TP-Link Archer C9 admin password reset (CVE-2017-11519)

Module exploits TP-Link Archer C9 password reset feature by leveraging a predictable random number generator seed. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer C9 admin password reset CVE-2017-11519""" import json import re from kittysploit import from lib.protocols.http.httpclient...

P2P wificam credential disclosure

A credential disclosure in several cameras which utilize the GoAhead webserver. !/usr/bin/env python3 -- coding: utf-8 -- """P2P wificam credential disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name'...

Cisco RV320 Command Injection

Module exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320 Command Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Check VM / Sandbox (PowerShell)

Exit early when common VM or sandbox indicators are detected !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "checkvm" info = "name": "Check VM / Sandbox PowerShell", "description": "Exit early when common VM or...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

Linksys E1500/E2500

Module exploits remote command execution in Linksys E1500/E2500 devices. Diagnostics interface allows executing root privileged shell commands is available on dedicated web pages on the device. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E1500/E2500""" import time from kittysploit import...

Asus RT-N16 Password Disclosure

Module exploits password disclosure vulnerability in Asus RT-N16 devices that allows to fetch credentials for the device. !/usr/bin/env python3 -- coding: utf-8 -- """Asus RT-N16 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Netgear ProSafe RCE

Module exploits remote command execution vulnerability in Netgear ProSafe WC9500, WC7600, WC7520 devices. If the target is vulnerable command shell is invoked. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear ProSafe RCE""" import re import json from kittysploit import from...

D-Link Multi HNAP RCE

Module exploits HNAP remote code execution vulnerability in multiple D-Link devices which allows executing commands on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link Multi HNAP RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Cisco Firepower Management 6.0 Path Traversal

Module exploits Cisco Firepower Management 6.0 Path Traversal vulnerability. If the target is vulnerable, it is possible to retrieve content of the arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Firepower Management 6.0 Path Traversal""" import re from kittysploit import from...

D-Link DCS Cameras Authentication Bypass

D-Link DCS web cameras allow unauthenticated attackers to obtain the configuration of the device remotely. A copy of the device configuration can be obtained by accessing unprocteted URL. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS Cameras Authentication Bypass""" import re from...

Hide Process Title (PowerShell)

Set console title to a benign value before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "hideargv" info = "name": "Hide Process Title PowerShell", "description": "Set console title to a benign value befo...

D-Link DGS-1510 Add User

D-Link DGS-1510-28XMP, DGS-1510-28X, DGS-1510-52X, DGS-1510-52, DGS-1510-28P, DGS-1510-28 and DGS-1510-20 Websmart devices with firmware before 1.31.B003 allow attackers to conduct Unauthenticated Information Disclosure attacks via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 --...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

3Com IMC Path Traversal

Exploits 3Com Intelligent Management Center path traversal vulnerability. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """3Com IMC Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient impor...

ZTE ZXHN H108N Wifi Password Disclosure

Module exploits ZTE ZXHN H108N WiFi Password Disclosure vulnerability that allows to retrieve password for wifi connection. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXHN H108N Wifi Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Belkin G Info Disclosure

Module exploits Belkin Wireless G Plus MIMO Router F5D9230-4 information disclosure vulnerability which allows fetching sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin G Info Disclosure""" import re from kittysploit import from...

XiongMai UC-HTTPd Path Traversal

Module exploits UC-HTTPd Path Traversal vulnerability in multiple XiongMai cameras. If target is vulnerable it is possible to list directories and read files from the file system. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai UC-HTTPd Path Traversal""" import re from kittysploit import fr...

DVR Creds Disclosure

Module exploits authentication bypass vulnerability in multiple DVR devices allowing attacker to retrieve users credentials. !/usr/bin/env python3 -- coding: utf-8 -- """DVR Creds Disclosure""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Linksys WRT100/WRT110 RCE

Module exploits remote command execution in Linksys WRT100/WRT110 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys WRT100/WRT110 RCE""" from kittysploit import from...

Cisco UCM Info Disclosure

Module exploits information disclosure vulnerability in Cisco UCM devices. If the target is vulnerable it is possible to read sensitive information through TFTP service. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCM Info Disclosure""" import re from kittysploit import from...

Cisco Unified Multi Path Traversal

Module exploits path traversal vulnerability in Cisco Unified Communications Manager, Cisco Unified Contact Center Express and Cisco Unified IP Interactive Voice Response devices.If the target is vulnerable it allows to read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 --...

Netgear Multi Password Disclosure

Module exploits Password Disclosure vulnerability in multiple Netgear devices. If target is vulnerable administrator's password is retrieved. This exploit only works if 'password recovery' in router settings is OFF. If the exploit has already been run, then it might not work anymore until device...

