TerraMaster TOS - GetTest.php RCE (CVE-2017-9328)

Exploits command injection in TerraMaster /include/ajax/GetTest.php to drop a PHP shell and open an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS GetTest.php RCE CVE-2017-9328 — opens execute session.""" import re from kittysploit import from...

jQuery File Upload - Unauth Upload RCE Detection (CVE-2018-9206)

Detects CVE-2018-9206 by uploading a PHP one-liner via blueimp jQuery-File-Upload endpoints and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """Blueimp jQuery File Upload unauthenticated RCE CVE-2018-9206.""" import re from urllib.parse import urlparse from kittysploit import from...

DroboPix - demo API Command Injection Detection (CVE-2018-14706)

Detects DroboPix RCE by injecting into /DroboPix/api/drobopix/demo JSON enabled field, writing id output under /DroboPix/, then reading it. !/usr/bin/env python3 -- coding: utf-8 -- """DroboPix demo API command injection CVE-2018-14706.""" import re import secrets from kittysploit import from...

FreePBX - API handler system() Detection (CVE-2014-1903)

Detects CVE-2014-1903 by calling /admin/config.php handler=api function=system with args=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin API handler system RCE CVE-2014-1903.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

PhpWiki - Ploticus RCE Detection (CVE-2014-5519)

Detects CVE-2014-5519 by POSTing a Ploticus device=";id;" payload to index.php edit preview. !/usr/bin/env python3 -- coding: utf-8 -- """PhpWiki Ploticus device command injection CVE-2014-5519.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Monitorix - Pipe Command Injection Detection (CVE-2013-7070)

Detects CVE-2013-7070/7071 by requesting /monitorix/|id| style paths. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix HTTP server pipe command injection CVE-2013-7070.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

AlienVault OSSIM - av-centerd SOAP RCE Detection (CVE-2014-3804)

Detects CVE-2014-3804 by POSTing updatesysteminfodebianpackage SOAP with injected ;id to av-centerd default port 40007. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Joomla - com_fields SQLi Detection (CVE-2017-8917)

Detects CVE-2017-8917 by sending UpdateXML payload via comfields list fullordering and matching XPATH syntax error .255. in a 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla comfields SQLi CVE-2017-8917.""" import re from kittysploit import from lib.protocols.http.httpclient...

D-Link DAP-2020 - webproc File Read (CVE-2021-27250)

Reads arbitrary files from D-Link DAP-2020 via POST /cgi-bin/webproc errorpage= parameter CVE-2021-27250. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage arbitrary file read CVE-2021-27250.""" from kittysploit import from lib.protocols.http.httpclient import...

Siemens SIMATIC - Default Password Auth Bypass Detection (CVE-2011-4508)

Detects CVE-2011-4508/4509 by POSTing Login=Administrator&Password=100 to FormLogin. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4508/4509 by POSTing Login=Administrator&Password=100 to FormLogin.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Bash Shellshock - HTTP CGI Detection (CVE-2014-6271)

Detects Shellshock by injecting :;; id into User-Agent/Referer/Cookie against common CGI paths and matching uid=/gid=. !/usr/bin/env python3 -- coding: utf-8 -- """GNU Bash Shellshock HTTP CGI RCE CVE-2014-6271 / CVE-2014-6278.""" import re from kittysploit import from lib.protocols.http.httpclie...

Zyxel Device - Export_Log File Read (CVE-2023-28770)

Reads arbitrary files via /ExportLog?/ on vulnerable Zyxel devices CVE-2023-28770. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel ExportLog unauthenticated file read CVE-2023-28770.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing unauthenticated arbitrary file reads password hashes, configs, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

Ruby on Rails Web Console - IP Bypass RCE (CVE-2015-3224)

Exploits CVE-2015-3224 by bypassing Web Console IP restrictions with X-Forwarded-For: 0000::1 and evaluating backtick OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails Web Console IP whitelist bypass RCE CVE-2015-3224 — opens execute...

Anti-Web - write.cgi File Read (CVE-2017-9097)

Reads arbitrary files via Anti-Web /cgi-bin/write.cgi template= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Anti-Web write.cgi arbitrary file read CVE-2017-9097.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi clas...

Zyxel NSA310 - Pure-FTPd Command Injection Detection

Detects Zyxel NSA310 FTP RCE by authenticating with user ' then pass '; id; and matching uid= in the FTP response. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NSA310 Pure-FTPd username command injection.""" import re import socket from kittysploit import from...

