3Com OfficeConnect Info Disclosure

Exploits 3Com OfficeConnect information disclosure vulnerability. If the target is vulnerable it is possible to read sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impor...

Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

Watchguard XCS Remote Command Execution

Exploits unauthenticated SQL injection and authenticated command injection in Watchguard XCS virtual appliances to gain command execution as nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Watchguard XCS Remote Command Execution""" import hashlib import re from random import randint from...

Zyxel P660HN-T v1 RCE

Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T v1 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v1 RCE""" from kittysploit import from lib.protocols.http.httpclien...

P2P wificam remote code execution

A credential disclosure in several cameras which utilize the GoAhead webserver, combined with an authenticated RCE allows for unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam remote code execution""" from kittysploit import from...

Hide Process argv (Python)

Replace process argv0 with an innocuous name on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process argv Python", "description": "Replace process argv0 with an innocuous nam...

Hide Process Title (PowerShell)

Set console title to a benign value before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process Title PowerShell", "description": "Set console title to a benign value befo...

3Com OfficeConnect RCE

Module exploits 3Com OfficeConnect remote command execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link Multi HNAP RCE

Module exploits HNAP remote code execution vulnerability in multiple D-Link devices which allows executing commands on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Multi HNAP RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Linksys E1500/E2500

Module exploits remote command execution in Linksys E1500/E2500 devices. Diagnostics interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E1500/E2500""" import time from kittysploit import...

Cisco UCM Info Disclosure

Module exploits information disclosure vulnerability in Cisco UCM devices. If the target is vulnerable it is possible to read sensitive information through TFTP service. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCM Info Disclosure""" import re from kittysploit import from...

D-Link DIR-300 & DIR-600 RCE

Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-600 RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Netwave IP Camera Information Disclosure

This exploit will try to retrieve WPA password and ddns host name, Also it would try to read memory leak in order to find username and password !/usr/bin/env python3 -- coding: utf-8 -- """Netwave IP Camera Information Disclosure""" import re from kittysploit import from...

Movistar ADSL Router BHS_RTA Path Traversal

Module exploits Movistar ADSL Router BHSRTA Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Movistar ADSL Router BHSRTA Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Shuttle 915 WM DNS Change

Module exploits Shuttle Tech ADSL Modem-Router 915 WM dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """Shuttle 915 WM DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass

Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 revD devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass""" import re from kittysploit...

D-Link DSL-2740R DNS Change

Module exploits D-Link DSL-2740R dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2740R DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

firepower_management60_rce

firepowermanagement60rce !/usr/bin/env python3 -- coding: utf-8 -- """firepowermanagement60rce""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'firepowermanagement60rce', 'description': 'firepowermanagement60rce',...

3Com IMC Path Traversal

Exploits 3Com Intelligent Management Center path traversal vulnerability. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient impor...

TCP-32764 Info Disclosure

Exploits backdoor functionality that allows fetching credentials for administrator user. !/usr/bin/env python3 -- coding: utf-8 -- """TCP-32764 Info Disclosure""" import re import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

Technicolor TG784n-v3 Auth Bypass

Module exploits Technicolor TG784n-v3 authentication bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TG784n-v3 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name':...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

Geutebruck G-Cam/EFD-2250 RCE

This module exploits a an arbitrary command execution vulnerability. Thevulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows ananonymous user to execute arbitrary commands with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Geutebruck G-Cam/EFD-2250 RCE"...

Ubiquiti AirOS 6.x - SSH Key Upload

Path traversal file upload via /login.cgi places an attacker SSH public key into /etc/dropbear/authorizedkeys, enabling login as ubnt. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS 6.x arbitrary file upload to authorizedkeys.""" from future import annotations import io import tempfi...

Zyxel Eir D1000 RCE

Module exploits Remote Command Execution vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 RCE""" from kittysploit import from lib.protocols.http.httpclient...

Router TCP/32764 Backdoor RCE

Exploits the TCP/32764 management backdoor on multiple SOHO routers Linksys, Netgear, Cisco, etc. for unauthenticated OS command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Router TCP/32764 backdoor RCE — opens execute session.""" import struct from kittysploit import from...

Check VM / Sandbox (PowerShell)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox PowerShell", "description": "Exit early when common VM or...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

Extract Embedded ZIP (Python)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback Python emitter.""" from future import annotations from typing import Any, Dict from kittysploit import from...

SIEMENS IP-Camera CCMS2025 Password Disclosure

Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials !/usr/bin/env python3 -- coding: utf-8 -- """SIEMENS IP-Camera CCMS2025 Password Disclosure""" import re from kittysploit import from...

Honeywell IP-Camera HICC-1100PT Password Disclosure

Module exploits Honeywell IP-Camera HICC-1100PT Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP-Camera HICC-1100PT Password Disclosure""" import re from kittysploit import from...

Brickcom Camera Credentials Disclosure

Exploit implementation for miscellaneous Brickcom cameras with 'users.cgi'.Allows remote credential disclosure by low-privilege user. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Camera Credentials Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DGS-1510 Add User

D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28 and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure attacks via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 --...

D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure

Module explois information disclosure vulnerability in D-Link DIR-300, DIR-320, DIR-600,DIR-615 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure""" import re fro...

D-Link DIR-825 Path Traversal

Module exploits D-Link DIR-825 path traversal vulnerability, which allows reading files from the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Cisco DPC2420 Info Disclosure

Module exploits Cisco DPC2420 information disclosure vulnerability which allows reading sensitive information from the configuration file. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco DPC2420 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DSL-2640B DNS Change

Module exploits D-Link DSL-2640B dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2640B DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSL-2750B Info Disclosure

Module explois information disclosure vulnerability in D-Link DSL-2750B devices. It is possible to retrieve sensitive information such as SSID, Wi-Fi password, PIN code. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2750B Info Disclosure""" import re from kittysploit import from...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

2Wire Gateway Auth Bypass

Module exploits 2Wire Gateway authentication bypass vulnerability. If the target is vulnerable link to bypass authentication is provided. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire Gateway Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Huawei HG866 Password Change

Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG866 Password Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

3Com IMC Info Disclosure

Exploits 3Com Intelligent Management Center information disclosure vulnerability that allows to fetch credentials for SQL sa account !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Netgear N300 Auth Bypass

Module exploits authentication bypass vulnerability in Netgear N300 devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear N300 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal

Module exploits Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal""" import re from kittysploit import from...

ACTi ACM-5611 Video Camera RCE

Module exploits ACTi ACM-5611 Video Camera Remote Command Execution Exploit !/usr/bin/env python3 -- coding: utf-8 -- """ACTi ACM-5611 Video Camera RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit,...

D-Link DNS-320L & DIR-327L RCE

Module exploits D-Link DNS-320L, DNS-327L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320L & DIR-327L RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Huawei Router HG532 RCE

Module exploits remote command execution in Huawei Router HG532 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Router HG532 RCE""" from kittysploit import from...

Zyxel P660HN-T v2 RCE

Remote command execution in Zyxel P660HN-T V2 devices via blind command injection in log settings commands up to 28 characters. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v2 RCE""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...