D-Link DI-524 CSRF (password change)

D-Link DI-524 Wireless 150 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DI-524 CSRF password change", "description": "D-Link DI-524 Wireless 150 router - Change admin passwo...

Artica Proxy 4.3.0 - Auth Bypass/OS Command Injection

Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Webmin password_change.cgi Backdoor

An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = 'name': "Webmin passwordchange.cgi Backdoor",...

Symantec Messaging Gateway 9.5 Default SSH Password

The 'support' user has a known default password, which can be used to login to the SSH service, and gain privileged access from remote from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info =...

Wordpress Plugin Ad Inserter rce

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleExploit, Httpclient, Wordpress: info = "name": "Wordpress Plugin Ad Inserter...

Zig Meterpreter Linux, Reverse TCP (compat)

Linux Meterpreter payload in Zig compatibility path; requires Zig compiler !/usr/bin/env python3 -- coding: utf-8 -- """ Compatibility module for the Linux Zig Meterpreter reverse TCP payload. Prefer payloads/singles/cmd/unix/zigmeterpreterlinuxreversetcp. """ from kittysploit import from...

Enumerate AWS EC2

Enumerate EC2 instances, security groups, and related resources !/usr/bin/env python3 -- coding: utf-8 -- """ AWS EC2 Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates EC2 instances, security groups, and related resources. """ from kittysploit import import json fr...

Enumerate AWS IAM

Enumerate IAM users, roles, groups, and policies !/usr/bin/env python3 -- coding: utf-8 -- """ AWS IAM Enumeration Module Author: KittySploit Team Version: 1.0.0 This module enumerates IAM users, roles, policies, and permissions. """ from kittysploit import import json from core.outputhandler...

Analyze CAN Messages

Analyzes CAN messages from a CANBUS session, detecting patterns and anomalies !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Message Analyzer - Analyzes CAN messages from a CANBUS session Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler import...

FTP Gather User Information

Enumerates FTP users, checks for anonymous access, and gathers connection information !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin from ftplib import FTP, errorperm import socket import time class ModulePost,...

JavaScript Base64 Encoder

Encodes JavaScript code in base64 with atob decoder from kittysploit import import base64 class ModuleEncoder: info = "name": "JavaScript Base64 Encoder", "description": "Encodes JavaScript code in base64 with atob decoder", "author": "KittySploit Team", "platform": Platform.JAVASCRIPT, Options...

Generic Bind TCP Listener

Ultra-simple bind TCP listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import socket class ModuleListener: info = 'name': 'Generic Bind TCP Listener', 'description': 'Ultra-simple bind TCP listener - framework handles session...

Sony Bravia Smart TV get wifi password

Retrieve the static Wi-Fi password in Sony Bravia Smart TV by using the Photo Sharing from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Sony Bravia Smart TV get wifi password', 'description': 'Retrieve the static Wi-Fi...

Supra Smart Cloud TV rfi

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Supra Smart Cloud TV rfi', 'description': 'Supra Smart Cloud TV allows remote file inclusion in the...

Windows x86 Reverse TCP Stager

Windows x86 Reverse TCP Stager from kittysploit import class ModulePayload: info = 'name': 'Windows x86 Reverse TCP Stager', 'description': 'Windows x86 Reverse TCP Stager', 'author': 'KittySploit Team', 'category': PayloadCategory.STAGER, 'arch': Arch.X64, 'platform': Platform.WINDOWS, 'listener...

Allegro Software RomPager "Misfortune Cookie"

This module exploits HTTP servers that appear to be vulnerable to the'Misfortune Cookie' vulnerability which affects Allegro SoftwareRompager versions before 4.34 and can allow attackers to authenticateto the HTTP service as an administrator without providing validcredentials. from kittysploit...

Brickcom Camera Credentials Disclosure

Allows remote credential disclosure by low-privilege user. from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleAuxiliary, Httpclient: info = "name": "Brickcom Camera Credentials Disclosure", "description": "Allows remote credential disclosure by...

