

D-Link DCS-2000 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-2000 CSRF", "description": "D-Link DCS-2000 camera - Change root password via CSRF POST", "author":...

Warehouse Inventory System 1.0 csrf

Warehouse Inventory System 1.0 change admin password csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": " Warehouse Inventory System 1.0 csrf", "description": " Warehouse Inventory System 1.0 change admin password csrf",...

JavaScript CharCode Encoder

Encodes JavaScript using String.fromCharCode with numeric ASCII values from kittysploit import class ModuleEncoder: info = "name": "JavaScript CharCode Encoder", "description": "Encodes JavaScript using String.fromCharCode with numeric ASCII values", "author": "KittySploit Team", "platform":...

Create ssh server

Create a ssh server and listen for connections from kittysploit import import paramiko import threading import socket from io import StringIO class ModuleListener: info = "name": "Create ssh server", "description": "Create a ssh server and listen for connections", "handler": Handler.REVERSE,...

reverse aws sqs

Reverse shell listener using AWS SQS Simple Queue Service !/usr/bin/env python3 -- coding: utf-8 -- """ AWS SQS Reverse Shell Listener Author: KittySploit Team Version: 1.0.0 This listener uses AWS SQS Simple Queue Service to establish a reverse shell connection. It requires two SQS queues: -...

JavaScript Unicode Encoder

Encodes JavaScript code into Unicode escape sequences \uXXXX from kittysploit import class ModuleEncoder: info = "name": "JavaScript Unicode Encoder", "description": "Encodes JavaScript code into Unicode escape sequences \uXXXX", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT,...

Python Base64 Encoder

Encodes Python code in base64 !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import base64 class ModuleEncoder: info = "name": "Python Base64 Encoder", "description": "Encodes Python code in base64", "author": "KittySploit Team", "platform": Platform.PYTHON, def encodeself,...

WordPress Admin for New User CSRF

WordPress - Create admin user via CSRF GET vulnerability from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "WordPress Admin for New User CSRF", "description": "WordPress - Create admin user via CSRF GET vulnerability", "author":...

Shell Php GET

Shell Php GET from kittysploit import class ModuleBackdoor: info = 'name': 'Shell Php GET', 'description': 'Shell Php GET', 'author': 'KittySploit Team', 'listener': 'listeners/web/phpget', 'sessiontype': SessionType.PHP, 'arch': Arch.PHP, paramname = OptString"kittyshell", "param name for...

D-Link DCS-963L CSRF

D-Link DCS-963L camera - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-963L CSRF", "description": "D-Link DCS-963L camera - Change admin password via CSRF POST", "author":...

flatCore CVE-2019-13961 CSRF

flatCore CMS - CSRF vulnerability in file upload endpoint CVE-2019-13961 from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "flatCore CVE-2019-13961 CSRF", "description": "flatCore CMS - CSRF vulnerability in file upload endpoint...

WebGoat Environment

OWASP WebGoat - Learning platform for web application security testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'WebGoat Environment', 'description': 'OWASP WebGoat - Learning platform for web application security testing',...

Linux x64 XOR Encoder

XOR encoder for Linux x64 payloads with 4-byte key !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleEncoder: info = "name": "Linux x64 XOR Encoder", "description": "XOR encoder for Linux x64 payloads with 4-byte key", "author": "KittySploit Team", "platform":...

Pastejacking - Clipboard Hijacking

Modifies victim's clipboard content to inject malicious payload when they paste !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.js.generic import bundlewithgenericlib, jsstring class ModuleBrowserExploit: info = "name": "Pastejacking - Clipboard Hijacking", "description...

Check robots.txt

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpclient import Httpclient from colorama import Fore, Style class ModuleAuxiliary, Httpclient: info = 'name': 'Check robots.txt', 'description': 'Crawl a web site and store information...

Wordpress Plugin Accesspress - Shell Upload

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and...

IAM Privilege Escalation

Attempt to escalate IAM privileges by creating privileged users/roles !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Privilege Escalation Module Author: KittySploit Team Version: 1.0.0 This module attempts to escalate IAM privileges by creating new users/roles or modifying existing ones...

Inject CAN Message

Injects CAN messages into the bus attack/exploitation !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Message Injector - Injects CAN messages into the bus Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler import printinfo, printsuccess, printerror,...

FTP Upload Web Shell

Uploads a web shell file to the FTP server for persistent web-based access !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import tempfile import time class ModulePost, FTPClientMixin: """FTP Web Shell Upload...

PHP 7.0-7.3 disable_functions bypass

PHP 7.0-7.3 disablefunctions bypass using UAF vulnerability from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.0-7.3 disablefunctions bypass", "description": "PHP 7.0-7.3 disablefunctions bypass using UAF...

Web Download File

Download a file from a web server from kittysploit import class ModulePost: info = "name": "Web Download File", "description": "Download a file from a web server", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects':...

Check archive website

Query the Wayback Machine CDX API for historical URLs of the target host. By default only samples a small set of URLs does not hammer the live site. from kittysploit import from lib.protocols.http.httpclient import Httpclient import requests from urllib.parse import urlparse class ModuleAuxiliary...

