Windows Upgrade Cmd to PowerShell

Enable PowerShell on a Windows shell session: wrap the current session same or open a new PowerShell reverse-TCP session new. !/usr/bin/env python3 -- coding: utf-8 -- """ Switch a Windows cmd.exe shell session to PowerShell. Modes: - same: wrap commands on the current session with powershell...

Adaptive Reverse TCP Listener

Reverse TCP listener that probes OS on connect and auto-upgrades Unix shells to PTY. Windows stays in line mode. !/usr/bin/env python3 -- coding: utf-8 -- """Adaptive reverse TCP listener. Detects OS on connect, attempts Unix PTY upgrade, stamps session metadata so classicshell / post modules can...

SharkNinja Robot Vacuum AWS IoT Exec_Command RCE

Remote command execution on SharkNinja internet-connected robot vacuums via AWS IoT Core MQTT device shadows. A misconfigured device certificate can authenticate to the regional broker and publish desired.ExecCommand to $aws/things//shadow/update; appd executes the string with popen. Requires...

Windows PowerShell CLM Bypass (TEMP redirect)

Bypass PowerShell Constrained Language Mode by launching a child powershell.exe with TEMP/TMP redirected to an AppLocker-allowed path default C:\Windows\Temp. PowerShell probes AppLocker script rules via a temp script; an allowed TEMP yields FullLanguage. !/usr/bin/env python3 -- coding: utf-8 --...

vBulletin runMaths Pre-Auth RCE (CVE-2026-61511)

Unauthenticated RCE via vB5TemplateRuntime::runMaths eval injection. Crafted pagenavpagenumber reaches vb:math through ajax/render/pagenav; phpfuck-style encoding bypasses the character whitelist to call system. Affects vBulletin = 6.2.1 / = 6.1.6 and 5.x through 5.7.5. !/usr/bin/env python3 --...

vBulletin runMaths Pre-Auth RCE Detection (CVE-2026-61511)

Detects unauthenticated RCE via vB5TemplateRuntime::runMaths CVE-2026-61511 by sending a safe phpfuck-encoded system'echo …' probe to ajax/render/pagenav. Affects vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 fixed in 6.2.2 / vendor patches. !/usr/bin/env python3 -- coding: utf-8 -- from...

Zig Kitty Agent HTTP Polling (Linux)

Compiled Zig Kitty implant: typed tasks over HTTP polling shell/ls/pwd/whoami/cat/download/upload/exit. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Zig Kitty HTTP polling implant Linux.""" from kittysploit import from...

LDAP AdminCount Accounts

Lists accounts with adminCount=1 AdminSDHolder / protected groups NetExec: nxc ldap -u -p --admin-count. !/usr/bin/env python3 -- coding: utf-8 -- """List adminCount=1 accounts NetExec: nxc ldap --admin-count.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

SMB Backup Operator Hive Dump

Uses Backup Operators-capable credentials to save SAM/SYSTEM/SECURITY hives via reg save over SMB exec, then downloads them NetExec backupoperator inspired. Optional secretsdump if impacket is installed. Does not dump NTDS.dit online — use a shell VSS module for full NTDS. !/usr/bin/env python3 -...

LDAP Active Users

Lists enabled not ACCOUNTDISABLE domain users for spray targeting NetExec: nxc ldap -u -p --active-users. !/usr/bin/env python3 -- coding: utf-8 -- """List enabled/active domain users NetExec: nxc ldap --active-users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient fro...

LDAP Query

Runs a raw LDAP filter and dumps matching attributes NetExec: nxc ldap -u -p --query 'sAMAccountName=user' ''. !/usr/bin/env python3 -- coding: utf-8 -- """Raw LDAP query NetExec: nxc ldap --query.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class ModuleAuxiliary,...

MSSQL Priv / Impersonate Check

Reports whether the session user is sysadmin and which logins can be impersonated NetExec: -M mssqlpriv / enumimpersonate. !/usr/bin/env python3 -- coding: utf-8 -- """MSSQL privilege / impersonation check on an active session.""" from kittysploit import from lib.protocols.mssql.mssqlclient impor...

LDAP Enum Users

Lists domain users with pwdLastSet and badPwdCount NetExec: nxc ldap -u -p --users. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate domain users NetExec: nxc ldap --users.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from lib.protocols.ldap.adenum import...

LDAP Group Members

List members of a group, or groups for a user NetExec: --groups 'Backup Operators' / -M groupmembership. !/usr/bin/env python3 -- coding: utf-8 -- """Group membership helpers NetExec: --groups / groupmembership.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient from...

LDAP Auth Check

Validates domain credentials with an LDAP bind and reports domain / DC info NetExec: nxc ldap -u -p . !/usr/bin/env python3 -- coding: utf-8 -- """Validate domain credentials over LDAP NetExec: nxc ldap host -u -p.""" from kittysploit import from lib.protocols.ldap.adclient import Adclient class...

LDAP Force Change Password

Resets a target user's password using LDAP unicodePwd requires LDAPS and ForceChangePassword / reset rights — NetExec: -M change-password. !/usr/bin/env python3 -- coding: utf-8 -- """Force-change a user password via LDAP ForceChangePassword ACL / NetExec change-password.""" from kittysploit impo...

