SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM — Detect

Fingerprint / reachability check for SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM !/usr/bin/env python3 -- coding: utf-8 -- r"""Detection for SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM""" from kittysploit import from...

InterSystems IRIS FolderManager Property Injection RCE — Detect

Fingerprint / reachability check for InterSystems IRIS FolderManager Property Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for InterSystems IRIS FolderManager Property Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Plastic SCM 8087 name-only ACL trigger RCE

NameWorkingMode + default ACL: cm trigger create with attacker Path → Process.Start. Requires local cm client; declares plasticuser no password. """Plastic SCM / Unity VCS name-only auth trigger RCE port 8087, cm client.""" from future import annotations import os import subprocess from kittysplo...

SonicWall SMA 1000 pre-auth storedCommunity RCE chain

Filter bypass, enable CMS, apply changes, SSO token, session id, POST configUserCommunityEPC.do with base64 Java gadget set storedcommunityb64. """SonicWall SMA 1000 pre-auth deserialization chain storedCommunity delivery.""" from future import annotations import json import time from kittysploit...

Kerio Connect Server.startEncryption Command Injection Authenticated RCE — Detect

Fingerprint / reachability check for Kerio Connect Server.startEncryption Command Injection Authenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Kerio Connect Server.startEncryption Command Injection Authenticated RCE""" from kittysploit import from...

Vicon Valerus Unauthenticated Command Injection RCE — Detect

Fingerprint / reachability check for Vicon Valerus Unauthenticated Command Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Vicon Valerus Unauthenticated Command Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AdRem NetCrunch Cross-Session Hijack RCE — Detect

Fingerprint / reachability check for AdRem NetCrunch Cross-Session Hijack RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for AdRem NetCrunch Cross-Session Hijack RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Abyss Web Server X1 2.16.22.0 - Missing Authentication for Console Credential Cr — Detect

Fingerprint / reachability check for Abyss Web Server X1 2.16.22.0 - Missing Authentication for Console Credential Creation Reaching a Configuration-Write to Log-as-CGI Command Execution Chain CWE-306, CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Abyss Web Server X1 2.16.22.0...

CIRCUTOR PowerStudio SCADA WAVE JWT alg=none Identity Forgery (Cross-Microservic — Detect

Fingerprint / reachability check for CIRCUTOR PowerStudio SCADA WAVE JWT alg=none Identity Forgery Cross-Microservice Authentication Bypass !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CIRCUTOR PowerStudio SCADA WAVE JWT alg=none Identity Forgery Cross-Microservice Authentication...

Codoforum — Admin Category-Image Polyglot Upload → www-data RCE — Detect

Fingerprint / reachability check for Codoforum — Admin Category-Image Polyglot Upload → www-data RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Codoforum — Admin Category-Image Polyglot Upload → www-data RCE""" from kittysploit import from lib.protocols.http.httpclient import...

DBxtra .NET — Unauthenticated SOAP xp_cmdshell RCE — Detect

Fingerprint / reachability check for DBxtra .NET — Unauthenticated SOAP xpcmdshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for DBxtra .NET — Unauthenticated SOAP xpcmdshell RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Devolutions Server (DVLS) — Bypassable PAM Entitlement Gate Exposes the `test-sc — Detect

Fingerprint / reachability check for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes the test-script PowerShell Sink: Administrator to NT AUTHORITY\SYSTEM !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes...

myDBR — Admin File-Editor PHP Code Injection RCE — Detect

Fingerprint / reachability check for myDBR — Admin File-Editor PHP Code Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for myDBR — Admin File-Editor PHP Code Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xp_cmdshell — Detect

Fingerprint / reachability check for Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xpcmdshell SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Logo Netsis NetOpenX REST 2.0.6.9 — Unauthenticated SQL Injection to xpcmdshell SYSTEM RCE""" from kittysploit...

GE PulseNET Enterprise ResourceFile Path Traversal Unauthenticated RCE — Detect

Fingerprint / reachability check for GE PulseNET Enterprise ResourceFile Path Traversal Unauthenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for GE PulseNET Enterprise ResourceFile Path Traversal Unauthenticated RCE""" from kittysploit import from lib.protocols.http.httpclie...

Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE — Detect

Fingerprint / reachability check for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Apache Struts 2 RestfulActionMapper OGNL Injection Unauthenticated Root RCE""" from kittysploit import from...

ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integ — Detect

Fingerprint / reachability check for ProSoft RLX-IFH24E v2.2.44 - Firmware Upgrade Package Executed Without Any Integrity Check, Reaching Root Command Execution and Full Overwrite of the Account Database CWE-494, CWE-345 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ProSoft RLX-IFH24...

TRENDnet TV-IP302PI NTP address command injection RCE

Authenticated CGI/ONVIF SetNTP: msntp -r sink with semicolon/command substitution in NtpIP / hostname field. """TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78""" from future import annotations from types...

