Linksys WRT100/WRT110 RCE

Module exploits remote command execution in Linksys WRT100/WRT110 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WRT100/WRT110 RCE""" from kittysploit import from...

AsusWRT Lan RCE

Module exploits multiple vulnerabilities to achieve remote code execution in AsusWRT firmware. The HTTP server contains vulnerability that allows bypass authentication via POST requests. Combining this with another vulnerability in the VPN configuration upload functionality allows setting NVRAM...

Hide Process Title (PowerShell)

Set console title to a benign value before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process Title PowerShell", "description": "Set console title to a benign value befo...

Hide Process argv (Python)

Replace process argv0 with an innocuous name on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process argv Python", "description": "Replace process argv0 with an innocuous nam...

Check VM / Sandbox (Python)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox Python", "description": "Exit early when common VM or sandbox...

Check VM / Sandbox (Zig)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox Zig", "description": "Exit early when common VM or sandbox...

Belkin N750 RCE

Module exploits Belkin N750 Remote Code Execution vulnerability which allows executing commands on operation system level. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin N750 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import...

Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Watchguard XCS Remote Command Execution

Exploits unauthenticated SQL injection and authenticated command injection in Watchguard XCS virtual appliances to gain command execution as nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Watchguard XCS Remote Command Execution""" import hashlib import re from random import randint from...

3Com OfficeConnect Info Disclosure

Exploits 3Com OfficeConnect information disclosure vulnerability. If the target is vulnerable it is possible to read sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impor...

Cisco UCM Info Disclosure

Module exploits information disclosure vulnerability in Cisco UCM devices. If the target is vulnerable it is possible to read sensitive information through TFTP service. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCM Info Disclosure""" import re from kittysploit import from...

D-Link DIR-300 & DIR-600 RCE

Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-600 RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Netwave IP Camera Information Disclosure

This exploit will try to retrieve WPA password and ddns host name, Also it would try to read memory leak in order to find username and password !/usr/bin/env python3 -- coding: utf-8 -- """Netwave IP Camera Information Disclosure""" import re from kittysploit import from...

D-Link Hedwig CGI RCE

Module exploits buffer overflow vulnerablity in D-Link Hedwig CGI component, which leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Hedwig CGI RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Movistar ADSL Router BHS_RTA Path Traversal

Module exploits Movistar ADSL Router BHSRTA Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Movistar ADSL Router BHSRTA Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Shuttle 915 WM DNS Change

Module exploits Shuttle Tech ADSL Modem-Router 915 WM dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """Shuttle 915 WM DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass

Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 revD devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass""" import re from kittysploit...

D-Link DSL-2740R DNS Change

Module exploits D-Link DSL-2740R dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2740R DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

firepower_management60_rce

firepowermanagement60rce !/usr/bin/env python3 -- coding: utf-8 -- """firepowermanagement60rce""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'firepowermanagement60rce', 'description': 'firepowermanagement60rce',...

3Com IMC Path Traversal

Exploits 3Com Intelligent Management Center path traversal vulnerability. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient impor...

TCP-32764 Info Disclosure

Exploits backdoor functionality that allows fetching credentials for administrator user. !/usr/bin/env python3 -- coding: utf-8 -- """TCP-32764 Info Disclosure""" import re import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

Technicolor TG784n-v3 Auth Bypass

Module exploits Technicolor TG784n-v3 authentication bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TG784n-v3 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name':...

MVPower DVR Jaws RCE

Module exploits MVPower DVR Jaws RCE vulnerability through 'shell' resource.Successful exploitation allows remote unauthorized attacker to execute commands on operating system level. Vulnerablity was actively used by IoT Reaper botnet. !/usr/bin/env python3 -- coding: utf-8 -- """MVPower DVR Jaws...

Geutebruck G-Cam/EFD-2250 RCE

This module exploits a an arbitrary command execution vulnerability. Thevulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows ananonymous user to execute arbitrary commands with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Geutebruck G-Cam/EFD-2250 RCE"...