Zig Kitty Agent HTTP Polling (Windows)

Compiled Zig Kitty implant: typed tasks over HTTP polling shell/ls/pwd/whoami/cat/download/upload/exit. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Zig Kitty HTTP polling implant Windows.""" from kittysploit import from...

MSSQL xp_cmdshell

Optionally impersonate a login e.g. sa, enable xpcmdshell, and execute an OS command NetExec: EXECUTE AS + spconfigure + xpcmdshell. !/usr/bin/env python3 -- coding: utf-8 -- """Enable xpcmdshell and run OS commands NetExec MSSQL xpcmdshell chain.""" from kittysploit import from...

MSSQL Enum Impersonate

Lists logins the current SQL user can EXECUTE AS NetExec: nxc mssql -M enumimpersonate. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate MSSQL impersonation rights NetExec: -M enumimpersonate.""" from future import annotations from kittysploit import class ModuleAuxiliary: info = "name":...

SMB Enable RDP

Enables or disables Remote Desktop by setting fDenyTSConnections via remote command execution over SMB NetExec: -M rdp -o ACTION=enable. Requires impacket for SCM exec. !/usr/bin/env python3 -- coding: utf-8 -- """Enable or disable RDP remotely via SMB command execution NetExec: -M rdp.""" from...

Web Device APIs Probe

Probe WebUSB, WebSerial and WebBluetooth availability and optionally request devices from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Web Device APIs Probe", "description": "Probe WebUSB, WebSerial and WebBluetooth availability and optionally request devices",...

RDP Encryption Enumeration

Negotiates RDP security protocols and reports SSL / CredSSP NLA / RDSTLS selection NSE rdp-enum-encryption. !/usr/bin/env python3 -- coding: utf-8 -- """RDP encryption / NLA negotiation enum NSE rdp-enum-encryption.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

HTTP NTLM Info

Sends an NTLM Type-1 negotiate and parses the Type-2 challenge for NetBIOS / DNS domain and computer names NSE http-ntlm-info. !/usr/bin/env python3 -- coding: utf-8 -- """HTTP NTLM challenge info NSE http-ntlm-info.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Linux x86 Reverse TCP Stager

Position-independent x86 Linux reverse TCP shellcode socket+connect+dup2+/bin/sh from kittysploit import class ModulePayload: """Linux x86 reverse TCP stager connect + dup2 + execve /bin/sh.""" info = "name": "Linux x86 Reverse TCP Stager", "description": "Position-independent x86 Linux reverse T...

Tabnabbing

When the tab becomes hidden, swap title/favicon and optional replaceState URL for phishing from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Tabnabbing", "description": "When the tab becomes hidden, swap title/favicon and optional replaceSta...

Fake Cookie Consent

Display a fake GDPR/cookie consent banner that harvests email and consent choices from kittysploit import import json import uuid class ModuleBrowserAuxiliary: info = "name": "Fake Cookie Consent", "description": "Display a fake GDPR/cookie consent banner that harvests email and consent choices",...

Frame Ancestors / Breakout Probe

Detect framing context, ancestor origins, sandboxing, and breakout/clickjacking signals from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Frame Ancestors / Breakout Probe", "description": "Detect framing context, ancestor origins, sandboxing, and...

Windows x64 Meterpreter/Stage Reverse TCP Stager

x64 reverse TCP stager: connect, read 4-byte LE size + stage, VirtualAlloc RWX and jump. Use with a stage pusher or pair stagemode=shell for embedded cmd.exe stage. Listener: listeners/multi/meterpreterreversetcp or reversetcp for shell mode. from kittysploit import import base64 import struct...

PowerShell Command Shell, Reverse HTTPS (TLS)

Connect back over TLS SslStream and create an interactive command shell. No native reversehttps listener — terminate TLS on the operator side stunnel, openssl sserver, etc. and forward plaintext to listeners/multi/reversetcp, or use listeners/multi/reversetls for native TLS termination...

IPMI Version

Probes IPMI/RMCP Get Channel Authentication Capabilities on UDP/623 NSE ipmi-version. !/usr/bin/env python3 -- coding: utf-8 -- """IPMI version fingerprint NSE ipmi-version.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.ipmi.detectors...

NFS Showmount

Queries the MOUNT daemon via portmap for NFS export lists NSE nfs-showmount. !/usr/bin/env python3 -- coding: utf-8 -- """NFS showmount / export list NSE nfs-showmount.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nfs.detectors import...

TFTP Enum

Attempts TFTP RRQ for common config/boot filenames NSE tftp-enum. !/usr/bin/env python3 -- coding: utf-8 -- """TFTP common-file enum NSE tftp-enum.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.tftp.detectors import probetftpenum class...

SMB OS Discovery

Discovers OS / LAN Manager / domain hints from SMB negotiate and anonymous session setup NSE smb-os-discovery. !/usr/bin/env python3 -- coding: utf-8 -- """SMB OS / domain discovery NSE smb-os-discovery.""" from kittysploit import from lib.protocols.smb.smbscannerclient import Smbscannerclient...

