Technicolor TC7200 Password Disclosure

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zyxel P660HN-T v2 RCE

Remote command execution in Zyxel P660HN-T V2 devices via blind command injection in log settings commands up to 28 characters. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v2 RCE""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Netgear R7000 & R6400 RCE

Module exploits remote command execution in Netgear R7000 and R6400 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear R7000 & R6400 RCE""" from kittysploit import from...

Netgear RAX30 RCE

Module exploits remote command execution in Netgear RAX30 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear RAX30 RCE""" from kittysploit import from...

D-Link DSL-2640B DNS Change

Module exploits D-Link DSL-2640B dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2640B DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

IPFire Proxy RCE

Module exploits IPFire 2.19 Core Update 101 Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Proxy RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Zyxel P660HN-T v1 RCE

Module exploits Remote Command Execution vulnerability in Zyxel P660HN-T v1 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v1 RCE""" from kittysploit import from lib.protocols.http.httpclien...

D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE

Module exploits D-Link DIR-300, DIR-645 and DIR-815 UPNP Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-645 & DIR-815 UPNP RCE""" import socket from kittysploit import from lib.exploit.handler...

Asus Infosvr Backdoor RCE

Module exploits remote command execution in multiple ASUS devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Asus Infosvr Backdoor RCE""" import struct import time import socket from...

TCP-32764 Info Disclosure

Exploits backdoor functionality that allows fetching credentials for administrator user. !/usr/bin/env python3 -- coding: utf-8 -- """TCP-32764 Info Disclosure""" import re import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

Geutebruck G-Cam/EFD-2250 RCE

This module exploits a an arbitrary command execution vulnerability. Thevulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows ananonymous user to execute arbitrary commands with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Geutebruck G-Cam/EFD-2250 RCE"...

BEWARD N100 RCE

BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution.shodan search: WWW-Authenticate: Basic realm="N100 H.264 IP Camera"censys search: services.http.response.headers.wwwauthenticate:"N100 H.264 IP Camera"zoomeye search: "headers:"N100 H.264 IP Camera" !/usr/bin/env python3 -- coding:...

P2P wificam remote code execution

A credential disclosure in several cameras which utilize the GoAhead webserver, combined with an authenticated RCE allows for unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam remote code execution""" from kittysploit import from...

Watchguard XCS Remote Command Execution

Exploits unauthenticated SQL injection and authenticated command injection in Watchguard XCS virtual appliances to gain command execution as nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Watchguard XCS Remote Command Execution""" import hashlib import re from random import randint from...

Movistar ADSL Router BHS_RTA Path Traversal

Module exploits Movistar ADSL Router BHSRTA Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Movistar ADSL Router BHSRTA Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Asmax AR1004G Password Disclosure

Exploits Asmax AR1004G Password Disclosure vulnerability that allows to fetch credentials for: Admin, Support and User accounts. !/usr/bin/env python3 -- coding: utf-8 -- """Asmax AR1004G Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Belkin Play Max Persistent RCE

Module exploits Belkin SSID injection vuln, allowing to execute arbitrary command at every boot. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Play Max Persistent RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient:...

FortiGate OS - SSH Backdoor (Fortimanager_Access)

Authenticates to FortiGate OS 4.x through 5.0.7 using the hard-coded FortimanagerAccess account and interactive SSH challenge response. !/usr/bin/env python3 -- coding: utf-8 -- """FortiGate OS 4.x–5.0.7 SSH backdoor FortimanagerAccess.""" from future import annotations import base64 import hashl...

Router TCP/32764 Backdoor RCE

Exploits the TCP/32764 management backdoor on multiple SOHO routers Linksys, Netgear, Cisco, etc. for unauthenticated OS command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Router TCP/32764 backdoor RCE — opens execute session.""" import struct from kittysploit import from...

IPFire Oinkcode RCE

Module exploits IPFire 2.19 Core Update 110 Remote Code Execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """IPFire Oinkcode RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TP-Link Archer C2 & C20i

Exploits TP-Link Archer C2 and Archer C20i remote code execution vulnerability that allows executing commands on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C2 & C20i""" import time from kittysploit import from...

LG_NAS_3718.510.a0_RCE

Module exploits LG-NAS Storage Remote Command Execution vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """LGNAS3718.510.a0RCE""" import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handl...

3Com OfficeConnect RCE

Module exploits 3Com OfficeConnect remote command execution vulnerability which allows executing command on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """3Com OfficeConnect RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Avigilon VideoIQ Camera Path Traversal

Module exploits Avigilon VideoIQ Camera Path Traversal vulnerability. If target is vulnerable it is possible to read file from file system. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon VideoIQ Camera Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient...