Master IP CAM credentials

MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers toobtain sensitive information via a crafted HTTP request, as demonstrated by the username, password, and configuration settings. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Reboot a Chromecast

With this module you can reboot a specified chromecast from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Reboot a Chromecast', 'description': 'With this module you can reboot a specified chromecast', 'author':...

Windows http.sys Driver DoS

Windows http.sys double free causing DoS. from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = "name": "Windows http.sys Driver DoS", "description": "Windows http.sys double free causing DoS.", "author": "KittySploit Team", "cve":...

dvwa csrf

DVWA CSRF attack - Change password via CSRF GET from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "dvwa csrf", "description": "DVWA CSRF attack - Change password via CSRF GET", "author": "KittySploit Team", "browser": Browser.ALL,...

D-Link 600M Change Wireless Password CSRF

D-Link 600M router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link 600M Change Wireless Password CSRF", "description": "D-Link 600M router - Change wireless password via CSRF POST"...

D-Link DCS-5300 CSRF

D-Link DCS-5300 camera - Change root password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DCS-5300 CSRF", "description": "D-Link DCS-5300 camera - Change root password via CSRF POST", "author":...

D-Link DIR-605 CSRF

D-Link DIR-605 router - Change admin password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-605 CSRF", "description": "D-Link DIR-605 router - Change admin password via CSRF POST", "author": "KittySplo...

D-Link DIR-615 CSRF

D-Link DIR-615 router - Change wireless password via CSRF POST from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "D-Link DIR-615 CSRF", "description": "D-Link DIR-615 router - Change wireless password via CSRF POST", "author":...

CMSUno 1.6 csrf

CMSUno 1.6 csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "CMSUno 1.6 csrf", "description": "CMSUno 1.6 csrf", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, target =...

Casdoor CVE-2023-34927 CSRF

Casdoor v2.95.0 and below - CSRF vulnerability in /api/set-password endpoint CVE-2023-34927 from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "Casdoor CVE-2023-34927 CSRF", "description": "Casdoor v2.95.0 and below - CSRF...

GetSimple CMS 1.6 csrf

GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request Forgery Add Admin from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "GetSimple CMS 1.6 csrf", "description": "GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request...

Sickbeard 0.1 csrf

Sickbeard 0.1 csrf from kittysploit import from lib.protocols.http.csrf import Csrf class ModuleBrowserAuxiliary, Csrf: info = "name": "Sickbeard 0.1 csrf", "description": "Sickbeard 0.1 csrf", "browser": Browser.ALL, "platform": Platform.ALL, "sessiontype": SessionType.BROWSER, target =...

Pop-Under Tab Closing

Create a pop-under window on user's tab closing from kittysploit import class ModuleBrowserAuxiliary: info = "name": "Pop-Under Tab Closing", "description": "Create a pop-under window on user's tab closing", "author": "KittySploit Team", "browser": Browser.ALL, "platform": Platform.ALL,...

Call+4 Dword XOR Encoder

Call+4 Dword XOR Encoder from kittysploit import class ModuleEncoder: info = "name": "Call+4 Dword XOR Encoder", 'description': 'Call+4 Dword XOR Encoder', 'author': 'KittySploit Team', 'arch': Arch.X86, 'platform': Platform.UNIX, def encodeself, payload: xorkey = b"\xc0\xb2\xf9\x99" buf =...

Generic HTTP Client Listener

Ultra-simple HTTP client listener - framework handles session management !/usr/bin/env python3 -- coding: utf-8 -- """ Generic HTTP Client Listener - Ultra-simple implementation following generic pattern Author: KittySploit Team Version: 1.0.0 """ from kittysploit import import requests class...

Linux x64 Command Shell Stage

Linux x64 shell stage - expects socket fd 3 to be connected staged !/usr/bin/env python3 -- coding: utf-8 -- """ Linux x64 Command Shell Stage Author: KittySploit Team Version: 1.0.0 This payload is a "stage" that expects a socket to already be connected. It performs: - dup2 loop to redirect...