CatDV unauth RMI aaftoolPath root RCE

SSH to target: unauth RMI saveSettings aaftoolPath + web login trigger AAF export. Requires sshkey root on appliance. """CatDV Server Unauthenticated RMI Root RCE""" from future import annotations from kittysploit import import base64 import os import subprocess import sys import time import re...

CIRCUTOR PowerStudio shellExecute SYSTEM RCE

JWT admin PUT reload + SSH upload default.xeve with shellExecute cmd.exe. Requires sshkey to Windows target. """CIRCUTOR PowerStudio SCADA WAVE Unauthenticated shellExecute SYSTEM RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Countersoft Gemini SQL injection xp_cmdshell RCE

After /account/login, stacked SQL in GetCustomFieldValue term enables xpcmdshell Windows, blind marker file. !/usr/bin/env python3 -- coding: utf-8 -- """Countersoft Gemini authenticated SQLi to xpcmdshell RCE.""" from future import annotations import re from urllib.parse import urlencode from...

Cisco CUCM Axis fmService exec stage RCE

Final chain stage: SOAP util:exec on /controlcenterservice/services/fmService with Basic axisauth prior SQLi/webshell stages manual. """Cisco CUCM Remote Code Execution Chain""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

IPConfigure Orchid DNF GPG key rpm --import injection RCE

Authenticated PUT /service/server/properties taints package.dnf.repo.gpgkey; restart runs unquoted rpm --import as root OOB / blind. """IPConfigure Orchid DNF repo GPG key injection root RCE.""" from future import annotations import base64 import json import time from urllib.parse import urlencod...

Jitterbit JdbcEngine SOAP COPY TO PROGRAM RCE

Unauthenticated SOAP startNewSession + dbExecute with embedded PostgreSQL superuser creds runs COPY TO PROGRAM on the agent host. """Jitterbit Agent unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE.""" from future import annotations import base64 import re import time from kittysploit import...

MultiTech Conduit import_config filename command injection RCE

Authenticated POST /api/command/uploadconfig with malicious filename breaks out of importconfig shell quoting. """MultiTech Conduit AEP importconfig filename command injection root RCE.""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclient import...

Opengear NGCS PDU name command injection

Administrator POST /api/v2/pdus with injected pdu.name breaks out of ogpower -n quoting; io.popen runs attacker command as root. !/usr/bin/env python3 -- coding: utf-8 -- """Opengear NGCS PDU name field command injection authenticated root.""" from future import annotations import json import re...

Rainbowfish PacsOne STOW-RS SOP Instance UID traversal RCE

Authenticated STOW-RS with traversing SOP Instance UID writes PHP under web root; invoke via ?c= for command execution reverse shell via set payload. """PacsOne Server 7.3.9 - Path Traversal in the DICOMweb STOW-RS Store Path CWE-22""" from future import annotations from kittysploit import from...

RoboTask REST API unauthenticated task execution

RoboTask REST API default port 9999 with RestUseApiKeys=0 accepts unauthenticated POST /api/tasks/id/run and executes preconfigured task actions with the RoboTask service privilege. !/usr/bin/env python3 -- coding: utf-8 -- """RoboTask REST API unauthenticated remote task execution CWE-306.""" fr...

Wavestore VMS venusd /simple/export command injection RCE

Authenticated venusd /simple/export user=install$cmd runs as root via command substitution default creds install:a on port 8443 plain HTTP. """Wavestore VMS venusd /simple/export command injection root.""" from future import annotations import base64 import re import socket import ssl from...

ActFax LPD Ghostscript %pipe% SYSTEM RCE

Unauthenticated LPD receive-job delivers PostScript with %pipe% cmd execution. """ActFax Unauthenticated LPD Ghostscript %pipe% SYSTEM RCE""" from future import annotations from kittysploit import import socket import sys import time import re import os import socket import sys import time class...

core-admin escape_param shell injection (bytecode sink)

Loads product security.pyc/command.pyc to craft shell metacharacters for configured sink templates local bytecode lab; use product UI/API on target. """core-admin — Systemic Shell Command Injection via Ineffective Quote Escaping → Authenticated Root RCE""" from future import annotations from...

Joget JasperReports jrxml expression injection RCE

POST plugin service with malicious userview JSON embeds jrxml Runtime.exec in JasperReportsMenu report compilation. """Joget Enterprise JasperReports jrxml expression injection RCE.""" from future import annotations import json import re from urllib.parse import urlencode from kittysploit import...

LogicalDOC automation Velocity sandbox bypass RCE

Requires DB routine/trigger on folder 4 ldautomation FROMBASE64. REST login + document upload triggers automation. """LogicalDOC automation Velocity sandbox bypass document upload RCE.""" from future import annotations import base64 import time import uuid from kittysploit import from...