Brickcom Camera Credentials Disclosure

Exploit implementation for miscellaneous Brickcom cameras with 'users.cgi'.Allows remote credential disclosure by low-privilege user. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Camera Credentials Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

TP-Link WDR740ND/WDR740N - Debug Backdoor RCE

Exploits the hidden debug endpoint /userRpm/DebugResultRpm.htm osteam/5up backdoor credentials to run shell commands as root. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND/WDR740N debug backdoor — opens execute session.""" import re from urllib.parse import quote from kittysploit...

Hide Process argv (Python)

Replace process argv0 with an innocuous name on Linux !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process argv Python", "description": "Replace process argv0 with an innocuous nam...

Billion 5200W-T - Remote Command Injection

Unauthenticated or authenticated OS command injection in Billion 5200W-T via advremotelog.asp or toolstime.asp. Spawns utelnetd and opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 5200W-T remote command injection — opens framework shell session.""" from...

Netwave IP Camera Information Disclosure

This exploit will try to retrieve WPA password and ddns host name, Also it would try to read memory leak in order to find username and password !/usr/bin/env python3 -- coding: utf-8 -- """Netwave IP Camera Information Disclosure""" import re from kittysploit import from...

D-Link DSL-2780B & DSL-2730B & DSL-526B DNS Change

Module exploits D-Link DSL-2780B, DSL-2730B and DSL-526B dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2780B & DSL-2730B & DSL-526B DNS Change""" import re from kittysploit import from...

2Wire 4011G & 5012NV Path Traversal

Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire 4011G & 5012NV Path Traversal""" import re from kittysploit import from...

Shuttle 915 WM DNS Change

Module exploits Shuttle Tech ADSL Modem-Router 915 WM dns change vulnerability. If the target is vulnerable it is possible to change dns settings. !/usr/bin/env python3 -- coding: utf-8 -- """Shuttle 915 WM DNS Change""" import re from kittysploit import from lib.protocols.http.httpclient import...

3Com AP8760 Password Disclosure

Exploits 3Com AP8760 password disclosure vulnerability.If the target is vulnerable it is possible to fetch credentials for administration user. !/usr/bin/env python3 -- coding: utf-8 -- """3Com AP8760 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient impo...

Billion 7700NR4 Password Disclosure

Exploits Billion 7700NR4 password disclosure vulnerability that allows to fetch credentials for admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Billion 7700NR4 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass

Module exploits authentication bypass vulnerability in D-Link DIR-300, DIR-320, DIR-615 revD devices. It is possible to access administration panel without providing password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-615 Auth Bypass""" import re from kittysploit...

Zyxel Eir D1000 WiFi Password Disclosure

Module exploits WiFi Password Disclosure vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to read WiFi password. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 WiFi Password Disclosure""" import re from kittysploit import from...

Comtrend CT 5361T Password Disclosure

WiFi router Comtrend CT 5361T suffers from a Password Disclosure Vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Comtrend CT 5361T Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info =...

Cisco Video Surveillance Path Traversal

Module exploits path traversal vulnerability in Cisco Video Surveillance Operations Manager 6.3.2 devices. If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Video Surveillance Path Traversal""" import re from kittysploit...

SIEMENS IP-Camera CCMS2025 Password Disclosure

Module exploits SIEMENS IP-Camera CCMS2025 Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials !/usr/bin/env python3 -- coding: utf-8 -- """SIEMENS IP-Camera CCMS2025 Password Disclosure""" import re from kittysploit import from...

D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure

Module explois information disclosure vulnerability in D-Link DIR-300, DIR-320, DIR-600,DIR-615 devices. It is possible to retrieve sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-320 & DIR-600 & DIR-615 Info Disclosure""" import re fro...

D-Link DIR-645 Password Disclosure

Module exploits D-Link DIR-645 password disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link...

Check VM / Sandbox (Python)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox Python", "description": "Exit early when common VM or sandbox...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

TP-Link WDR842ND configure Disclosure

Module exploits TP-Link WDR842ND configure disclosure vulnerability which allows fetching configure. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR842ND configure Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Technicolor TG784n-v3 Auth Bypass

Module exploits Technicolor TG784n-v3 authentication bypass vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TG784n-v3 Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name':...

Thomson TWG849 Info Disclosure

Module exploits Thomson TWG849 information disclosure vulnerability which allows reading sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Thomson TWG849 Info Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Agent Local Store (Python)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback Python emitter.""" from typing import Any, Dict from kittysploit import from...

Extract Embedded ZIP (Python)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback Python emitter.""" from future import annotations from typing import Any, Dict from kittysploit import from...

Daemonize Process (Zig)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Zig", "description": "Detach from the controlling terminal on Un...