FreePBX - Music Upload Filename RCE Detection

Detects FreePBX music module RCE by uploading a file named $id.wav via /admin/ajax.php?module=music&command=upload and matching uid= in the 500 response. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename command injection.""" import re from kittysploit import from...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

WordPress is-human - passthru RCE Detection (CVE-2011-10033)

Detects CVE-2011-10033 via is-human/engine.php type=ihoptions;passthruphpinfo;error. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-10033 via is-human/engine.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

D-Link DIR-816 - SystemCommand Command Injection

Exploits DIR-816 /goform/SystemCommand after extracting tokenid from /dirlogin.asp. Command output is not always echoed; uses time-based check then best-effort execute. Prefer writing to a reachable path when possible. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-816 SystemCommand RCE ...

Redis - Lua Sandbox Escape RCE (CVE-2022-0543)

Exploits CVE-2022-0543 on Debian/Ubuntu Redis packages by loading liblua5.1 via package.loadlib inside EVAL and running shell commands through io.popen. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Redis Lua sandbox escape RCE CVE-2022-0543 — opens execute...

ProFTPD - mod_copy CPFR/CPTO Detection (CVE-2015-3306)

Detects CVE-2015-3306 by issuing unauthenticated SITE CPFR /etc/passwd then SITE CPTO /tmp/passwd.copy and matching copy success. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD modcopy unauthenticated SITE CPFR/CPTO CVE-2015-3306.""" import socket from kittysploit import from...

Home Assistant - Supervisor Auth Bypass Info Leak (CVE-2023-27482)

Uses CVE-2023-27482 path-traversal auth bypass to fetch supervisor/core JSON info without credentials. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant Supervisor auth bypass info leak CVE-2023-27482.""" from kittysploit import from...

Apache Tomcat - PUT JSP Upload Detection (CVE-2017-12615/12617)

Detects CVE-2017-12615/12617 by PUT-uploading a JSP via trailing-slash path and verifying execution on GET. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat HTTP PUT JSP upload RCE CVE-2017-12615 / CVE-2017-12617.""" from kittysploit import from lib.protocols.http.httpclient import...

Symantec Web Gateway - pbcontrol.php RCE (CVE-2012-2953)

Exploits CVE-2012-2953 command injection in pbcontrol.php filename. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953 — opens execute session.""" import re from urllib.parse import quote from kittysploit import...

AWStats Totals - sort Parameter RCE Detection (CVE-2008-3922)

Detects CVE-2008-3922 by requesting awstatstotals.php?sort=.phpinfo.exit.$a and matching phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2008-3922 by requesting awstatstotals.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ownCloud graphapi - phpinfo Disclosure Detection (CVE-2023-49103)

ownCloud graphapi exposes vendor test script GetPhpInfo.php, leaking phpinfo output including container environment variables such as OWNCLOUDADMIN CVE-2023-49103 / CVE-2023-49282, CISA KEV. !/usr/bin/env python3 -- coding: utf-8 -- """ownCloud graphapi phpinfo disclosure CVE-2023-49103 /...

Ruby on Rails - Accept Header File Read (CVE-2019-5418)

Reads arbitrary files via CVE-2019-5418 Accept-header path traversal ../../../../file. !/usr/bin/env python3 -- coding: utf-8 -- """Rails Accept-header arbitrary file read CVE-2019-5418.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

ManageEngine DC - agentLogUploader Detection (CVE-2013-7390)

Detects CVE-2013-7390/2014-5007 by POSTing to agentLogUploader and matching X-dc-header: yes. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central agentLogUploader upload CVE-2013-7390.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ManageEngine DC - statusUpdate Upload Detection (CVE-2014-5005)

Detects CVE-2014-5005/5006 by uploading a JSP via statusUpdate LFU path traversal and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Desktop Central statusUpdate arbitrary file upload CVE-2014-5005.""" from kittysploit import from lib.protocols.http.httpclient impo...

FreeSWITCH - /api/system RCE Detection (CVE-2018-19911)

Detects CVE-2018-19911 by requesting /api/system/?id and related paths and looking for uid= in the response. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH unauthenticated /api/system command execution CVE-2018-19911.""" import re from kittysploit import from lib.protocols.http.httpclien...

OpenMRS - REST concept XStream RCE Fingerprint (CVE-2018-19276)

Soft-detects CVE-2018-19276 by POSTing empty body with Content-Type: text/xml to /ws/rest/v1/concept and looking for XStream / unmarshal related errors full RCE check needs outbound ICMP. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS REST concept endpoint XStream RCE fingerprint...