Linksys E-Series TheMoon RCE

Module exploits remote code execution vulnerability in multiple Linksys E-Series devices. Vulnerability was actively used by TheMoon Worm. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E-Series TheMoon RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Netgear DGN2200 RCE

Exploits Netgear DGN2200 RCE vulnerability through dnslookup.cgi resource. !/usr/bin/env python3 -- coding: utf-8 -- """Netgear DGN2200 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit, Httpclient,...

D-Link DCS-930L Auth RCE

Module exploits D-Link DCS-930L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS-930L Auth RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import...

D-Link DSP-W110 RCE

Module exploits D-Link DSP-W110 Remote Command Execution vulnerability which allows executing command on the operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSP-W110 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link PingTest RCE

Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Jovision camera credential disclosure

Exploit implementation for jovision IP camera Credential Disclosure vulnerability. If target is vulnerable details of user accounts on the device including usernames and passwords are returned. !/usr/bin/env python3 -- coding: utf-8 -- """Jovision camera credential disclosure""" import json impor...

ZTE ZXV10 RCE

Exploits ZTE ZXV10 H108L remote code execution vulnerability that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXV10 RCE""" import re import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Belkin N750 RCE

Module exploits Belkin N750 Remote Code Execution vulnerability which allows executing commands on operation system level. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin N750 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import...

Zyxel Eir D1000 RCE

Module exploits Remote Command Execution vulnerability in Zyxel/Eir D1000 devices. If the target is vulnerable it allows to execute commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel Eir D1000 RCE""" from kittysploit import from lib.protocols.http.httpclient...

Cisco UCS Manager RCE

Module exploits Cisco UCS Manager 2.1 1b Remote Code Execution vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco UCS Manager RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

firepower_management60_rce

firepowermanagement60rce !/usr/bin/env python3 -- coding: utf-8 -- """firepowermanagement60rce""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'firepowermanagement60rce', 'description': 'firepowermanagement60rce',...

Technicolor TC7200 Password Disclosure V2

Module exploits Technicolor TC7200 password disclosure vulnerability which allows fetching administration's password. !/usr/bin/env python3 -- coding: utf-8 -- """Technicolor TC7200 Password Disclosure V2""" import re import struct from kittysploit import from lib.protocols.http.httpclient import...

Agent Local Store (PowerShell)

Bootstrap encrypted local task storage on the implant before callback !/usr/bin/env python3 -- coding: utf-8 -- """Bootstrap encrypted agent-side task storage before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from...

Honeywell IP-Camera HICC-1100PT Password Disclosure

Module exploits Honeywell IP-Camera HICC-1100PT Password Dislosure vulnerability. If target is vulnerable it is possible to read administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP-Camera HICC-1100PT Password Disclosure""" import re from kittysploit import from...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

D-Link DIR-850L Creds Disclosure

Module exploits D-Link DIR-850L credentials disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-850L Creds Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ACTi ACM-5611 Video Camera RCE

Module exploits ACTi ACM-5611 Video Camera Remote Command Execution Exploit !/usr/bin/env python3 -- coding: utf-8 -- """ACTi ACM-5611 Video Camera RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler import Handler class ModuleExploit,...

D-Link DIR-300 & DIR-600 RCE

Module exploits D-Link DIR-300, DIR-600 Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-300 & DIR-600 RCE""" from kittysploit import from lib.protocols.http.httpclient import...

JVC & Vanderbilt & Honeywell IP-Camera Path Traversal

Module exploits JVC IP-Camera VN-T216VPRU, Vanderbilt IP-Camera CCPW3025-IR / CVMW3025-IR and Honeywell IP-Camera HICC-1100PT Path Traversal vulnerability. If target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """JVC & Vanderbilt &...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

TP-Link WDR740ND & WDR740N Path Traversal

Exploits TP-Link WDR740ND and WDR740N path traversal vulnerabilitythat allowsto read files from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR740ND & WDR740N Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Mikrotik WinBox Auth Bypass - Creds Disclosure

Module bypass authentication through WinBox service in Mikrotik devices versions from 6.29 release date: 2015/28/05 to 6.42 release date 2018/04/20 and retrieves administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Mikrotik WinBox Auth Bypass - Creds Disclosure""" import re fr...

TP-Link WDR842ND configure Disclosure

Module exploits TP-Link WDR842ND configure disclosure vulnerability which allows fetching configure. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link WDR842ND configure Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Brickcom Camera Credentials Disclosure

Exploit implementation for miscellaneous Brickcom cameras with 'users.cgi'.Allows remote credential disclosure by low-privilege user. !/usr/bin/env python3 -- coding: utf-8 -- """Brickcom Camera Credentials Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

Netsys Multi RCE

Exploits Netsys multiple remote command execution vulnerabilities that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netsys Multi RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

2Wire Gateway Auth Bypass

Module exploits 2Wire Gateway authentication bypass vulnerability. If the target is vulnerable link to bypass authentication is provided. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire Gateway Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...