BusyBox / ash Reverse TCP

Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux from kittysploit import class ModulePayload: CLIENTLANGUAGE = "sh" info = "name": "BusyBox / ash Reverse TCP", "description": "Minimal reverse TCP shell for BusyBox/ash IoT, containers, embedded Linux", "category":...

Windows HTA / mshta Reverse TCP

HTA payload launched via mshta.exe; VBS drops/compiles a C reverse shell with csc.exe no powershell.exe required from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "hta" info = "name": "Windows HTA / mshta Reverse TCP", "description": "HTA payload launched via mshta.exe;...

Windows VBScript Reverse TCP (csc on-box)

VBScript/cscript delivery vector: writes a tiny C reverse shell, compiles with csc.exe .NET Framework, and runs it — no powershell.exe from kittysploit import import base64 class ModulePayload: CLIENTLANGUAGE = "vbscript" info = "name": "Windows VBScript Reverse TCP csc on-box", "description":...

DNS Subdomain Brute

Brute-forces common subdomain labels against a target nameserver NSE dns-brute. !/usr/bin/env python3 -- coding: utf-8 -- """DNS subdomain brute NSE dns-brute.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.dns.detectors import...

DNS Cache Snoop

Sends non-recursive queries for popular names; answers imply the resolver has them cached NSE dns-cache-snoop. !/usr/bin/env python3 -- coding: utf-8 -- """DNS cache snooping NSE dns-cache-snoop.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

DNS Recursion Available

Checks whether a DNS server answers recursive queries for third-party names open resolver risk — NSE dns-recursion. !/usr/bin/env python3 -- coding: utf-8 -- """DNS recursion check NSE dns-recursion.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

DNS SRV Enumeration

Enumerates common SRV records LDAP, Kerberos, SIP, XMPP, Autodiscover for a domain via a target nameserver NSE dns-srv-enum. !/usr/bin/env python3 -- coding: utf-8 -- """DNS SRV record enumeration NSE dns-srv-enum.""" from kittysploit import from lib.protocols.ics.icsscannerclient import...

RMI Dump Registry

Performs a JRMP handshake against a Java RMI registry and extracts bound names when present NSE rmi-dumpregistry. !/usr/bin/env python3 -- coding: utf-8 -- """Java RMI registry dump NSE rmi-dumpregistry.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient fr...

IPMI Cipher Zero

Checks whether IPMI 2.0 accepts RMCP+ Open Session with cipher suite 0 CVE-2013-4782 authentication bypass — NSE ipmi-cipher-zero. !/usr/bin/env python3 -- coding: utf-8 -- """IPMI cipher zero auth bypass NSE ipmi-cipher-zero.""" from kittysploit import from lib.protocols.ics.icsscannerclient...

NetBIOS NBSTAT

Queries NetBIOS node status UDP/137 for registered names and MAC NSE nbstat. !/usr/bin/env python3 -- coding: utf-8 -- """NetBIOS node status NSE nbstat.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.netbios.detectors import probenbsta...

Python MQTT Reverse Shell

Connect to an MQTT broker, subscribe to cmd topic, publish results stdlib MQTT 3.1.1 — no paho required on target. Pairs with listeners/iot/reversemqttshell. from kittysploit import from lib.c2.mqttreverseagent import buildmqttreverseagentscript class ModulePayload: """MQTT reverse shell agent —...

PowerShell DNS Reverse Shell

Poll DNS TXT for commands and exfil output via result subdomain queries raw UDP DNS — custom nameserver IP:port. Pairs with listeners/covert/dns. from kittysploit import import base64 from lib.c2.dnsreverseagent import buildpowershelldnsagentscript class ModulePayload: """PowerShell DNS TXT polli...

PowerShell HTTP Polling Beacon

Native PowerShell HTTP polling implant compatible with listeners/multi/reversehttppolling jitter, kill date, working hours, cover traffic from kittysploit import import base64 from lib.c2.beaconprofile import BeaconProfile from lib.c2.powershellhttppolling import buildpowershellhttppollingscript...

SSH Auth Methods

Lists SSH user-authentication methods offered for a username NSE ssh-auth-methods. Requires Paramiko. !/usr/bin/env python3 -- coding: utf-8 -- """SSH authentication methods NSE ssh-auth-methods.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

SSH Host Key

Retrieves the SSH host key type and MD5/SHA256 fingerprints NSE ssh-hostkey. Requires Paramiko. !/usr/bin/env python3 -- coding: utf-8 -- """SSH host key fingerprints NSE ssh-hostkey.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Persistent Formjacking

Hook existing and dynamically added forms via MutationObserver and exfiltrate submissions from kittysploit import import json import time import uuid class ModuleBrowserAuxiliary: info = "name": "Persistent Formjacking", "description": "Hook existing and dynamically added forms via MutationObserv...

Web Command Shell (ASP / ASPX / JSP)

Generate a minimal web command shell for upload/write after web RCE. Pairs with listeners/web/php style interaction or generic HTTP. Default: password-protected cmd execution via GET/POST param. from kittysploit import class ModulePayload: """Web command shells for ASP/ASPX/JSP RCE chains.""" inf...