ColdFusion - RDS Auth Bypass Detection (CVE-2013-0632)

Detects CVE-2013-0632 by POSTing adminpassword=&rdsPasswordAllowed=1 to administrator.cfc?method=login and accessing the admin homepage. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

OpenMRS - dataexchange export.form Disclosure Detection (CVE-2020-5732)

Detects OpenMRS unauthenticated data export by POSTing conceptIds=1 to /module/dataexchange/export.form and looking for HTTP 201 with conceptdatatypeid. !/usr/bin/env python3 -- coding: utf-8 -- """OpenMRS dataexchange export.form unauthenticated access CVE-2020-5732...""" from kittysploit import...

GoAhead - ../.x/ Path Traversal Detection (CVE-2014-9707)

Detects CVE-2014-9707 by requesting /../../../.x/.x/.x/.x/.x/.x/etc/passwd style paths on Embedthis GoAhead. !/usr/bin/env python3 -- coding: utf-8 -- """Embedthis GoAhead ../.x/ path traversal CVE-2014-9707.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Express.js - Debug Mode Stack Trace Disclosure

Detects Express apps running with NODEENV=development or similar debug error handlers by sending a GET with Content-Type: application/json and a non-JSON body, then looking for a 400 response that leaks a SyntaxError stack / nodemodules path. !/usr/bin/env python3 -- coding: utf-8 -- """Express.j...

D-Link DWR - /uir Path Traversal Detection (CVE-2017-6190)

Detects CVE-2017-6190 by requesting /uir/../../../../../../etc/passwd ../ traversal after /uir/, distinct from CVE-2018-10822 // style. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR /uir path traversal CVE-2017-6190.""" import re from kittysploit import from lib.protocols.http.httpclien...

NUUO NVRmini 2 - File Upload Detection (CVE-2018-11523)

Detects CVE-2018-11523 by uploading a PHP phpinfo payload to /upload.php and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated PHP upload CVE-2018-11523.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

VMware - SDK Directory Traversal Detection (CVE-2009-3733)

Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2009-3733 via /sdk/ encoded traversal to /etc/passwd on VMware Server/ESX UI port.""" import re from kittysploit import from...

ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)

Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TerraMaster TOS - exportUser.php Command Injection (CVE-2020-15568)

Exploits CVE-2020-15568 by injecting OS commands via /include/exportUser.php func=exec and reading redirected stdout from /include/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS exportUser.php exec RCE CVE-2020-15568 — opens execute...

Unraid OS - Web UI Auth Bypass Detection (CVE-2020-5849)

Detects CVE-2020-5849 by requesting /webGui/images/green-on.png/Settings and looking for authenticated Settings panel markers without login. !/usr/bin/env python3 -- coding: utf-8 -- """Unraid OS 6.8.0 Web UI authentication bypass CVE-2020-5849.""" from kittysploit import from...

TerraMaster TOS - makecvs.php Command Injection (CVE-2020-28187)

Exploits CVE-2020-28187 by writing a temporary PHP webshell via /include/makecvs.php?Event= and executing OS commands. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS makecvs.php Event RCE CVE-2020-28187 — opens execute session.""" import re impo...

Icinga Web 2 - static/img Path Traversal Detection (CVE-2020-24368)

Detects CVE-2020-24368 by reading /etc/passwd via /static/img?modulename=&file=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Icinga Web 2 static/img module path traversal CVE-2020-24368.""" import re from kittysploit import from lib.protocols.http.httpclient import...

RomPager - Misfortune Cookie Detection (CVE-2014-9222)

Detects CVE-2014-9222 by sending Cookie C107373883=/ to /tr069 and matching the token plus RomPager not-found marker. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie CVE-2014-9222.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

TYPO3 - download.php localconf.php Disclosure Detection

Detects TYPO3 fileadmin/download.php LFI reading typo3conf/localconf.php TYPO3CONFVARS / typodbpassword. !/usr/bin/env python3 -- coding: utf-8 -- """Detects TYPO3 fileadmin/download.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Rails - XML YAML Deserialization Detection (CVE-2013-0156)

Detects CVE-2013-0156 by POSTing XML probes string vs yaml Time vs null-byte object to /posts/search and comparing status codes. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization probe CVE-2013-0156.""" from kittysploit import from lib.protocols.http.httpclient...

Beward IP Camera - fileread Disclosure Detection

Detects unauthenticated file disclosure via /cgi-bin/operator/fileread?READ.filePath=/etc/passwd on Beward IP cameras. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera fileread arbitrary file disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link - User-Agent Backdoor Detection (CVE-2013-6026)

Detects CVE-2013-6026 by comparing unauthorized responses with and without User-Agent xmlsetroodkcableoj28840ybtide on thttpd-alphanetworks. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link string-reversed User-Agent backdoor CVE-2013-6026.""" from kittysploit import from...