DVWA - Damn Vulnerable Web Application

Start a Docker environment containing DVWA for security web tests !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'DVWA - Damn Vulnerable Web Application', 'description': 'Start a Docker environment containing DVWA for security web...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

Wordpress plugin - 1 Flash Gallery

1 Flash Gallery Wordpress Plugin File Upload Exploit from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Wordpress plugin - 1 Flash Gallery", "description": "1 Flash Gallery Wordpress Plugin File Upload Exploit", "cve": "",...

Fuzz CANBUS

Fuzzes CAN bus with various message patterns to discover vulnerabilities !/usr/bin/env python3 -- coding: utf-8 -- """ CANBUS Fuzzer - Fuzzes CAN bus with various message patterns Author: KittySploit Team Version: 1.0.0 """ from kittysploit import from core.outputhandler import printinfo,...

MySQL UDF Command Execution

Execute system commands via MySQL UDF User Defined Functions - requires FILE privilege from kittysploit import from lib.protocols.mysql.mysqlclient import MySQLClient import platform class ModulePost, MySQLClient: info = "name": "MySQL UDF Command Execution", "description": "Execute system comman...

List all users from /etc/passwd

List all users from /etc/passwd from kittysploit import from core.framework.failure import ProcedureError, FailureType class ModulePost: info = "name": "List all users from /etc/passwd", "description": "List all users from /etc/passwd", "author": "KittySploit Team", "arch": Arch.PHP, "tags": "php...

PHP Port Scanner

PHP Port Scanner from kittysploit import class ModulePost: info = "name": "PHP Port Scanner", "description": "PHP Port Scanner", "arch": Arch.PHP, 'agent': 'risk': 'intrusive', 'effects': 'activeexploitation', 'expectedrequests': 2, 'reversible': False, 'approvalrequired': True, 'produces':...

Bind TCP shell

Bind TCP shell in PHP using a bind handler from kittysploit import from lib.exploit.handler import Bind class ModulePost, Bind: info = "name": "Bind TCP shell", "description": "Bind TCP shell in PHP using a bind handler", "author": "KittySploit Team", "arch": Arch.PHP, 'agent': 'risk': 'intrusive...

Nexus < 3.15.0 rce

Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleExploit, Httpclient: info = "name": "Nexus 3.15.0 rce", "description": "Sonatype Nexus Repository Manager before 3.15.0 has Incorre...

Unraid 6.8.0 Auth Bypass PHP Code Execution

This module exploits two vulnerabilities affecting Unraid 6.8.0An authentication bypass is used to gain access to the administrativeinterface, and an insecure use of the extract PHP function can be abusedfor arbitrary code execution as root. from kittysploit import from...

Quantum vmPRO Backdoor Command

Any user, even one without admin privileges, can get access to the restricted SSH shell from kittysploit import from lib.protocols.ssh.sshclient import Sshclient from lib.exploit.handler import Handler class ModuleExploit, Sshclient, Handler: info = 'name': 'Quantum vmPRO Backdoor Command',...

rpc.py 0.6.0 - RCE

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the 'serializer: pickle'HTTP header is sent. In other words, although JSON not Pickle is the default data format, an unauthenticated client can cause the data to be processed with unpickle. from kittysploit import...

FTP Download Directory

Downloads entire directory structure from FTP server recursively !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import time class ModulePost, FTPClientMixin: """FTP Download All Module""" info = "name": "FTP...

FTP Gather Configuration Files

Searches for configuration files on FTP server that may contain sensitive information passwords, API keys, database credentials, etc. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ftp.ftpclient import FTPClientMixin import os import re class ModulePost,...

WordPress Plugin Backdoor

Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/ from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'WordPress Plugin Backdoor', 'description': 'Generate a WordPress plugin backdoor that can be installed in wp-content/plugins/',...

Android properties from a Sony TV

Get internal TV files over HTTP without authentication from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Android properties from a Sony TV', 'description': 'Get internal TV files over HTTP without authentication',...

Joomla <= 3.6.4 admin takeover

An issue was discovered in components/comusers/models/registration.php in Joomla! before 3.6.5.Incorrect filtering of registration form data stored to the session on a validation error enables auser to gain access to a registered user's account and reset the user's group mappings, username,and...