PHP 7.4 > ffi disable_functions bypass

PHP 7.4 ffi disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.4 ffi disablefunctions bypass", "description": "PHP 7.4 ffi disablefunctions bypass", "arch": Arch.PHP, 'agent': 'risk...

PHP 7.1-7.3 disable_functions bypass

PHP 7.1-7.3 json disablefunctions bypass from kittysploit import from lib.protocols.http.httpserver import Httpserver as HTTPServer class ModulePost, HTTPServer: info = "name": "PHP 7.1-7.3 disablefunctions bypass", "description": "PHP 7.1-7.3 json disablefunctions bypass", "arch": Arch.PHP,...

Enumerate MyImunify360 Configuration

Extract MyImunify360 configuration, credentials, whitelist, and rules from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "Enumerate MyImunify360 Configuration", "description": "Extract MyImunify360 configuration, credentials,...

Reverse TCP shell

Reverse TCP shell in PHP using a reverse handler from kittysploit import from lib.exploit.handler import Reverse class ModulePost, Reverse: info = "name": "Reverse TCP shell", "description": "Reverse TCP shell in PHP using a reverse handler", "author": "KittySploit Team", "arch": Arch.PHP, 'agent...

Windows x64 Command Shell Stage

Windows x64 shell stage - expects socket handle to be connected staged !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import os import subprocess import struct from pathlib import Path class ModulePayload: info = 'name': 'Windows x64 Command Shell Stage', 'description': 'Window...

LFI Fuzzer

Fuzzing module for Local File Inclusion vulnerabilities. Tests various LFI bypass techniques and payloads. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.scanner.http.moduleresult import finalizehttpscannerrun, targetbaseurl from lib.protocols.http.httpclient import...

Wordpress user enumeration

Try to extract wordpress user enumeration from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Wordpress user enumeration', 'description': "Try to extract wordpress user enumeration", 'tags': 'web', 'scanner', 'wordpress',...

PHP 8.1.0-dev (backdoor)

PHP 8.1.0-dev backdoor from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': 'PHP 8.1.0-dev backdoor', 'description': 'PHP 8.1.0-dev backdoor', 'cve': '', 'platform': Platform.ALL, 'arch': Arch.X64, Arch.X86, 'payload':...

MS08-067 Microsoft Server Service Relative Path Stack Corruption

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild ...

Generic SSH Client Listener

Ultra-simple SSH client listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import paramiko class ModuleListener: info = 'name': 'Generic SSH Client Listener', 'description': 'Ultra-simple SSH client listener - framework handles sessio...

Unix Command Shell, Reverse TCP (via Python)

Connect back and create a command shell via Python Linux/Unix only; use singles/cmd/windows/pythonreversetcp on Windows from kittysploit import from lib.shell.ptyruntime import buildunixptyscript class ModulePayload: CLIENTLANGUAGE = "python" info = 'name': 'Unix Command Shell, Reverse TCP via...

Sourcegraph Gitserver 3.36.3 Rce

Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service. The service acts as a git exec proxy, and fails to properly restrict calling git config. This allows an attacker to set the git core.sshCommand...

Barracuda load balancer Priv Key

Privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 via the use of an improperly protected SSH key. from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name':...

Enumerate EC2 Metadata

Retrieve metadata from EC2 Instance Metadata Service IMDS !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Metadata Enumeration Module Author: KittySploit Team Version: 1.0.0 This module retrieves metadata from EC2 Instance Metadata Service IMDS. """ from kittysploit import import json from...

Cross-Account Role Assumption

Attempt to assume IAM roles in other AWS accounts !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Cross-Account Role Assumption Module Author: KittySploit Team Version: 1.0.0 This module attempts to assume roles in other AWS accounts cross-account access. """ from kittysploit import import json...

Enumerate AWS Services

Discover all AWS services in use across the account !/usr/bin/env python3 -- coding: utf-8 -- """ AWS Services Enumeration Module Author: KittySploit Team Version: 1.0.0 This module discovers all AWS services in use and provides a comprehensive overview. """ from kittysploit import import json fr...

FTP Gather File Listing

Enumerates files and directories on FTP server, optionally downloading interesting files !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os class ModulePost, FTPClientMixin: """FTP File Enumeration Module""" info =...

reverse aws sqs command

AWS SQS command executor listener - execute commands via SQS without interactive shell !/usr/bin/env python3 -- coding: utf-8 -- """ AWS SQS Command Executor Listener Author: KittySploit Team Version: 1.0.0 This listener uses AWS SQS to execute commands remotely without an interactive shell. It's...

CORS Misconfiguration Scanner

Scans for common CORS Cross-Origin Resource Sharing misconfigurations that could allow unauthorized cross-origin requests !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Debian Package Creator

Debian Package Creator from kittysploit import import os import shutil from pathlib import Path from lib.compile.debevasionhelpers import createararchive, createcontroltar, createdatatar, class ModuleBackdoor: info = 'name': 'Debian Package Creator', 'description': 'Debian Package Creator',...