Ubiquiti AirOS 6.x - SSH Key Upload

Path traversal file upload via /login.cgi places an attacker SSH public key into /etc/dropbear/authorizedkeys, enabling login as ubnt. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS 6.x arbitrary file upload to authorizedkeys.""" from future import annotations import io import tempfi...

Zyxel Eir D1000 RCE

Module exploits Remote Command Execution vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 RCE""" from kittysploit import from lib.protocols.http.httpclient...

Router TCP/32764 Backdoor RCE

Exploits the TCP/32764 management backdoor on multiple SOHO routers Linksys, Netgear, Cisco, etc. for unauthenticated OS command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Router TCP/32764 backdoor RCE — opens execute session.""" import struct from kittysploit import from...

Check VM / Sandbox (PowerShell)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox PowerShell", "description": "Exit early when common VM or...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

Extract Embedded ZIP (Python)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback Python emitter.""" from future import annotations from typing import Any, Dict from kittysploit import from...

SIEMENS IP-Camera CCMS2025 Password Disclosure

Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials !/usr/bin/env python3 -- coding: utf-8 -- """SIEMENS IP-Camera CCMS2025 Password Disclosure""" import re from kittysploit import from...

Honeywell IP-Camera HICC-1100PT Password Disclosure

Module exploits Honeywell IP-Camera HICC-1100PT Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP-Camera HICC-1100PT Password Disclosure""" import re from kittysploit import from...

Brickcom Camera Credentials Disclosure

Exploit implementation for miscellaneous Brickcom cameras with 'users.cgi'.Allows remote credential disclosure by low-privilege user. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Camera Credentials Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DGS-1510 Add User

D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28 and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure attacks via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 --...

D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure

Module explois information disclosure vulnerability in D-Link DIR-300, DIR-320, DIR-600,DIR-615 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure""" import re fro...

D-Link DIR-825 Path Traversal

Module exploits D-Link DIR-825 path traversal vulnerability, which allows reading files from the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-825 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Cisco DPC2420 Info Disclosure

Module exploits Cisco DPC2420 information disclosure vulnerability which allows reading sensitive information from the configuration file. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco DPC2420 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

D-Link DSL-2640B DNS Change

Module exploits D-Link DSL-2640B dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2640B DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DSL-2750B Info Disclosure

Module explois information disclosure vulnerability in D-Link DSL-2750B devices. It is possible to retrieve sensitive information such as SSID, Wi-Fi password, PIN code. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2750B Info Disclosure""" import re from kittysploit import from...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

2Wire Gateway Auth Bypass

Module exploits 2Wire Gateway authentication bypass vulnerability. If the target is vulnerable link to bypass authentication is provided. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire Gateway Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Huawei HG866 Password Change

Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG866 Password Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

3Com IMC Info Disclosure

Exploits 3Com Intelligent Management Center information disclosure vulnerability that allows to fetch credentials for SQL sa account !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Netgear N300 Auth Bypass

Module exploits authentication bypass vulnerability in Netgear N300 devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear N300 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Miele Professional PG 8528 Path Traversal

Module exploits Miele Professional PG 8528 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Miele Professional PG 8528 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal

Module exploits Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear WNR500/WNR612v3/JNR1010/JNR2010 Path Traversal""" import re from kittysploit import from...

ACTi ACM-5611 Video Camera RCE

Module exploits ACTi ACM-5611 Video Camera Remote Command Execution Exploit !/usr/bin/env python3 -- coding: utf-8 -- """ACTi ACM-5611 Video Camera RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit,...

Grandstream GXV3611 HD - Telnet SQL Injection

SQL injection in the Grandstream GXV3611 HD telnet login resets the admin password to 'a', triggers the !/ port lol backdoor on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet SQLi — opens framework shell session.""" impo...

D-Link DNS-320L & DIR-327L RCE

Module exploits D-Link DNS-320L, DNS-327L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320L & DIR-327L RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...