Microsip ASD — Unauthenticated UNC Binary-Planting RCE — Detect

Fingerprint / reachability check for Microsip ASD — Unauthenticated UNC Binary-Planting RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Microsip ASD — Unauthenticated UNC Binary-Planting RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Delta DIAEnergie IEMS — Authenticated CommandTag SQL Injection → VBScript → RCE

Delta DIAEnergie IEMS — Authenticated CommandTag SQL Injection → VBScript → RCE """Delta DIAEnergie IEMS — Authenticated CommandTag SQL Injection → VBScript → RCE""" from future import annotations from kittysploit import import os, sys, socket, hashlib, base64, time import time import re import...

Circutor LineEds 24.11.14 — Unauthenticated shellExecute Command Injection in th — Detect

Fingerprint / reachability check for Circutor LineEds 24.11.14 — Unauthenticated shellExecute Command Injection in the pwrstudio Event Engine Root Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Circutor LineEds 24.11.14 — Unauthenticated shellExecute Command Injectio...

Lantronix SGX5150 FsBrowseClean command injection root RCE

Authenticated POST ajax=FsBrowseClean with path=x'\n breaks out of ltrxusbumount shell quoting. """Lantronix SGX5150 FsBrowseClean newline command injection root RCE.""" from future import annotations import base64 import re from urllib.parse import urlencode from kittysploit import from...

Lansweeper LicenseActions second-order SQLi RCE

Authenticated addsqlserver stores malicious Name; getsqlservers triggers second-order SQL injection and xpcmdshell. !/usr/bin/env python3 -- coding: utf-8 -- """Lansweeper LicenseActions second-order SQLi to xpcmdshell RCE.""" from future import annotations import json import re import time from...

CFEngine Hub VCS gitServer injection RCE

OAuth2 admin token then POST /api/vcs/settings injects $cmd into params.sh; execution when masterfiles-stage.sh is sourced hub deploy/cf-agent. !/usr/bin/env python3 -- coding: utf-8 -- """CFEngine Nova Hub VCS settings gitServer command injection.""" from future import annotations import json...

StreamSets Transformer auth none ScalaDTransform RCE

Unauthenticated /rest/v1 pipeline API: ScalaDTransform stage runs sh -c with attacker command http.authentication=none. """StreamSets Transformer auth none ScalaDTransform anonymous RCE.""" from future import annotations import json import time import uuid from kittysploit import from...

Laquis SCADA unauth uploade CMDEXT DLL autoload RCE

Unauthenticated POST /uploade.html writes CMDEXT.DLL; optional GET /reset.html forces restart so mili loads the DLL DllMain runs on attach. """LCDS Laquis SCADA — Unauthenticated /uploade.html File Write + Startup CMDEXT.DLL Autoload = Pre-Auth RCE CVSS 9.8""" from future import annotations impor...

Syncrify PublicLink chunk upload traversal cron root RCE

Backup user PublicLink auth then binary chunk upload st=u with traversing chunk name writes /etc/cron.d/. """Syncrify PublicLink chunk upload path traversal cron root RCE.""" from future import annotations import re import struct import time from urllib.parse import quote from kittysploit import...

Raritan EMX port_mux config injection root RCE

Login → download config → inject protolistenerhttp program=/bin/sh → upload → TCP connect triggers execv as root. """Raritan EMX authenticated portmux protolistener config injection root RCE.""" from future import annotations import re import socket import time import uuid from urllib.parse impor...

nanoDLP Unauthenticated Root RCE via G-code Injection — Detect

Fingerprint / reachability check for nanoDLP Unauthenticated Root RCE via G-code Injection !/usr/bin/env python3 -- coding: utf-8 -- """Detection for nanoDLP Unauthenticated Root RCE via G-code Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ZesleCP admin file write cron root RCE

Admin POST /file-manager/save-file writes /etc/cron.d/ as root; crond executes attacker command. !/usr/bin/env python3 -- coding: utf-8 -- """ZesleCP admin arbitrary file write to /etc/cron.d root RCE.""" from future import annotations import json import re import time from kittysploit import fro...

AdRem NetCrunch cross-session hijack startup RCE

Use victim sid@gid with unauthenticated attacker session x-sid to call SetScriptOptions + RestartNCServer. """AdRem NetCrunch Cross-Session Hijack RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient from concurrent.futures import...

mySCADA PRO Runtime — Unauthenticated `upgrade` Branch Command Injection → Root — Detect

Fingerprint / reachability check for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE""" from kittysploit import from...

PacsOne Server 7.3.9 - Path Traversal in the DICOMweb STOW-RS Store Path (CWE-22 — Detect

Fingerprint / reachability check for PacsOne Server 7.3.9 - Path Traversal in the DICOMweb STOW-RS Store Path CWE-22 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for PacsOne Server 7.3.9 - Path Traversal in the DICOMweb STOW-RS Store Path CWE-22""" from kittysploit import from...

Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE — Detect

Fingerprint / reachability check for Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Jitterbit Agent Unauthenticated SOAP JdbcEngine COPY TO PROGRAM RCE""" from kittysploit import from lib.protocols.http.httpclient...

Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xp_cmdshell RCE — Detect

Fingerprint / reachability check for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE""" from kittysploit import from lib.protocols.http.httpclient impor...